Transportation Business Resources

(DESCRIPTION)
Screenshot: SiriusXM. Icons: YouTube, LinkedIn, Facebook, Apple Podcasts, Spotify, TikTok, X. The host in a black T-shirt and a baseball cap with the What the Truck? logo, and a beard and mustache sits at a desk covered with items including a pair of shoes that say What the Truck?, two toy trucks, a model airplane and figurines. Text on right sidebar below a photo of apples: Today's Show. Freight Magic, How About Them Apples, Scott Cornell, Managing Your Risk Profile, and Don't be a Stranger. Below is a QR code and the logo, Truck Stop. On the bottom of the screen are the What the Truck logo and the crawler, Headlines, Union Pacific has assessed peak season surcharges out of Southern California. Court allows CBRE to sell Yellow's remaining properties - A Delaware bankruptcy court ruled Friday that Yellow Corp. could retain real estate broker CBRE to sell its remaining terminals, which include 46 owned and 70 leased locations. Counsel for the debtors also said submission of a final Chapter 11 bankruptcy plan to the court will happen in the coming days, ahead of the expiration of the company's exclusivity period. Crawler continues. The main screen splits to the host on the left and Scott Cornell on the right. Scott Cornell, Transportation Lead and Crime and Theft Specialist, Travelers.

(SPEECH)
HOST: I don't know. Anyways, we got Scott Cornell from Travelers on now. Scott, thank you so much for coming back to the show. I started with a news story that was probably something that's something for your heart. But today, we're going to get into talking a little bit about risk profiles and everything. But before we get there, thanks for coming back on the show.

SCOTT CORNELL: Yeah. Thanks for having me back. It's nice we got a rotation. Obviously, you talk to different people here and there here at Travelers for different topics, but it's always good to be on. I enjoy it, so thanks for having me.

HOST: Now today, we're going to talk about risk profiles. When people talk about risk profiles, what are we talking about?

SCOTT CORNELL: Yeah. So there's a lot to talk about today. So I may actually be referring to some notes on this one. So your risk profile is sort of like your credit score. There's no actual score but lenders look at your credit score, and they decide, are you a good risk for a loan? The insurance industry is going to take a look at you and decide, are you a good risk, are you an average risk, or are you a worse risk?

So just like you want to try avoid having a bad credit score, you're going to want to try and have a good risk score or a good risk profile, more so because, again, there's really no score. But it's more of how do you look as a risk? So you want to make sure that you look good.

HOST: Yeah, no. That makes sense. So now that you've kind of set and defined what it is, let's get into it. Hit it, Scott.

SCOTT CORNELL: Yeah. So a few things are really going to come into play for that when it comes to the transportation industry. What types of loads are you hauling or warehousing them? What are your contracts look like and what are you doing to mitigate all those risks? So if we start with the commodities.

We're in one of the toughest transportation economies. You talk about this all the time. But we're in one of the toughest transportation economies that we've seen in years and it continues to be challenging.

So in that kind of an economy, are you taking on loads that-- are you tempted to take on loads or accept loads that you normally wouldn't? Things like lithium ion batteries. In another episode coming up, you're going to be talking to Craig Leinauer and he's going to be talking about commodities like that.

Are you taking on electronic equipment that's susceptible to theft? Are you taking on machinery that really can't be repaired, or the warranty is going to be voided if any kind of damage happens? You sign the contracts on those loads. What are those contracts look like? Are these contracts that normally in a good freight economy, you would push back on a little bit, or you'd red line some of the wording, or are you just taking on what they put on your desk because you're stretched and you need to make sure you're keeping loaded, right?

And if you're a warehouser, are you taking in commodities that you normally wouldn't take in or you're not equipped to take in? So if you take in something like cooking oil. Cooking oil is highly flammable. So if you have rows, and rows, and rows of cooking oil in your warehouse, here at Travelers, we have a risk control specialist that would likely be able to evaluate if you have the right facility or the system. That's a class 4 fire risk.

A class 4 fire can burn through metal. Water can actually make the fire worse rather than putting it out. You need special fire extinguishers for that. Sometimes, you need walled off rooms to contain the fire. So you could be taking something on that seems harmless on its surface, but it actually is a big fire risk. And are you aware of that?

HOST: Wow. Seed oils. If their PR wasn't bad enough, we got cooking oils. Who knew? You also mentioned contracts. Usually, when you're getting a commodity like this, there's some contract that goes out. Let's talk about your risk profile and how the contracts can affect that, especially in this economy where you might be more apt to maybe bring on commodities you're not used to.

SCOTT CORNELL: Yeah. The contracts that you sign are critical for your risk profile, especially as a freight broker. But the more you sign on for, the more liable you're going to be. The more liability you accept, the higher risk you're taking. So are you insured for that risk?

In a down economy, we see people tend to sign contracts that they might normally redline or push back on, and that can be really dangerous, especially when you're not used to doing this. You're not used to taking on that additional risk. So if someone puts a contract in front of you and you accept it, that could put you in a scenario of risk. So you've got to have good review of your contracts and this is particularly important in that freight broker space.

In a freight broker scenario, are you taking on the risk of a trucker? Are you agreeing to be liable as a carrier? That's a lot of additional liability and it's something that freight brokers usually want to avoid in a better transportation economy. So a tougher transportation economy, it's important to keep the business flowing. But if you take on too much liability, that can be a real problem for you.

HOST: So what's a freight broker, a carrier, or a warehouse operator supposed to do to get a handle on all this?

SCOTT CORNELL: Make sure you have a conversation with your agent about all these things. And that you're discussing, does your policy have the right coverages for the risk that you're taking on? Is it going to pick up the liability that you're picking up in the contracts that you're signing?

You want to balance that profit of the load. If you haul freights of all kinds and dry goods and then say you take on 3% pharma ingredients, 3% is not much. But if the customers want to give you more and you're trying to stay loaded so you're going to start taking on more, you really have to take on or consider that rate. Is the rate good for the risk that you're taking on? Do you need to increase your limits? What will the cost be for that?

If you're hauling high target electronics, that are high target for theft, and you're hauling them in one of the highest cargo theft areas in the country, to one of the highest cargo theft areas in the country and the cost of insurance for those two loads that you didn't normally haul or you wouldn't normally haul is so high that the margins are so small, is it even worth the risk? So you have to consider all that.

HOST: Got it. So you got to make sure-- you got to check your insurance coverages, you got to make sure that. It ties so back into the story, like you mentioned. Electronics the number one stolen thing, Ontario. So you're going Ontario, Canada. Toronto area, 93% of cargo theft. Your risk profile. It's what we're talking about. Your risk profile's gone up a bit. Now you got to know the insurance. But failing the insurance or having the insurance, what else?

SCOTT CORNELL: Do you have a good risk control person on staff or a safety manager? Do you have good process and procedures in place? The risk managers who oversee things. Do you have legal counsel on staff that gives you good advice on how those contracts are worded, and what liability you're pulling in when you're taking on those new contracts?

Do you have a risk department? Ideally, you have a combination of risk control and legal safety managers that are going to give you the best advice and put you in the best scenario. If you don't, are you partnered with an insurance company that can provide some of those services? Are you partnered with somebody that has a dedicated risk control team like we do, that specializes in transportation and can help you examine those risks and really have a clear view of what you're taking on?

If you're talking about theft, you and I have talked about theft numerous times. We have our special investigations group and that team works to recover cargo, but they can also work with our clients to evaluate the risk that you're taking on theft-wise and help you put good processes and procedures in place.

Do you have good training for your staff on the risk that you're taking on? Driver safety. Proper loading of the cargo. Proper cargo theft prevention through something like our sig team. Are you partnered with somebody that can help you build all those things, put all those things together if you don't have them internally.

(DESCRIPTION)
Screenshot: SiriusXM. Icons: YouTube, LinkedIn, Facebook, Apple Podcast, Spotify, TikTok, X. The host in a black T-shirt with the What the Truck? logo, a baseball cap and beard and mustache sits at a desk covered with items including a pair of shoes that say What the Truck?, two toy trucks, a model airplane and figurines. Text on right sidebar below photos of the host and three other men, with the What the Truck? logo and the title, How Cargo Thieves are Using AI: Today's Show. Nooner with Dooner, The Shot Heard Round the World, Prime Day, Project 44 L.T.L. E.B.O.L., On Deck. Below is a QR code and the logo, Talon Logistics, Inc. On the bottom of the screen are the What the Truck? logo and the crawler, Headlines, CSX has become the fourth Class 1 railroad to join RailPulse, the telematics joint venture that aims to put GPS equipment and sensors on freight cars to monitor their location and health in real time. Crawler continues. The main screen splits to the host on the left and Rehman Khan on the right. The right sidebar changes to, Today's Show, Rehman Khan, AI and Cargo Theft, Tesla Malfunction? WTT Gear dot com, Kyle Taylor.

(SPEECH)
DOONER: So, let's talk a little AI. We got Rehman Khan. He's Assistant Vice President, Cyber Risk Control at Travelers. Great to have you on the show. Thank you so much for coming by.

REHMAN KHAN: You bet. Thank you very much for having us. It's a great opportunity to be here and to speak to your listeners. So excited to be here.

DOONER: Of course. And look, I know that you're incredibly qualified to talk about this topic. But for people who have not met you before, what do you do over at Travelers?

REHMAN KHAN: So, a little bit on the personal end, I have been in information security for the last 17 years. I have spent some time with Department of Defense supporting our fighter jet platforms in terms of security architecture, how they communicate with allies, air-to-ground information security channels. And as of late, last, I want to say about a good eight years, have been focused on commercial applications of information security. I have been with some financial institutions in the past, currently with Travelers.

And my day to day, typically it revolves around connecting with our insureds, our applicants that are looking to take out a policy on what their security controls look like, what the gaps may be, what the opportunities are and how we perceive risk. So basically, trying to quantify risk to a very high extent to be able to pinpoint exactly where we want to be in terms of our pricing. Do we even like the risk? Is that something we want to underwrite or pass? So, taking a look at the cybersecurity programs of the organizations that they're trying to take out an insurance policy with Travelers.

DOONER: Great. So now when most people hear AI, they're like, great, I'm going to give it a prompt to make a funny picture or something, or I'm going to have it summarized. When you hear about AI, you're in cyber risk. And you have to say, uh-oh, what could the threat possibly be to supply chains?

REHMAN KHAN: So, the threats, it's really interesting how every few years we have a term that is tokenized. Previously, it was blockchain. Nowadays, it's AI. Prior to that it was cloud. So the trend goes on and on.

When I look at AI, it's simply a matter of how efficiently an organization perform a task. Now, the issue with AI is that it is available, it's cheap, it's free in most instances, and the free versions right now are very capable of providing to you the information you're looking for, whether you're trying to figure out what your medical condition may be or you're trying to figure out how best to write a cybersecurity vulnerability exploit, how to exploit a vulnerability, for instance, Windows. And AI is capable of pulling information from multiple sources. It's capable of putting it together in a, um, ingestible format.

And you can actually tell it to write certain scripts. You can tell it to divulge information. You can also get it to crunch a lot of data for you. And that's what most of us are using it for nowadays. You take a paragraph, you put it in and tell it to summarize it for you and give you an opinion, it will do that.

Within the trucking industry, what we're seeing is attackers or thieves are focused on figuring out exactly how best to get into the systems and start stealing information. Now, trucking industry revolves around a lot of documentation. You have your freight way, airway bills for the freight. You have your release documentation. You have all of these different trucking organizations, truckers pulling into a hub to pick a freight.

From an attacker's perspective, if I were an attacker, and what we are seeing as a ground reality is that they're not only using AI to exploit your computer systems, your system of records, but they're also looking to pull templates on what a airway bill might look like. Instead of guessing and pulling Google images to figure out what a bill of material might look like, now they're getting actual information from whomever has posted some examples of their airway bills online. They're looking at what are the patterns of trucks moving in and out of an organization, what are the best times to pull in, what are the best times to pull out. They're doing a lot of data mining on vulnerabilities that are very cyber and technology focused.

And they're also looking at your processes and procedures and figuring out how best to exploit it. For instance, if I walk into a facility to pick up a load, the organization might take a look at my driver's license, they might look for some insurance and other forms of documentation that's required to pick up a freight load. As an attacker, I can pull this information, I can forge it very, very easily, and then be able to go back out there, pull that information at the counter, pick up a load and just disappear. So, a couple different vectors in terms of how the trucking industry may be attacked right now.

DOONER: Yeah, and it's AI. It's just a tool so we use it for good or for bad. Staying on the bad side, so you mentioned that these things could be hacked. What have we got to look out for? What have we got to look out for on the bad side of AI in how this is going to factor into trucking?

REHMAN KHAN: See, we tend to as-- as humans, we tend to fear what we don't fully understand. And that's just the ground reality. What we see as a pattern and what we would suggest people look out for is the degree of automation and the implementation of artificial intelligence within their systems.

Organizations will naturally bring in AI and artificial intelligence tooling to automate their processes, to automate a lot of the systems, streamline their procedures internally, streamline their security. Now, every single one of these things, because they are tied to a technology pattern, naturally, attackers are able to bypass a lot of this using AI on their end. For instance, if I'm using AI to start populating tons of information based on past orders or past deliveries or past system of records, attackers also have access to a lot of that information online.

Attackers will be able to pull a lot of information on how trucking industry is using AI, what are some actual implementations of AI technology, and they will be able to come up with ways to bypass. So, what we say is be responsible in assessing your use cases and be very, very mindful of the human element that can make mistake. At the core of all technology, whether it's successful or failing, is a human being. And all we need is one human element to fail at their job and let the intruders or the attackers in.

Previously, as all of us listening today would occasionally check our emails and there would be the Nigerian Prince attack. You are now entitled to $17 billion. All I need is your bank account information and I'll send you the check.

Within corporate America, within the corporate space, within the industry, you have your email addresses out there. Someone needs to just figure out exactly who to pinpoint an attack, send that email, get a foothold of your network by exploiting a weak link. And from that point on, they're on the network observing and absorbing everything that is going on, including how your AI systems are working.

So, we have to be very mindful of the fact that AI is successful till it's successful. But when it fails, you will fall back to your traditional attack vectors. So, a very detailed security risk assessment is definitely required, and every use case should be vetted.

DOONER: Yeah. And I get texts from Craig Fuller all the time telling me to get him some Apple gift cards. Seemingly, he changes his phone number all the time. I haven't got them yet. I won't name names on who here has, but it has happened before.

REHMAN KHAN: True.
DOONER: OK, so thieves can use AI. Great. Let's get rid of it, right?

Or is there anything good? Can we do bots versus bots? Is there a good side to the trucking industry for the AI?

REHMAN KHAN: There are some great use cases. So, attackers will always be there regardless of how bulletproof your system is. Within information security, before I respond to the question, there is a saying, it's not a matter of if, it's a matter of when.

Today, those of us that are deeply involved in cybersecurity, we hear a name of an organization in the news that has been exploited. And we don't really think twice about it or pay too much attention to it. And the reason is not that we're negligent. It's simply a matter of, oh, OK, you too?

Think about AT&T. What is it, 110 million? 110 million records, your text messages, private conversations, everything has been leaked. Most of us folks out there, our Social Security numbers are on the black market. So, we are already under attack all the time.

Now, in terms of the tools and what we can use AI to successfully implement and ease some of the pains of being in the business and operating, some of the examples are simply real-time threat detection. You have your security cameras, physical security. You have your entry points. You have your customer database. You can basically bring all these elements, all these data points into a central repo or in simpler terms, a system of record.

And from there, AI can basically massage the data and say, OK, on these days, this is what your flow pattern is. On certain days, you have less trucks versus on other days your traffic pattern shows x, y and z. Most of these trucks are traveling from the Midwest to the West Coast or down South, up North, what have you, to the East Coast. This is how best to optimize your path and your loads. This is how you should be distributing it.

There is with artificial intelligence, it's not just a matter of-- with AI, the core is not necessarily just the information it is sitting on. It is capable of massaging a lot of data, tons of data, and giving you a picture that you're looking for. So, you can also bring in your smart sensors, your IoT devices to figure out what's the best way to optimize the security of a building or a facility.

What are the best security controls we should be implementing? Where should the cameras be? What is the flow in egress and ingress to your facility, to your parking lots, et cetera? What are the human elements?

Let's take a look at when we hire someone, what are the data elements that we're picking up? And are we just running a background check on work history? Are we looking at your Social Security number, your criminal history? If we are, let's tie that together into our driver check-in system.

So, we know when IDs are scanned, a driver shows up with fake credentials, we should be able to quickly scan it. And AI will be able to tell you that, hey, the face and the ID does not match. Or it's a close match, but it's not 100% match. You need to look at something else. So, there are quite a few different use cases that can be implemented successfully to further better the operations.

DOONER: Just got to be aware on both sides. It's a double-- it could be a double-edged sword, especially in this crazy world.

REHMAN KHAN: It is.

DOONER: Always get your insurance. Always be safe out there. Go check out Travelers dot com. And sir, thank you much-- thank you so much for your time today on this important topic that we're all just trying to start to understand.

REHMAN KHAN: Pleasure's all mine. Thank you for having me.

DOONER: Thanks for coming by.