UnHacked - Cybersecurity Made Simple for Small Businesses

Justin Shelley (00:00)
Welcome everybody to episode 68 of Unhacked. Mario, we've got an interesting one today. We talk a lot about cybersecurity. You know, we're here to help business owners navigate the chaos that involves, is involved with cybersecurity. We want people to come out stronger, smarter, and always more secure. ⁓ You know, and I'm kind of known for saying in my introduction that we protect people from lawsuits. And before I even go there, I'm just going to say today,

We're going to talk about a brand new set of lawsuits that I mean, I know about it. This wasn't brand new, ⁓ but it just kind of hit me in a way that it hasn't before. And I thought we needed to dedicate an episode to this. So, I know, and again, we're going to get to introductions, but I know just in prepping for this, you and I both got a little bit steamed. ⁓ we're going to talk.

Mario Zaki (00:48)
Yeah, this

actually has nothing to do with Russian hackers or any type of hackers whatsoever

Justin Shelley (00:55)
Right.

Which is why it's not really on the radar and or hasn't been yet. So ⁓ we'll we'll get into it. But first, let's do some introductions. I am Justin Shelley, CEO of Phoenix IT Advisors, and we help build businesses use technology to build their wealth, build their business. And then we help them protect that wealth from Russian hackers, aka the world government fines and penalties. And as we're going to talk about today, the lawsuits that come if we don't do everything exactly right.

Mario Zaki (01:18)
the

Justin Shelley (01:24)
God, it's a fun world we live in. Mario, tell everybody what you do and who you do it for.

Mario Zaki (01:30)
Yeah, Mario Zacchi, CEO of Mastek IT, located in sunny New Jersey. Well, not so sunny today, but normally. ⁓ We are located right outside of Manhattan, been in business for 21 years, and we specialize in keeping small to medium sized businesses safe and keeping business owners have the ability to sleep better at night, knowing that their company is safe and secure.

Justin Shelley (01:57)
Beautiful. Well, Mario, in all that, was it on your radar that you needed to protect your clients from lawsuits regarding their websites? Yes or no. Okay, here we are. So as I introduced the topic, Mario, we're going to talk about ADA compliant websites. If that's even the official term for it, ⁓ right up front, I'm going to admit this is not something that I specialize in. It's something that just kind of

Mario Zaki (02:09)
No, no.

Justin Shelley (02:27)
Smack me over the head today. So we're going to dive in. ⁓ and before I say anything else, I'm going to say, I'm going to be very clear that I am oblivious to the, the challenges that people face who have disabilities. And I'm, I'm grateful for it, but I'm also aware of it. I'm sensitive to it. ⁓ even, you know, as far out as I go in my circle, I don't know people who have major

disabilities that prevent them from doing things in life. don't get me wrong. The universe has not been kind to me. have plenty of challenges, but my body functions normally. ⁓ and this is a major problem for a lot of people who don't, am, I am grateful that we have laws that, you know, force businesses to put wheelchair ramps in, for example. ⁓ you know, if you can't get up steps, it's nice to have these alternatives. I've

I've been on both sides of it where, you know, I, I have had people temporarily injured, disabled, whatever, and had to use wheelchairs and it sucks. I've also been, you know, and where I'm remodeling businesses and, the inspector comes in and says, Hey, you have to put X percent of the remodel costs into additional accessibility. which I was very frustrated with. So, ⁓ we're going to get heated. We're going to get passionate. And I just want to be clear right now that we are not talking about.

the very real problem that people have and accommodations that are made to assist them. 100 % I'm all for that. What we're upset about today is the ambiguity, the vagueness and the horseshit lawsuits that are going on to small business owners who are not doing anything intentionally wrong. Is that fair?

Mario Zaki (04:14)
100%. And if I could add, I know what we mentioned ADA compliant, most people are gonna like, what the hell is that? I don't even wanna listen to this. But this affects large businesses, small businesses, even Justin, think before we recorded, you said one of the biggest targets, correct me if I was wrong, you said our companies that are making less than $500,000 a year, is that correct?

Justin Shelley (04:24)
You're right.

The direct quote, and this is from accessible.org, can small businesses be sued over ADA website compliance? The answer is yes. In fact, most of our clients are small business owners who use, oh, who use our services after being sued. Despite big companies getting the headlines, it's small businesses with less than $500,000 in revenue who are sued most frequent.

I mean, listen, I want to knock any level of business, but like short of a million dollars, you're just struggling. You're barely surviving, right? This, and this is the biggest target. So doesn't matter. And we hear that a lot, right? When we're talking about security and other things that people need to spend money on where technology is concerned is I'm too small. I don't have to worry about that. Not the case here. Not the case here. So, all right.

Mario Zaki (05:32)
Now, I

guess we should explain what ADA compliance means when it comes to websites. Is that correct?

Justin Shelley (05:39)
Yes, you got that one. Roll with it. Okay.

Mario Zaki (05:41)
Yeah,

yeah. So ⁓ pretty much what it means is every website, and obviously websites are easily accessible for everybody, you know, from a computer, smartphone, even some watches now can browse them, you know, web. And every website, and this is a federal law, not a state. So this is nationwide. There are some laws that says that your website has to be easily

viewed or accessible by ⁓ people with handicaps, like, you know, vision and stuff like that. And if it's not, if it violates anything, you are, you know, open to have lawsuits. Okay. Now the problem is with this is ADA compliant. There is no clear cut list of what you need to have. It's not like it's saying you need to have

you know, text to speech, doesn't actually say you have to have this. It doesn't say you have to only be able to use certain colors or your font size needs to be a certain size. Okay? It's very vague, very gray, and that's the problem.

Justin Shelley (07:01)
it's a big problem. there's, you know, we talk a lot about frameworks or right. You know, I bring that up quite a bit. ⁓ those are black and white. They're clear cut. You do this and, and you can check that box. You don't do that. The box goes unchecked and it dings your score. That's what we don't have with, ⁓ eight, 88 compliance. We have the, what is it? The WCAG, ⁓ which has published some guidelines, right?

But that's all they are is they are guidelines. it's kind of a crap shoot, depending on what court, what attorneys you, you have, or you find yourself mixed up with. so yeah, it's frustrating. And you know, on that note, here's, I'm going to tell you exactly where this whole thing came from for me. told you it kind of caught me out of left field a little bit. And again, I'm not saying I haven't heard of this before, but I, the gravity of it, guess, never really hit me. So, ⁓

I'm cruising my favorite online platform and I read this. I run a small online boutique and today I received a demand letter claiming that my website isn't compliant with the ADA and WCAG standards. They're threatening to sue unless I either pay a settlement or fix the issues right away. The problem is I honestly didn't even know this was a requirement. After some frantic Googling, I learned about WCAG levels

accessibility rules like alt text, keyboard navigation and color contrast. But honestly, it's all overwhelming. I don't have the budget to hire an expensive developer right now. And then the conversation ensues back and forth with, you know, I, I can't take any, or make any claim to the credibility of the comments, but I did read through them and overwhelmingly the answer is yes, this is real. Yes. This is a problem. you have

to fix it. And you know, the more I dove into this, the more I realized, like, once you get deemed, you're you're paying money. There's there's no way out of this. You're you're paying to fix it a you're probably paying either a settlement or you're going to court and paying a judgment. And you've got lost opportunity, you've got you know, you should be working on your business, not fighting attorneys and judges and this kind of stuff. So ⁓ thoughts Mario, is this a real problem?

How real of a problem do you think this is?

Mario Zaki (09:26)
This is a very real problem. you know, from an overview, you know, most people are going to say, and I, I'm going to be one of those people that are like, ah, that's, know, this is BS or whatever. But I mean, we, when we sit there and research it more, we're seeing large companies get hit with million dollar settlements. Um, we're seeing small companies paying anywhere between 5,000 to 10,000 to 20,000 in settlements and stuff like that.

And the problem is, it seems like it's a money grab. This is an electronic ambulance chasers that are literally doing this stuff. And because we mentioned before, there is no clear guidelines. You know, a lot of times they may go to court and the case could get dismissed. There's a lot of them that we've seen get dismissed, you know, for several different reasons. But the problem is you still have to hire a lawyer.

Justin Shelley (10:05)
Yeah.

Mario Zaki (10:25)
you still have to do the investigations and stuff like that, do your due diligence. And as we know, lawyers aren't cheap. And do you really want to go into court just representing yourself, you know, and saying, well, this is BS because...

Justin Shelley (10:41)
Yeah. Not when I mean the

settlements, assuming you stay out of court or tens of thousands of dollars or can be, you know, five to 20, I think is the, average five to $20,000 for a settlement out of court plus your attorney's expenses. And if you go, ⁓ first of all, attorney expenses, I, the last time I considered going to court with somebody, my attorney said it's a $20,000 retainer and that's to get started. That's just to get started. ⁓ so we were not.

not cheap for companies making a half a million or less. one of the things that that's like kind of hard to hear for me is that there's no warning required at all. A disabled user or often their attorney can file a lawsuit in federal or state court without giving you heads up. It's just done. So

Mario Zaki (11:30)
Yeah. And

on top of that, it's not stopping from any other, anybody else from suing you for the same thing. So you can get hit with the same lawsuit, two, three, four, 10 times, you know, if they all hit you at the same time. Um, so, and you know, in a lot of cases and a lot of lawsuits, you know, usually if you have a settlement or it, you know, something happens,

Justin Shelley (11:37)
Yeah.

Mario Zaki (11:57)
Most law lawyers will put in there like all right, you can't come back and sue me for this issue again I am you know, we're done with this that is not the case here and that's what drives me crazy is you could end up being hit by ten of these at $5,000 a piece minimum and that's $50,000 right off the bat You know because you don't have the guidelines that says this button on your

Justin Shelley (12:18)
Right.

Mario Zaki (12:27)
website is not correct. It's not feasible. Okay, well what is it supposed to be? Nobody knows.

Justin Shelley (12:37)
Yeah. It's crazy. It's crazy. ⁓ yeah, like you said, you, think you called them a digital ambulance chasers. There are, there are just tools that will scan websites and pop up the warnings, the errors. In fact, we played with that a little bit before we got on here. anything you want to share as far as what you learned using this, ⁓ and, let's, let's give a shout out to one in particular that people can use cause it's easy to use and it's free. ⁓ wave w a v e dot web aim w e b

Mario Zaki (12:51)
Are you with it?

Justin Shelley (13:06)
⁓ That's the one I used. believe that's the one you used. I have no affiliation with this company. I just found them. They were recommended through some of this chatting that I was looking at online. I will link them in the comments. If you're listening to this on, your phone or whatever, or wherever you're listening to it, just go to the detailed description. I'll have a link to this. Please go check your own websites. With that, Mario, what did you learn using this tool?

Mario Zaki (13:11)
Yes.

I learned that it really this tool you put in any website and it will analyze it and come up with some of the the the issues that have found now with that said the two biggest issues that we have seen the two biggest ones is ⁓ the contrast so like you know the back the background versus the text on unlike the button or on the website itself and the other is the alternate

text on a link or button. So for example, if somebody goes to it and wants to hear what that button actually is, like book appointment, know, book now or something like that, you need to actually call that button saying call now. So when somebody uses their accessibility systems, it will actually read it to them instead of just says button.

Justin Shelley (14:30)
There's a button, yeah.

Mario Zaki (14:31)
Yeah, so those are the two biggest ones that we've seen. Those are like the two things. And I put in some random websites like Yahoo, Apple, McDonald's, you know, and even those sites came up with some errors. McDonald's surprisingly was actually the best one, you know, with the least amount of errors. But those sites also still had some errors. Now, not a tremendous amount.

And there is, you don't know what there is, there's no threshold. You can't say 50 % of your website is inaccessible or 1 % of your website. You could have one button that somebody mislabeled or didn't give it an alternate text. Does that make it a violation? That's the problem is we don't know.

Justin Shelley (15:05)
Right.

I mean, it's still being kind of duped out in court and, know, unfortunately, technology usually moves faster than the legal system does. So I, I believe at some point we will have standards that can be applied universally right now, as we've said before, in a lot of cases with technology, it's a wild, wild West. We're figuring it out. We're learning. And unfortunately we're learning, ⁓ with some very expensive lessons. So you mentioned alt text. that it's a lot of things you mentioned.

Mario Zaki (15:32)
Correct.

Justin Shelley (15:52)
buttons also on images. If you have a picture of yourself, you know, on like I do on my homepage, it has to say in the alt text. ⁓ what is that picture about? And like you said, so that a reader, ⁓ application that just describes or reads a website to somebody who can't see it. Then, you know, like you said, it's a button or it's a picture. And if we don't know what it is, that pose is a hardship. no captions on videos. That's another one color contrast. already mentioned.

Mario Zaki (15:54)
images.

Justin Shelley (16:20)
broken keyboard navigation. ⁓ I mean, I, hell I use keyboard navigation a lot. If I'm troubleshooting or working on something and the mouse doesn't function, ⁓ not what this is about, but, ⁓ some of this stuff is important, right? Forms not labeled for screen readers. that's one that I hadn't thought about. So, and you know, PS, Justin behind the scenes, frantically checking his website. don't worry about the time we publish this, I will have it all fixed.

but I mean, like you pointed out, there's, there's not a perfect, there's not a set standard. so what I don't want to do though, as I really hate that about our topic in general, we have to scare people to get people to take action, but I never want to leave it there with, you're screwed. Good night. because that goes against what you try to do with just to help people sleep better at night. So Mario let's shift to helping people sleep better at night.

What do we recommend for any business who has a website, which is pretty much all of us? What do we do?

Mario Zaki (17:26)
So the first thing is definitely to go to that site that you mentioned before that we have at length, Wave. The other thing is, I don't know the exact number of percentage out there, but I wanna throw something around, like 80 % of websites are ⁓ WordPress. And they do have some plugins with websites that you can do.

that will give you the ability to work towards making it better. I don't know if I haven't tested it completely. We will before this airs, but we haven't tested it completely to know how great it works. But at the very minimum too, discuss it with somebody that is either your website person or somebody that is familiar with websites that can easily do this now.

Nothing here is too crazy. You know like you you know you go to the website You know you go to my website you see a picture of me. You know just name that picture handsome bald guy You know and then you're ⁓ You know there ⁓ You're right I do have a little bit of hair

Justin Shelley (18:37)
Hahaha

Listen, we got to keep it honest, Mario. We can't have lies. I think there's legal terms for that too.

Mario Zaki (18:50)
⁓ That's it. Am I forgetting anything?

Justin Shelley (18:54)
No, I mean, I will say, and you know, again, this is what I hate this topic because it's just one more thing we have to do, which is frustrating. But what I do love about it is that it fits very neatly into what we already teach people know your weaknesses. Just go out and get the assessment, get that, get somebody to review it, find the fixes and create a plan, prioritize them, you know, get that, get the critical stuff, the easy stuff first. And by the way, I'm just going to say,

document the shit out of all of it. ⁓ you know, if, if you do get drug into some sort of a lawsuit or a threat of a lawsuit, having this plan, and we call it a plan of action with milestones or a poem, ⁓ it's, it's going to help your defense. I'm not going to say it's going to get you off the hook completely, but it's definitely going to be, ⁓ you know, when you can show a judge, like, Hey, yes, we did the test on this date. We found this many problems. We started fixing them. And here's

the paper trail of all the fixes that we've done so far. That's huge. So do something. Brian, who's not here today, always says, you know, it's, not a journey. It's a destination. Find it and just make gradual improvements, but document the hell out

Mario Zaki (20:11)
Exactly, exactly. Yeah, now go ahead Justin.

Justin Shelley (20:14)
⁓

Well, so there's, there's one other point that was made on this. I really liked this article I read or the, it's kind of a Q and a on accessible.org. Why do ADA website lawsuits typically settle? And I mean, this is kind of hopeless, but it tells you, ⁓ ADA website cases almost always settle because it is more inexpensive and quicker to settle a claim rather than to defend against it. If you have to try to defend yourself against one of these claims, even if they're these stupid ambulance chasers,

It's, cheaper to just to settle and we're talking, you know, five to $20,000. It's not chump change. So we want to hit this now, right? It's way cheaper. While we may not have the budget like that story I read when we started, don't have the budget to go out and redevelop my site. I bet for less than $5,000, you can make some significant improvements to your website in this area. I mean, really for a few hundred bucks, depending on who's doing your website for you, you know, where I have mine hosted, I can just throw them a list of things and say, go fix that.

Um, you know, and I don't have to pay anymore. So hopefully you're, on some sort of a system like that. But even if you're paying a developer a few hundred bucks, um, way better than a 5,000 to $20,000.

Mario Zaki (21:29)
Yeah, I mean, you can get a brand new website, you know, for, you know, for about under $5,000. And we're not telling everybody to go out there and get new websites. You know, like we mentioned earlier, some of the stuff is easily fixable, but just like what we tell everybody, the first line of defense, you know, the way to defend yourself is knowledge. have to first know what issues there are. Now that you're educated, you have to work towards

Justin Shelley (21:35)
Yeah.

Mario Zaki (21:58)
fixing it. And unfortunately, with just like everything else in this country, you can't plead ignorance. You can't say, well, I never even heard about this. How do you expect me to be compliant if I never even heard about it? And unfortunately, you can't that's not their problem.

Justin Shelley (22:08)
Right.

Yeah.

just what I needed, Mario, just what I needed on the end of an already busy and stressful week. One more problem, one more problem. But like I said, it's, it's, it's an issue. The world of business is finding problems and solving them. If we're not comfortable doing that, we probably shouldn't be in business in the first place. It is one more thing. ⁓ but it is something that we can, we can do. We can work towards, and honestly, this is probably not a popular opinion, but if this is not something that you can or

can afford to do or are willing to do your best bet is to take your website down. You know, like get your stuff up on a Google business or social media or whatever, and don't run a website. That is an option. It's not a great option, but if you're a small enough business where it's prohibitive to make these changes, ⁓ just take it offline. Don't have it because otherwise you're a target. There are literally scanners that somebody can use an attorney, a dirty attorney can just sit there and scan websites and pull the errors and that's it.

Piece of cake, simple money.

Mario Zaki (23:26)
We actually read that there's attorneys that literally hire what they call testers that just sit there and they scan websites and run it probably against the same tool to see if it's compliant or not. And now with AI, I'm sure they can do probably thousands of these websites very quickly and get a list of people that they need to just send out notices to. It is crazy.

Justin Shelley (23:38)
Right.

Mario Zaki (23:55)
This is out of all the things, you know, what episode are we at? We're on 68 out of 67 other episodes. I feel like this even though it's completely 100 % true is the craziest one that we have talked about

Justin Shelley (24:14)
And I won't rat you out completely, but you had way more colorful words on that before we hit record. Um, it's, listen, it's frustrating, right? I mean, we're Jesus Christ. We're just trying to conduct business and sell a service and make money and provide for our families and our employees. And, um, God, the nightmarish, um, administrative tasks that go along with running a business do get frustrating and overwhelming.

Mario Zaki (24:18)
Yeah.

Justin Shelley (24:41)
And I hate that sometimes we have to bring light to things that nobody wants to hear, but I would sure rather somebody hear it here, take some actions and avoid a lawsuit or downtime or, you know, being forced to take your website offline or whatever else. So, all right, Mario, unless you've got anything else, ⁓ super enlightening or cheerful, since this has kind of been a downer, ⁓ we'll go ahead and kind of wrap this one up. We'll keep it short today. Any, any final thoughts?

Mario Zaki (25:10)
⁓ no, that's it. mean, this is definitely something that we've haven't mentioned before, but it is very important because it is not something that you can, you know, that we easily help people all the time, you know, protect this computer, better firewall backup and stuff like that. This is something where most MSPs out there don't even offer website services. You know, like they can't, they may not even be able to help you.

And, you know, this is something that is very ⁓ important. is, it seems like it's getting worse. And like I mentioned, it, ⁓ it is nationwide. This is a federal thing. It's not, even though there are bigger loss, you know, there, we did see that there's more lawsuits in certain areas like, you know, New York, California, Florida, for some reason, those areas are a lot bigger or more, more, ⁓

we're seeing more lawsuits in those areas, it still affects everybody. And somebody that resides in like, know, ⁓ South Carolina can be sued by somebody in in Washington, just because your website is there. You know, they don't even need to do business with you.

Justin Shelley (26:29)
Yeah. It's a crazy world. It's a crazy world. All right. Well, I'm just going to reiterate, do something, run the scan. Like right now today, please run the scan, jot down a few things that you can fix. Simply take those actions and document it. Just take that one step today. ⁓ that in itself is not enough, but it's a place to get started. And then you just need to continue iterating through this process. pretty much indefinitely because websites.

they get updated and we have to constantly be on our toes. So, ⁓ yeah, that's, that's what I got. ⁓ and I have homework to do myself. So sure.

Mario Zaki (27:12)
I do have one question actually that I don't

know and I'm assuming the answer is yes. I guess every page on your website counts differently. Does it like your homepage have to, say you fix all the images and stuff like that on your homepage. What about our contact us page? Is that technically different?

Justin Shelley (27:39)
I, I,

I am not speaking as an expert, just using my best logic. I don't think you're getting away with any pages that are not compliant. I think they all have to be there. because again, I mean, if you put yourself like, okay, so we're, we're complaining about stuff that does impact us negatively, but let's for a second, put ourselves in a situation where you're visually impaired and you are trying to get information. Maybe it's healthcare information for yourself or for somebody else. And you're on a website.

And you know, you're using these tools and you get to the place where you need the information and it's on two or three clicks deep. And all of a sudden the information's not there for you, right? That's going to be wildly frustrating. ⁓ so I, can't imagine that it would only apply to the homepage, but I'm not an expert. And as you've already stated, this isn't flushed out completely right now. We're, we're still working through a lot of this, ⁓ to be safe. I'm evaluating every page on my website and I have a lot of them. So this is not a simple process, but.

Mario Zaki (28:29)
Yeah.

Justin Shelley (28:38)
there's, there's work to do.

Mario Zaki (28:41)
Yeah, because before when I was doing testing, I just did all the homepages, but then I realized, like, wait, you know, like, there's, that's just the front page.

Justin Shelley (28:45)
Right. That's one page.

Well, we're, using a free tool as well. That's, that's where we start, but ultimately, ⁓ there is some effort and some costs involved to it and your need to get a paid tool or a paid expert and have them really run through it and find the spots and fix them. And like I said, document it. and then another recommendation was to have a page where, ⁓ people can make suggestions for updates that they would like you to make for ADA compliance. So.

Get to work guys, homework assigned. And there's not even really like our ongoing free offer. Of course, go to our website on hack.live. ⁓ and you can get a free assessment from, from any of us that is, ⁓ cybersecurity related. If you ask me for a free assessment on your website to see if it's ADA compliant, I'm going to be pulling up one of these free tools and saying, here's what I got. but unfortunately I'm not the expert on this. I'm just bringing awareness today. Mario, you want to weigh in on that one?

Mario Zaki (29:49)
No, no, I couldn't have said it better myself. We're gonna use the exact same things that we mentioned, so... Today's a freebie.

Justin Shelley (29:51)
Okay.

Right, right. ⁓

Yeah. And it's a day of awareness. It is not a day of solutions. Just get it fixed guys. Don't get sued. All right, Mario. That's all I've got. you have any final takeaways, sign-offs, ⁓ sayonara's? How do you want to end today, Mario?

Mario Zaki (30:11)
No,

just like I say all the time, you know, we want to help you sleep better at night. And the first step in being protected is awareness and training. Go out there and check out your website, you know, check out a friend's website and see you'll learn a lot. ⁓ And take the steps, take the steps. We all want to sleep better at night. And ⁓ that's it.

Justin Shelley (30:40)
All right. Appreciate it. As always, thank you for being here. I am Justin. Remember, listen in, take action and keep your business unhacked and un-sued. See you next week.

Mario Zaki (30:50)
Bye guys.