Episode 212 – CISA updates, taxing IT professionals, and standing by generative AI

[00:00:02.380] – Big time radio announcer
From somewhere deep in the cloud and the corners of the earth, this is the Killing It podcast, with a focus on helping you make sense and dollars of all things IT. With your hosts, Dave Sobel, Ryan Morris, and Karl Palachuk.

[00:00:21.770] – Karl
Welcome, everybody, and we have something very special for you today. Important information. At 212 degrees Fahrenheit, water becomes steam. At 211, it’s hot. At 212, you can move a locomotive or make electricity. We are happy to bring you episode 212 of the Killing It, Killing It podcast.

[00:00:48.400] – Dave
Karl, if we’re now steam, is that just a bunch of hot air?

[00:00:52.160] – Karl
We are a lot of hot. We’re beyond hot air.

[00:00:55.350] – Ryan
We are the droplets within the hot air.

[00:00:59.950] – Dave
It’s It’s a thing. Now, I want to kick us off with something a little bit fun. Gents, what’s your current pet peeve?

[00:01:06.830] – Karl
For me, I got to say this is just very personal, but ads on streaming media that I’ve already paid for. Netflix, Disney. I was like, Wait a minute, I paid for this. Why do I have to have ads? I don’t get it.

[00:01:22.770] – Dave
That’s a good one. Because they’re ad-free. That’s a good one.

[00:01:27.870] – Ryan
I know. The fact that ad-free is no longer ad Mine is broad, and I have stickers on my laptops now to represent it.

[00:01:34.570] – Dave
It’s data is greater than opinions. My continues to be the same pet peeve I’ve had for 20 years of my career is that opinions are always trumped by data. If you come to me with data, that is better than opinions, but otherwise it’s opinion.

[00:01:50.510] – Karl
This just reflects your addiction to reality.

[00:01:54.840] – Dave
It’s true. It’s my favorite truck. It is my favorite Trump.

[00:01:58.590] – Ryan
Dave is stubborn like that. He’s stubborn like that.

[00:02:02.640] – Dave
I made an entire job in podcast out of reporting on data. So yes, I am completely on board with that. But that is mine. Data stronger than opinions.

[00:02:12.350] – Ryan
See, now I’ll beat you guys halfway in between there. Mine doesn’t have nearly as much substance in the world, but it is something that there’s data to back up. My current pet peeve is branding for technology companies. That’s essentially just a word misspelled. You can probably think of 77 of them right off. This is a word, and it’s a general word, and I can’t trademark or copyright that word because it’s in the public domain. But if I misspell it, aren’t I clever and therefore marketing genius? I instantly think less of companies that their brand is just a misspelling.

[00:02:53.860] – Dave
It’s usually removing a Vowel at the end to slide the R closer to something else.

[00:03:00.340] – Karl
Did they run out of fake words like Intel and Pentium? Like, what the hell? I know.

[00:03:05.880] – Ryan
We no longer have… Well, if you watch all the commercials for the drugs that are being sold to us on television, they have officially run out of like, syllabus that they can mush together and make a brand name. Now they’re just doing stuff where it’s like, and this one, I can’t… When you put a G and a L and a Y, right in the middle of a word, and it’s preceded by a B, and followed by another another continent, that’s not a word.

[00:03:39.660] – Dave
It’s a glarful, for all your concentration needs.

[00:03:44.060] – Karl
European, and then it’s a proper name.

[00:03:48.430] – Ryan
Exactly.

[00:03:49.240] – Karl
I will make a final note on this. As a graduate of the University of Michigan, it really irritates me that the Ohio State has copyrighted, trademarked The. The word The is a trademark of The Ohio State University.

[00:04:09.740] – Karl
Today’s episode is brought to you by the Small Biz Thoughts Technology Community. The best deal in online communities for IT Owners is Small Biz Thoughts Technology Community. Memberships start at just $799 a year, and that includes a five-week course at IT Service Provider University. Grab all the details at www.Smallbizthoughts.Org.

[00:04:35.150] – Ryan
Excellent. All right, let’s move into topic number one. I’ll introduce this one. So nobody is surprised by the fact that cybersecurity is still an A number one priority for all of our customers as well as for us in the service provider world. The one adult voice in the room that has consistently been there to establish standards, to provide alerts, to notify us of things that need to be taken seriously has been CISA at the federal government level. We have all read the headlines. We know that there are changes, cuts, misunderstandings, perhaps, of what the original mission was that is redirecting the organization into new activities. A, I said to you guys at the beginning right here, the one adult voice in the room. In fact, my experience has been, especially over the last five months, it’s the one thing all cybersecurity professionals from every spot on the spectrum, politically, socially, culturally, financially, the one thing everybody agrees on, CIS is important. It’s being altered. What do you guys see that is happening, and how do you think that’s going to impact the broader world of technology in terms of degraded cybersecurity capabilities?

[00:06:00.040] – Dave
We’ll admit, I have some biases here, too. As the one who lives just outside DC in Northern Virginia, and actually has friends affected by the turmoil internally, I have to say, I have some biases here. From the perspective of it hits me in personal ways, too. But now that I’ve acknowledged that, let’s also say, Look, I’m with you. I think generally, we can look at since its formation, since it has generally invested in a lot of the things that are important to us as a country, If we believe the threat of cyber actors is important, and we’ve got portions of our military defund. This is this portion for civilians. What I’m actually thinking for me, the most important bit that I think is worth talking about here is, is I’m watching very closely the vendors that are saying something, which is mostly nobody. There’s a lot of crickets. Now, I look and go, vendors, particularly all these cybersecurity vendors, who say how important it is that cybersecurity is the biggest opportunity right now, and all MSPs and IT services companies should be doing cybersecurity, are shockingly quiet at the dismantling of the civilian portion of cybersecurity readiness.

[00:07:12.380] – Dave
I look and go, if it’s really as important as you vendors say it is, and you are also incredibly quiet here, I think that’s incredibly telling. For me, what I’m starting to say is, is when I’m looking at us as a community, as IT service providers, MSPs, the people, guys like us advising them, I’m looking for what do customers need. I think there is some real need here. But if the vendors are not willing to step up and do something about it when it really matters, well, does it really matter?

[00:07:43.440] – Karl
Well, and coming off of that, what’s the alternative? Because there cannot be nothing. This void has to be filled, and it will be filled by private organizations, by other governments. Unfortunately, I don’t know how small IT service providers get a hold of data that’s valid, that is safe, where you could say, I’m going to get these alerts, and I’m going to put them in some automated way into my system, and I’m going to rely on it, and I’m going to believe that it’s going to be legit, and my clients can rely on me. Because in a lot of ways, if you pick a vendor and they make a mistake, or they’re like, Oh, wait a minute. Yeah, that vendor is no longer to do business in the United States. Kaspersky comes to mind. I picked the wrong vendor. Now, what do I do? So there can’t be a void. There has to be something. We have to figure out how do we get the government to put a little funding into this and into the right thing? You can’t wave your hand and say, Just don’t do anything. That is not an option.

[00:08:57.400] – Ryan
Yeah, doing nothing is not an option. Now, I recently went to the RSA conference in San Francisco. By the way, reports of San Francisco’s demise might be a little bit exaggerated. The town definitely has some fraying around the edges, but it was good to see 45,000 people come back in for a very substantial conference and put everybody on the same conversation. There were nearly 700 exhibitors there. I came away, A, with a headache, and B, with an overwhelming sense of there’s a tool for that. There is a way to solve all of these problems. But the one thing that I also came away with was if there is not a central version of the truth in a cyber environment, then all the tools in the world make it worse. You are going to be chasing bogeymen, and you are going to be ignoring truly important things if there is not one centrally agreed upon version of the truth. I don’t think that that is the role of a single vendor. I don’t think that you can have a person selling a piece of technology saying, mine is the one true answer to rule them all, and you should buy this software instead of that software.

[00:10:16.520] – Ryan
That will never be credible. There has to be that unifying voice. I will also report from the floors of the convention, everybody in private was freaked out about what was going on. Everybody Every serious cybersecurity professional of every persuasion was freaked out about what was going on and how we are or are not continuing the centralization of this. The frameworks, the new versions of approaches, the way we can apply technology with method to make a difference in cybersecurity, every one of them agreed, no matter what I’m doing in my little pocket of the universe, if there’s not a central version of the truth, we’re all screwed. But to your point, Dave, I didn’t hear anybody say that out loud from the big stage. So maybe I missed that statement, and somebody can correct us, but people need to start saying that very loudly.

[00:11:14.910] – Dave
They need to start… And again, I look at this and say, if you believe that cybersecurity is not only important, important for customers, but also the giant opportunity that everyone says it is, you got to back that up with actual actions to defend it. I say there’s actually some interesting parallels with what’s happening over on the journalism side, where the element of journalists need to invest and protect and defend their space. Cybersecurity has thematically some of the same bits here. It’s about the communication. It’s about the coordination. It’s about getting the information out. There is an element here of if it is important, as we’re all saying it is, well, you might have to actually stick your neck out and make that happen.

[00:11:59.040] – Karl
Do you think there’s a vendor, maybe not one that we’re currently aware of, but some company somewhere that is saying, All right, it’s time to step up. It’s time to step in. We’re building the database. We’re building the infrastructure. We’ve got the data collection systems, and we’ve got the data reporting systems, and they’re about- Yeah, the Europeans.

[00:12:18.500] – Dave
I’ll say the Europeans, right? Because on the business of tech, I just reported on launching the EUVD, which is their own vulnerability database. They are working on replacing CVE because they have come to the conclusion it is unreliable out of the US. Now, there’s a lot of uphill battle for that, but the Europeans are stepping up to build their own version of it.

[00:12:40.510] – Karl
It’s quite interesting. The Europeans are the default, de facto leaders in the world on data privacy. Now, are you saying they will become the de facto leaders in the world on cybersecurity alerts and information from foreign attacks?

[00:13:00.320] – Dave
They have the opportunity to become. Right now, what they’ve said is we cannot rely on the United States. The United States is an unreliable partner and is no longer showing consistency and willing to invest. Rather than do that and wait, we are simply going to solve our own needs, but we’re also going to share those needs with those that want it. That, by the way, is how you become a leader, is that you make it easy to follow them. Well, I’m going to pivot us, and interestingly, in a way, it’s almost a related story to this, is I want to bring up the taxes for IT consultants in the delivery of IT services. We’re in the point now where both Maryland and Washington State have announced new taxes on IT services, cloud services, it oftentimes includes cyber security. We’re going to have to laugh and go, not to say we told you so, because I believe we’ve been talking about this on this show for a little while. In our warmup and prep for this, we were actually talking about that these guys are not even the first states to do this, that there’s a growing list of it.

[00:14:06.500] – Dave
And interesting, when we look at what happened in Maryland, there was a lot of discussion, a whole lot of stuff was included, and then back and forth and lobbyists got involved in the The only one left was IT services and all of its related pieces when the tax bill went out. Gents, I’m going to throw out to you, Hey, we’re talking to a group of MSPs and IT services companies. Taxes directly on their services? What say you?

[00:14:31.560] – Karl
Well, I will say one of the members of the board at National Society of IT Service Providers is also on the board of the Chamber of Commerce of the State of Maryland. They were heavily involved in this, but it was literally one of these things that at the last minute they said, No, okay, you’re going to kill this. You’re going to kill this tax on all services. Fine, we’ll just put it on IT. Boom, done. It happened so fast. The problem is for the rest of all the other states, this is exactly what you can expect to happen when two things are in place. One, budget deficits. We need money from somebody somewhere who’s got money that we’re not currently taxing. Oh, okay. Guess what? Those juicy folks at IT are a prime candidate. Number two, if we don’t have a seat at the table, then there’s nobody who can speak on our behalf when something happens. And I do not think this is the last time we’re going to talking about taxes on IT services.

[00:15:34.020] – Ryan
No. And I think that what you’re describing is, as I’ve understood it throughout my career, when things are new, they can swim around the edges. They can dance between the raindrops and not get caught by the regulations, and especially at a federal level where things are very inefficient. It’s very easy for a new upstart industry to say, Well, that’s not us, and we’re not included included in that, and therefore, your regulations don’t apply. But as an industry matures, not every industry does, because some of them just cease to exist. They do not succeed their way into full maturity. But any industry that does succeed into maturity becomes such a target, becomes so large that eventually people will come, A, with the regulations to say, We need you to do your jobs better, and then B, with the taxes that say, You guys do 75% of all of the revenue that happens in this industry, therefore big buckets of money that we can capitalize on. But the third one, and I think this is ultimately where our industry is not yet prepared and be where all the big damage can be done, very much as you’re describing, Dave, there will be regulations, there will be taxes, and then there will be backroom deals that happen in order to really shape the teeth of any of these organizational approaches.

[00:17:07.140] – Ryan
I don’t think that we as IT service providers have a voice yet at the table that is loud enough, large enough to really alter these things in our favor. But boy, if we don’t get one in the very near future, we’re going to look around and say, Oh, so there were some rules to the game. We just chose to think that we were different and we could innovate our way around it. I think that we will learn some old-fashioned lessons about how the dollars really get divided up. My call to action to everybody in the channel is, if there is somebody who’s saying, I’ll take that burden, and I will stand up and I will fight that fight, A, join them, B, fund them, C, say stuff out loud, because if you don’t do those things, you will take the short end of the regulatory stick.

[00:17:59.680] – Dave
Can I highlight how much I like big buckets of money? I just need to highlight. But again, I’m with you. I’m going to call them out because I said this on the business tech. I’m going to say it here as well. This could not be more of a commercial for the National Society of IT Service Workers. It just essentially is just that. Because if I look around, I stick my head up and go, all of the community organizations that are out there doing all kinds of different stuff, what are the only ones that are actually leaning into lobbying efforts at Any level, it’s the National Society. You can say, CompTA in its former self, backed off from that. Gta is making some noises, but frankly, I don’t believe they are capable of executing. I’m actually going to say it. I don’t believe they’re capable of executing on that because they’re trying to be a neutral space for vendors and service providers to come together. There’s a direct conflict of the vendor needs and the service provider needs when it comes to lawmaking that do not believe they will be able to reconcile, as opposed to the National Society, which is in the title who they’re focused on.

[00:19:07.010] – Dave
I’ll just laugh and go, Hey, who’s the only one who is focused on that, has let it out as their mission statement? If you’re looking for a place to get involved, that feels like the one place where you can do some work on this.

[00:19:20.870] – Karl
A little follow-up on the buckets of money, which is tempting. I want to love buckets of money, but I also feel like, it’s on the discussion. Don’t talk about that out loud because it is partly because we are so successful as an industry that IT service providers are being gobbled up by one another. There’s the deal of the week, the deal of the month. And politicians are not blind to that. When they see an industry that is so juicy, that private equity is coming in with billions of dollars and buying up everything they can find, they’re naturally going to say, It looks like a place to get some taxes. So how can we help them divert their eyes and figure out something to tax besides us? Because I’ll tell you what’s next is taxing your services, particularly for services that you resell that basically there’s nothing you can do except pass it onto your clients, whether it is Office 365 or anything else. And a lot of that stuff that’s been delivered has not been taxed since day one in 1994, when the internet became public. It’s just not been a thing we talk about.

[00:20:40.200] – Dave
By the way, I do believe that taxes are coming for that, and at some level, zero is unsustainable. I look and say, if this is the true delivery of product, which is what we talk about, in services as product, there is a logical extension of that to say there will be some tax revenue to that. In particular, because it is a component of it. I want to look at it from the perspective of, are the amounts healthy? Are they sustainable? Are they something that can be managed? And sensitive to the fact that we need to make sure that they are put in the right place. There’s a very different level of, say, taxing the delivery of services to a Fortune 5,000 company versus the delivery of services to a sub $2 million small business. We have progressive tax systems for a reason because you can actually balance it in such a way. It’s not necessarily a matter of saying, Hey, we’re trying to make this zero. It’s a, Can we talk about this in a way that’s healthy for the entire ecosystem and solves the problem?

[00:21:44.530] – Karl
Where in the channel should the taxes come? At the top of the bottom, somewhere in the middle?

[00:21:50.050] – Ryan
Yeah, somebody has to, and fingers will get pointed there, but I will highlight a point you just made there, Dave. When the thing that we sell is a digital service, when product becomes transient, that is the end result of all of this digital delivery and subscription economy, and where the intellectual property is something that you do not own, you just rent. That is something that will absolutely lead into the direction of this outcome. As an industry, we’ve been saying things like, There are no more products. You do not purchase and own anything. Everything is an operating expense, and we will move in that model. That’s a good idea, except what that does is it opens up a back door into, Okay, maybe all things that are operating expense are now taxable. So we will see more of that.

[00:22:43.440] – Karl
Sadly, the crystal ball is not very clear. All right, topic number three, under what circumstances should we rely on generative AI? You knew there was going to be an AI conversation, and we’re going to link into the show notes a great graphic and a description of a Boolean exercise that you can easily go through, looking at very simple questions. First of all, does it matter if the output is true? Yes or no? Well, if it doesn’t matter, by all means, you’re good to go rely on generative AI. If it does matter, then you need to ask, do you have the expertise to verify that the output is correct? If you If you don’t, then it’s a red light. Do not proceed. If you do have the expertise, then, okay, you might proceed. The third question is, are you willing to take full responsibility for inaccuracies? If the answer is no, do not proceed with generative AI. If it’s yes, proceed with caution. Note that there’s never a yes, always go option. The best you can hope for is the yellow light, which is proceed.

[00:24:00.760] – Dave
Hold on. I want to actually highlight the relevance of is it true? Because what’s interesting, true is a strong statement. I always say right is the way that I think about it from the perspective of… Because a lot of things that are opinions or that are where absolute perfection is not the end goal. In particular, there’s a lot of things that are marketing efforts or communication efforts, where there isn’t necessarily true, there’s communicating an idea. That’s where the element of, for me, there’s a lot of stuff that perfection is unattainable. I also think about this from the perspective of like, well, human. If I’m putting this through a human, am I also ensuring absolute perfection? Unless it’s going through a fact-checking process or something. There’s a lot of times where you’ll just write something which is designed to cause a discussion or spark an idea that fits into this. Is the output true? Well, it doesn’t have to be. It’s not solving for that. I think oftentimes we’re very limiting of our perspective of what has to be right when it actually that isn’t the goal, that the goal is conversation or communication or stimulating thought or something, where from my perspective, it becomes safe to use because the goal isn’t perfection.

[00:25:22.830] – Dave
Oftentimes, remember, humans aren’t perfect either. We need to confer against humans. Are we able to do this in a safe way? That said, the element of this that I think is really important is, is are you willing to take full responsibility for the output is the second portion of that, which is still coupled with the does it have to be true? If you’re willing to take the risk, right, of the fact that it may have an opinion that is a stronger or positioned differently than if you’re willing to accept that portion of the risk, it does move it into that green safe to use. But I think this framework is super useful.

[00:26:00.540] – Ryan
Well, and I think, again, the middle portion of this test is the one that continues to be true, but is relevant and is going to become much more significant in the future. Do you, the user, the craftsman who is wielding the tool, have the expertise to verify whether or not it is real, the output of the Gen AI is real, and to massage it, to improve it, to validate its existence. If you, the user do not know the topic about which you are asking Gen AI to speak, then maybe it’s giving you real answers. Maybe it’s giving you a load of confident bullshit, and you don’t know the difference. But that is, I believe, the ultimate deciding factor, because like you say, Dave, there’s a lot of debate. Does it matter if it’s true? I was working on words in my brain while you were talking there. Does it matter if it’s real? Does it matter if it is valuable? Does it matter if it is of impact and substance in the world? If the answer to all of those things is no, cool, be creative. Gen AI, some images that are really cute and clever, knock yourself out, right?

[00:27:12.680] – Ryan
But beyond that debate, you the user, do you possess the depth, the experience, the substance to determine whether or not what you are putting out is responsible and relevant and generally improving the discourse? If the answer to that is no, stop it. You are using… I always use this example. I’m not a handy person when it comes to physical tools and building stuff in this world, but I really, really enjoy watching television programs about people who are good at those things. But I always say to people, you could give me all the best tools in the world. You could build me a shed in a workshop and give me all of that stuff that would make the very best craftsman, I’d still be more willing or more likely to slice off my own thumb than I would be to deliver you an heirloom quality piece of furniture. It’s not the tools that matter. It is the craftsman, the human in the loop, that determines whether or not the output is fit for purpose or consumption. And if that’s not true, damn it, stop it. We’ve got way too many non-experts out there using tools to supposedly answer questions that are really just dragging down the discourse.

[00:28:32.110] – Karl
Let me just actually draw that out a tiny bit more, then we’ll get off the tools. But I saw a great commentary on YouTube about chop saws, miter saws. Somebody had made the comment like, You can’t get accurate cuts on miter saws. The first comment was, You can’t get accurate cuts on the miter saws. Don’t blame your tools. The thing every craftsman knows is if you’re blaming the tools, your skills are not quite up to spec. And what’s interesting is a lot of the words that float in my head are not the words that either of you have used with this. I might replace truth with accuracy. I might say, Well, maybe we need some subroutines on this simple Boolean diagram. That’s okay, is it useful? Does it communicate? Ultimately, the goal of communication is to transfer information and opinion. Those are two very different things. So does it help me feed my brain what I need to take things internally, to make decisions, to make good choices, blah, blah, blah, to do my job better, to deliver better services to my client? Is it useful? Anyway, I do think that this is a place to start.

[00:29:52.020] – Karl
It is a great place to start. I encourage everybody to go take a look at that and then argue with somebody about it.

[00:29:57.860] – Ryan
Well, and also, let me just go back and add on on top of what you just said there, Karl, absolutely zero of us in this conversation are suggesting that Gen AI is not a useful tool, and we are not here to be scoled and tell you, Stop using those tools. We are personally using these tools to great effect and for a responsible purposes, we hope and we believe, but also to expand reach and coverage and capacity and to do things bigger, better than we could do with manual labor. That is the purpose of technology and tools and has been since the invention of the basic lever or inclined plane as a piece of human-invented technology. Please use these tools. Please actually become an expert. Also as a service provider, please use the service capabilities you have to prepare and support your customers in their ability to use these tools. We’re not here to tell you not to use Gen AI. We’re here to tell you, Stop it with the irresponsible use. And by the way, if you can be the guy who charges to validate whether or not your customers are the correct ones to be using that and then enable them to use it responsibly, you should charge a lot of money for that.

[00:31:16.120] – Dave
Remember, the pursuit of perfection is what often makes you inability to ship. And I think about that framework a lot when I talk about generative AI, the fact that I don’t necessarily I’m not looking to achieve perfection, but that comes down to in places where I need perfection, this may not be the right tool.

[00:31:38.160] – Karl
Exactly. That brings us to a close. I’m not sure we reached any perfection, but we did reach 212 degrees and 212 episodes. Thank you for tuning in, and we’ll see you next time on the Killing It.

[00:31:50.790] – Dave
Killing It.

[00:31:52.390] – Big time radio announcer
Thanks for tuning in to the Killing It podcast. Please share with your friends and tell everyone to subscribe on iTunes and all the podcast places. Join us next week and help us keep killing it in the technology business.