Business Adaptability

How is small business adapting to COVID19?

NOTE: Since this article was posted it has been updated with new information.
 
When governors issued stay at home orders and business closings it was a shock to say the least. Businesses were deemed essential or non-essential, the latter being ordered closed for the foreseeable future with no re opening date. Small businesses of all sizes and industry are desperately hurting. It’s interesting to see how businesses have adapted to either reach their customers while closed or try to keep customers while operating under restrictions.

Businesses that provide personal services such as salons and barbershops do not have much choice. Restaurants were given a reprieve in that they could provide take out or delivery. Some businesses that were allowed to stay open are still seeing a decline in sales. People are just not going out. Even these businesses have had to become creative to develop more customers. One of the new buzzwords is contactless. Companies are using that description to reassure customers that you can obtain products without having to meet someone face to face. Businesses like hardware stores have begun offering curbside pickup to encourage shoppers that may not want to go inside the physical store. Ecommerce has increased especially for stores that are closed and have had to find other sales outlets.

A contactless marketing coup has been Little Caesar’s pizza portal. They offered in store contactless pizza pick up before contactless was a thing. They quickly adjusted marketing with the new terminology to point out their system of pizza delivery. Other delivery pizza companies are ensuring drivers wear gloves and masks, and leave the thermal delivery bag outside the door for the customer to retrieve the products. In addition to deals and sales there’s been other creativity to entice customers. Restaurants are offering ingredient kits to make your favorite menu item at home. Bakeries are selling cake and cupcake decoration kits. Gardening and craft projects, the list grows everyday of small businesses adapting to new marketing schemes.

What about when the restrictions ease? When everything reopens how are businesses going to change to reassure customers that it’s safe to patronize? As we’ve seen with the beaches around the country, when there’s a reopening some people are going to come out droves. Others will wait a few days or weeks to see what happens. And others may not return to restaurants and at all. A Washington Post-University of Maryland poll of 1,005 people found that Americans are wary to return to restaurants and retail.

Retailers will have to demonstrate what sanitization and distancing procedures are being taken to reassure customers that it is safe to visit. The stores that are open now are taking measures to sanitize. Grocery stores are limiting shoppers and installing shields at checkouts. Restaurants are limiting capacity and reassigning staff to compartmentalize duties to one person-one task. Other types of retail are installing shields, social distanced queue markers, and ramping up contactless pay devices. Others that didn’t normally wear gloves are now. And, of course, everyone is wearing masks. Store signs use to read-No Shirt, No Shoes, No Service. Now, No Mask-No Service!

Patrons have to know what is being down to ensure their safety. Receiving communications as to the efforts and seeing the physical efforts, employees wearing masks, limited capacity, shields at points of sale. all this goes a long way to reassure customers that they will be safe when shopping.

Some companies that sell services and some product based are able maintain operations by allowing employees to work from home. How will that change? Will companies move towards or relax work from home rules? If you’d Goolged the word zoom in January 2020 the search results would have been much different than they are in May 2020.  Now instead of the online dictionary definition (a more likely result) the first return is the website for the online video conferencing company. “Zoom” quickly became synonymous with web meetings. Japan’s business culture is having great difficulty with work from home. As technologically advanced as Japan is their business world is steep in tradition, requiring in person transactions and paper documents. 

What will go away and what will return to pre COVID? Sanitizing wipe downs, gloves, masks, and register shields will probably stay. Will we shake hands to close a deal? Or will elbow bumps be the new social norm of greeting and accords.

The deeper we go into the economic shutdown news of businesses adapting is breaking everyday. Here are a few approaches to rethinking how we do business. 

Still operating drive-in theaters are seeing a boom and entrepreneurs are looking to open new drive-ins. Music promoters are experimenting with drive-in concerts where venues will allow.

In addition to drive thru, Chick-Fil-A expanded curbside and added another feature. When the food is delivered to your car, it is carried inside of a plastic container. The customer then lifts their food bags out of the container. 

LYFT issued guidelines to reassure riders how they are ensuring clean and safe rides. https://www.lyft.com/blog/posts/lyft-launching-health-safety-program
A video of how Dutch restaurants are protecting employees and customers was released. https://m.youtube.com/watch?v=kz3oi4WIKl0

Social Engineering Facebook

Social Engineering

NOTE: Since being published, this article has been updated with new information. 

If you’re on social media, specifically Facebook, you’ve seen the 21^stcentury version of chain letters. Here of late there’s been lots of  “challenges”, quizzes, and tagging of friends to encourage them to keep the challenge going. List every country you’ve been to, list every state you’ve been to, favorite movies, pictures of pets, pictures of your spouse and/or your parents, and the most current- your high school senior photo, under #Classof2020.

Who knows who starts these but they catch on as cute or fun ways to pass the time on Facebook. They are also ways for social engineers to find out more than you want strangers to know. Using the short list above, how many total strangers would you exchange that information? Probably not many. But most people don’t have very secure social media accounts. They are completely open to public view. Simple searches, most likely by the ones who started these challenges, can find the responses to hash tags and/or using bots mine the information. Then using social engineering the hacker can construct quite a profile on you.

As if your basic profile information isn’t enough, add that to answers from the above examples. Now in addition to your name, age and/or exact date of birth, high school, university, town, they can add photos and names of parents, spouses, pets, etc. For example. Viewing someone's Facebook page who completed some of the more popular quizzes, one could determine the following.
Jane Doe
Born January 1, 1973
Lives in Anywhere, Iowa
Went to Anywhere High School and Iowa State University, graduating in 1994
Not married
Christian 
Her parents are John and Jeanine (Pictures)
Loves dogs, especially her German Shepherd Rover (Picture)
Has visited 15 U.S. states and Paris, Rome, and London (Pictures)
Loves movies, specifically classic romances
Lots of pictures of Jane and Check-ins at her favorite places (with dates and times)

All of this information is more than enough to construct passwords, answers to security questions, or even more nefarious real word activities.

Users feel comfortable within the confines of Facebook. Like with other cons these are perpetuated because of the element of trust. Trust that it came from a friend, so it must be OK. Or it’s only a harmless quiz about my favorite TV shows. Also, trust in the complacency that only your friends can see the responses. Once your friends start sharing then your information is exposed.

In addition to the cut and paste challenges there are external links to quizzes. The links take you to a third party site that runs the quiz and posts back to Facebook. Most have learned not to click on links in emails. Why would you click on a link within a Facebook post? Back to trust. A friend shared the post it must be safe.

Use social media wisely. Check your privacy settings. If you haven’t done so in awhile, change your password. Think twice before participating in cut and paste challenges and quizzes. You don’t want to be the one making the familiar post-Don’t accept any friend requests from me. I’ve been hacked!!

April 27, 2020 The FBI issued a warning not to participate in social media quizzes. The quizzes are based on "something you know; something you have; and something you are" all of which can be used to social engineer passwords.
FBI bulletin-https://www.fbi.gov/contact-us/field-offices/pittsburgh/news/press-releases/fbi-pittsburgh-warns-popular-social-media-trends-can-lead-to-fraud

Read other posts about privacy

Juice Cleanse 

Cleaning Up Your Online Presence 

One Born Every Minute 

What did you just say? 

Apple Employees Win Suit

A quick post to relay the results of a California court ruling.  

The California Supreme Court recently ruled in favor of Apple employees allowing them to be paid for after shift security searches. Apple requires employees of their product stores to be searched after their shift, checking for stolen company products. Employees filed a class action suit claiming that they should be compensated for the time required to complete the searches. Failure to comply with the search policy can lead to being fired.

A federal district court had earlier ruled in favor of Apple. Stating that the employees had to prove that they were being restrained from leaving. The case then went to the U.S. 9th Circuit Court, who returned the case to state court for an interpretation of state law regarding compensation. The California Supreme ruled in favor of employees and the case now returns to the U.S. 9th Circuit Court. The ruling, as of now, does not affect other states as it was not a federal court decision. However, once the U.S. Circuit Court considers California's Supreme Court decision it may rule in favor of employees. Compensation for requirements after an employee is "off duty" may be interpreted differently and cause a ripple effect through the U.S. regarding employee pay and overtime.

This is not the first time a California ruling has affected employee compensation. In 2018, The California Supreme Ruled that employers must pay employees for "off the clock" activities such as locking up, setting alarms, and other administrative duties. There is a federal rule called the de minimis rule that says that employees can be required to work small amounts of time, less than ten minutes say, that would be difficult to track administratively. However, California courts ruled that the federal rule had not been adopted under California wage laws and, therefore, did not apply.

De minimis Rule

The "de minimis" rule came from the Supreme Court in 1946, stating that employers, when considering amount of time worked, may disregard time worked over shift when it amounted to seconds or minutes. The U.S. Department of Labor adopted a similar rule under 29 C.F.R. § 785.47, which states, insubstantial or insignificant periods of time beyond the scheduled working hours may be disregarded. 

Under the Fair Labor Standards Act (FLSA) regulations, 29 C.F.R. § 785.11, if an “employer knows or has reason to believe that the work is being performed, he must count the time as hours worked.” The Portal-to-Portal Act, 29 U.S.C. §§ 251-62, amended the FLSA and relieves employers of the obligation to compensate an employee for activities such as: traveling to and from the actual place of performance of the principal activity and activities which are preliminary to or postliminary to the principal activity, which occur either prior to the time on any particular workday or subsequent to the time on any particular workday. 

This is a just a small sampling of the laws and precedents that would go into any court’s decision on compensation of employees after hours. There have been too many cases to cite here regarding compensation beyond work hours. Cases involving employee’s loading/unloading/resupplying company vehicles at home, answering phone calls, emails and texts. If California is the test, then the trend would lean towards the employee.

Small business owners have to take this into consideration as they apply policy. Whether for breaks, meal times, or after work communications, how employers pay employees may be changing.

Link for the Maryland Guide to Wage Payment and Employment Standards

Maryland bans the box

Maryland Bans the Box for private employers

NOTE: This article was initially posted in May 2013 and has been updated with new and current information.

As you may know, Ban the Box refers to removing the criminal convictions question from employment applications. Preferring that any discussion of criminal histories be done further along in the application process and in person. Hoping to make the process fairer for applicants.

In October of 2013, Maryland’s first Ban the Box law took effect. The law removed the criminal conviction question from State employment applications. At that time, there were only seven states with similar legislation.  Since then the Ban the Box movement has swept the nation with cities, counties, and states enacting laws. According to the National Employment Law Project, as of July 2019, there were thirty-five states and one hundred and fifty cities and counties that have Ban the Box laws. Thirteen states have laws that prohibit private employers from asking about criminal history on the application. As of January 1, 2020, Maryland became the fourteenth.

Maryland Private Employer law takes effect January 2020

The Maryland legislature passed a private employer Ban the Box law in 2019 only to have the law vetoed by the Governor. In one of the first acts of the 2020 legislature, the Maryland General Assembly voted to override the veto.

The new law states that, before the first in person interview, employers may not ask an applicant to disclose details about whether or not a criminal record exists. This law only applies to those employers with fifteen or more employees too include seasonal, temporary, and contractual employees.

So far only a few major corporations, such as Target and Walmart, have publically “Banned the box”.

Details of the laws procession through the legislative process can be found at http://mgaleg.maryland.gov/mgawebsite/Legislation/Details/hb0994/?ys=2019rs

Juice Cleanse

While I am not educated in computer programming or repair I am knowledgeable and proficient enough to make computers do what I need and understand how that occurs. Because of my lack of formal training I never doubt what can be done with computers, I just assume that I do not know how to make it happen. Anything is possible. So when I hear of new smart devices or electronic conveniences that make our life easier, I figure it only a matter of time until someone compromises the security. 

In November 2019, the Los Angeles County District Attorney published a public service message warning travelers of using public USB charging stations.

http://da.lacounty.gov/about/inside-LADA/juice-jacking-criminals-use-public-usb-chargers-steal-data-ff

How it works

Criminals either conceal a computer in charging stations or load malware onto the stations. Much like credit card skimmers at gas pumps. When someone plugs their device into the charging station via USB the criminals computer can access the device.  Or the malware is transferred to the device so that the criminal can access at a later time. 

There have been mixed reactions to the LA County DA report. But no one is saying that it can’t been done. More likely it is the effort versus the reward. Snopes.com reported, "While it is technically possible for crooks to steal information or install malware via public USB ports, this practice doesn't appear to be widespread".

Best practice-Use your own charging cables with a transformer and plug directly into an AC outlet.

Lasers as keys

Another threat to smart devices or rather smart homes is lasers. Researchers at the University of Michigan have created attacks using focused light to manipulate smart speakers. From as far as one hundred yards researchers could transform their voice commands into light beams aimed at the speaker. Once beamed the speaker reacts as if someone were speaking to it.

The results of the discovery mean that criminals could trick smart speakers into opening garage doors, smart locks, lights, whatever security feature that is linked to the smart speaker.

In our brave new world one has to suspect that someone is always watching or listening. And no computer, mobile device, or now the things that charge them, are secure.

Find other posts on skimming, WiFi, and smart device security in my blog archive. 

Move the sign

Went to MVA to meet with a fingerprint services company. The local MVA is a smaller facility compared to the State headquarters. This location has two entrances at either end of a long single-story building. The original intent was that customers with registration issues would enter through one door and licensing through another. Over time the entrances have become generic and there is a check-in desk at the center of the building. So it doesn’t matter what entrance one uses. 

Outside of one entrance is a sign for the fingerprint services company. One would guess that customers would enter through the entrance next to the sign. Once inside customers find that the fingerprint office is at the other end of the building, closer to the other entrance.

I explain all of this because of what was observed while waiting. Inside the entrance opposite the fingerprint office is a Trooper stationed at a lectern. While waiting, I observed customers approach him several times with questions, some of which regarded the whereabouts of the fingerprint office. Appearing annoyed the Trooper would direct the customers to the other end of the building.

The Trooper is stationed there for building security, not information. But stationed at a lectern, in uniform, near an entrance is going to attract questions. It would not relieve all of the questions, but simply moving the fingerprint services sign to the building entrance outside of where the office is located would alleviate many.

Businesses large and small see this or don’t see it, a forest for the trees kind of thing. Simple solutions that will reduce stress on a job or person. Sometimes it is poor planning or the next great idea that wasn’t vetted at all levels.

Management makes changes for employee well-being or system improvement. If the people at the top are not completely familiar with the issue sometimes the change can actually cause problems. Management needs to see the problem from the source and get employee input at that level. Employees who identify problems have to be empowered to make “field” decisions that can quickly solve issues and improve service.

Sometimes simply moving a sign to a better position can make a world of difference. 

Can you buy an AR15 in Maryland?

NOTE: This post was updated in 2019 with current information regarding Maryland gun laws.

After a mass shooting, attention is focused on the availability of the weapon used. Most times that weapon is a semi-automatic, assault style, rifle. How did the person obtain the weapon and why is it available to public, are the questions usually asked. As you probably have figured out gun laws in the U.S. are convoluted. Laws on gun possession and sale differ from state to state. Too many to try to explain in a single post. For this blog the question raised is-Can you buy an AR15 in Maryland? The short answer is no.

However, the weapon used in the Dayton, Ohio shooting could be sold in Maryland. The Anderson Manufacturing .223 caliber AM-15 used by the Dayton shooter is currently not approved for sale by the Handgun Roster Board (See Guns approved for sale in Maryland below). But a similar gun, the .300 caliber AM-15 is approved for sale in Maryland. A "loophole" to Maryland's assault weapons ban. 

Assault style weapons

The federal government and some states have strict laws regarding the regulation and availability of fully automatic weapons or machine guns. What is more readily available are assault style weapons that are similar to what the military uses but in a semi-automatic capacity (firing one bullet and automatically reloading with each depression of the trigger). “AR15” is a type of civilian rifle modeled after what the U.S. military issues. Although it is a specific product the name is also used incorrectly to identify a wider variety of assault style weapons. When, in fact, there are many different manufacturers and models.

The Federal government banned semi-automatic assault style weapons in 1994. However, the ban expired in 2004 and those guns became legal for sale once again. Maryland banned the sale of what is defined as an “assault rifle” or ”assault long gun” in the Firearm Safety Act of 2013. The types of weapons included are what are commonly known as “AR15”s and all variants or copies. However, persons that legally possessed these types of weapons prior to October 1, 2013 could continue to possess them. They just couldn’t be sold within the state.

The Maryland State Police is tasked with regulating firearm sales in Maryland. This link, Maryland State Police Firearm Search, explains what can and cannot be possessed and sold. Other states with bans on the sale of assault style rifles are: California, Connecticut, Massachusetts, New Jersey, New York, and the District of Columbia.

Guns approved for sale in Maryland

In addition to regulating the sale of firearms, Maryland law also determines what guns can and cannot be sold in the State. Handguns manufactured after 1985 can only be sold in Maryland if the Handgun Roster Board has specifically approved it for sale and placed it on the Official Handgun Roster. The Handgun Roster Board is part of the Maryland State Police and consists of eleven members-The Secretary of the State police and ten people appointed by the Governor for terms of four years.

You may search manufacturers to determine if a handgun is on the handgun roster and legal for sale in Maryland thru this link.  Handgun Roster search

Waiting periods

Waiting periods and firearm sale laws are also being discussed in the news. Maryland has some of the strictest firearm laws in the country. 1995, 2000, and 2013 saw major legislation packages passed that restricted the sale and types of firearms that could be sold in Maryland. Even before that, in 1966, Maryland was one of the first states to pass legislation regarding waiting periods for purchasing handguns. Since 1966, a firearm dealer must wait seven days before the gun may be transferred to the purchaser. During this time, the Maryland State Police conducts it’s background check of the prospective purchaser. The Responsible Gun Safety Act of 2000 expanded the waiting period and background checks to include the private sale of handguns between individuals.

Only nine states and the District of Columbia currently have waiting periods-California, Florida, Hawaii, Illinois, Iowa, Maryland, Minnesota, New Jersey, and Rhode Island. Waiting periods for gun sales received a boost on February 20, 2018 when the Supreme Court dismissed a 2^nd Amendment challenge to California’s 10-day waiting period as a “reasonable safety” precaution.

Please feel free to share this post. See the blog archive for more information on buying guns in Maryland.

How to buy a gun in Maryland January 2017