# Clean Data Has an Address

*In 2027 a company's data can be contaminated long before anyone steals it: by a broker, a vendor, an offshore processor, or a model trained on what trafficked people were made to collect. Five house files show where it gets in. Virginia Beach shows what keeps it out.*

By **Jenny Huang Goodman MPA MSc MHSA, Principal** — The Stash Edge, Hako Shikin LLC.
Published 2026-10-24.

Canonical: https://www.pops4.com/stash/articles/clean-data-has-an-address
Tags: data provenance, trafficking, vendor risk, AI governance, Virginia Beach, clean money

---

The most valuable thing a company keeps is no longer in its vault. It is in its lists: the names, addresses, titles and birthdays it has gathered over years of doing ordinary business, and the lists it has bought, borrowed and been sent by people it trusted.

Every one of those lists has a history. **A list does not know where it has been**, and most companies cannot say either. That gap, between what a company holds and what it can prove about where it came from, is where the contamination of the next decade lives.

## The contamination nobody audits

**Contamination does not need a breach.** It arrives the way most trouble arrives in business: through a hand you trusted, carrying a list nobody asked about.

The United Nations human rights office counted **at least 300,000 people working in scam operations across South-East Asia** this February, trafficked from at least 66 countries, many held in compounds and worked through nineteen-hour days ([OHCHR, 20 Feb 2026](https://news.un.org/en/story/2026/02/1167012)).

The money behind them has tripled in two years. UNODC's July assessment put last year's scam losses across East and South-East Asia, Australia and New Zealand at **88.3 to 114.1 billion dollars**, and described the groups as franchises with specialised departments, one of them for **harvesting data** ([UNODC, as reported 23 Jul 2026](https://decrypt.co/374140/southeast-asian-scam-networks-cost-victims-up-to-114b-in-a-year-un)).

What the compounds work from is lists. When the United Kingdom sanctioned the Xinbi marketplace in March, it said plainly that **stolen personal data for targeting victims could be bought there** ([UK Government, 26 Mar 2026](https://www.gov.uk/government/news/uk-crackdown-on-vile-scam-centres-steps-up-with-sanctions-on-illicit-crypto-network)). In September the US Treasury designated the same marketplace a transnational criminal organisation and said it had processed **over 24 billion dollars** ([Treasury, 9 Sep 2026](https://home.treasury.gov/news/press-releases/sb0624)).

The largest forfeiture action in the history of the US Justice Department came out of this economy: about **127,271 bitcoin, roughly 15 billion dollars**, sought from the chairman of a group accused of running forced-labour scam compounds in Cambodia, with 146 related targets sanctioned the same day ([DOJ, 14 Oct 2025](https://www.justice.gov/opa/pr/chairman-prince-group-indicted-operating-cambodian-forced-labor-scam-compounds-engaged); [Treasury, 14 Oct 2025](https://home.treasury.gov/news/press-releases/sb0278)).

The victims are not far away. FinCEN reviewed 33,904 reports filed by American banks and found **about 12.7 billion dollars linked to suspected overseas scam centres, with victims in all fifty states** ([FinCEN, 3 Sep 2026](https://www.fincen.gov/news/news-releases/fincen-identifies-nearly-13-billion-linked-suspected-digital-asset-scams)).

The ordinary data trade feeds the same appetite. According to a November 2023 study from Duke University's Sanford School, funded in part by West Point, researchers posing as ordinary buyers obtained records on American servicemembers, details that are meant to stay protected, for **as little as twelve cents a record**, filtered by how close they lived to a base, from brokers who did little to check who was buying ([Duke Sanford, Nov 2023](https://techpolicy.sanford.duke.edu/data-brokers-and-the-sale-of-data-on-us-military-personnel/); [MIT Technology Review, 6 Nov 2023](https://www.technologyreview.com/2023/11/06/1083002/sensitive-data-about-us-military-personnel-data-brokers/)).

Regulators have noticed. In February the Federal Trade Commission warned **thirteen data brokers** that a person's status as a member of the Armed Forces is protected data under federal law, with penalties of up to **53,088 dollars per violation** ([FTC, 9 Feb 2026](https://www.ftc.gov/news-events/news/press-releases/2026/02/ftc-reminds-data-brokers-their-obligations-comply-padfaa)).

And it has happened at home before. In 2021 a large American marketing-data firm agreed to pay **150 million dollars** after the Justice Department found one of its units had supplied data on more than 30 million consumers to fraud schemes aimed at older people ([DOJ, 27 Jan 2021](https://www.justice.gov/usao-co/pr/marketing-company-agrees-pay-150-million-facilitating-elder-fraud-schemes)).

Put the numbers in one line and the shape appears. **At least 300,000 people held. Up to 114 billion dollars taken in a year. 12.7 billion traced through American banks. Twelve cents for a servicemember's address.** The cheapest input in the whole economy is the list, and every company keeps one.

Contamination runs in both directions. A company's list can leak into this economy through a vendor, and data harvested in this economy can arrive back inside a company, folded into a purchased list, a training set or an enrichment file. **Either way, the company is now holding something with a history it cannot show.**

## Five doors, from the house files

**Every one of these came in through a door** someone thought was locked.

Over the past three months the house has published five files that read, together, as a map of where contamination gets in. Each is pinned on this desk. Read side by side, they are the homework.

**The first door is the website nobody thinks about.** [The Website You Never Think About Was Open Before Breakfast](https://www.pops4.com/stash/articles/php2shell-the-website-you-never-think-about) traced a flaw that sat for more than a decade under the engine that runs most of the web's sites. The dealer portal, the company store and the old campaign page hold names and shipping addresses, and **the vendor's forgotten server is where a list walks out without anyone touching your own systems.**

**The second door is the vendor's feed.** [Brand Safety Used to Be a Phone Call. Now It Is a Search.](https://www.pops4.com/stash/articles/brand-safety-used-to-be-a-phone-call) showed that AI systems collapse a brand and the people who handle it into one result. **A vendor who is careless in public is usually careless in private**, and a vendor's circle is now part of a company's record whether the company likes it or not.

**The third door is the estate built in the eighties.** [Why Banks Are Losing the Room](https://www.pops4.com/stash/articles/why-banks-are-losing-the-room-vendor-estate-2026-08-15) found vendor agreements still running on terms written before anyone imagined a market in personal data, with permissions over shareholder information that nobody has reread since. **An old contract is a door left open by a person who has since retired.**

**The fourth door is the path nobody can examine.** [A Model Reads What You Wrote Down. A Person Sees What You Did.](https://www.pops4.com/stash/articles/the-business-associate-agreement-nobody-asked-for) followed risk capital into structures its own state cannot see, and ended on the line every data officer should keep on the wall: **a missing document produces no document.** Data routed where no one can look is data no one can vouch for.

**The fifth door is whoever stands nearest your name.** [Brand Rules for the Age of AI](https://www.pops4.com/stash/articles/brand-rules-for-the-age-of-ai) set out how machines now collect a brand up with its neighbours. **The same machines read the neighbours of a dataset**: who supplied it, who enriched it, who labelled it. A clean company standing beside a dirty list is described, in the end, by the list.

## 2027 is the year it becomes a duty

**Fourteen months.** That is how long a board has before forced labour and data provenance become the same question.

For most of the past decade, clean data was good practice. Over the next fifteen months it becomes the law in the markets that matter, on dates that are already set.

The US Justice Department's Data Security Program has been in force since **8 April 2025**, and its due-diligence and audit duties since **October 2025**: bulk sensitive data may not flow to a country of concern, directly or through a vendor, an employee or an investor ([DOJ National Security Division](https://www.justice.gov/nsd/data-security)).

The Protecting Americans' Data from Foreign Adversaries Act has applied since **June 2024**, and names **status as a member of the Armed Forces** among the sensitive data brokers may not make available to foreign adversaries ([FTC warning letter, Feb 2026](https://www.ftc.gov/system/files/ftc_gov/pdf/military-padfaa-warning-letter-template.pdf)).

Virginia put **precise geolocation data** beyond the reach of the data trade from **1 July 2026** (SB 338). California's Delete Act has required registered brokers to honour deletion requests through a single state platform since **1 August 2026**, and its rules on automated decisions apply from **1 January 2027** ([California Privacy Protection Agency](https://privacy.ca.gov/drop-for-data-brokers/)).

In Europe, the AI Act's data-governance duties for high-risk systems, covering where training data came from, how it was collected and how it was checked, apply from **2 December 2027**, after this year's amendment moved the date ([Hunton, 28 Jul 2026](https://www.hunton.com/privacy-and-cybersecurity-law-blog/eu-digital-omnibus-on-ai-enters-into-force)).

Twelve days later, on **14 December 2027**, the EU Forced Labour Regulation applies: any product made wholly or partly with forced labour may be barred from the European market ([Baker McKenzie, 24 Aug 2026](https://globalimportblog.bakermckenzie.com/2026/08/24/eu-publishes-guidelines-on-the-application-of-the-eu-forced-labour-regulation/)). In the United States, the Department of Homeland Security made **its largest single addition to the forced-labour entity list** this August, 43 companies at once ([Covington, Aug 2026](https://www.cov.com/en/news-and-insights/insights/2026/08/dhs-expands-uflpa-entity-list-amid-intensifying-enforcement-landscape)).

Read together, the calendar says something no single rule says. **Forced-labour diligence and data diligence are becoming one discipline.** The person who keyed in the list, labelled the training set or worked the call centre is now part of the data's provenance, and the law is starting to ask about them.

## What clean looks like

**Clean is not a feeling.** It is a document you can hand an auditor in under a minute.

Clean does not mean secret. It means **a custody record**: for every list and every dataset, where it came from, who collected it, on what legal basis, on what date, who has touched it since, and who is allowed to touch it next.

The Data & Trust Alliance turned that record into a standard in 2024, tested with more than fifty organisations: source, lineage, legal rights, privacy and protection, generation date, intended use ([Data & Trust Alliance, Jul 2024](https://www.helpnetsecurity.com/2024/07/22/saira-jesani-data-trust-alliance-data-provenance-standards/)). The NSA, CISA, the FBI and their Five Eyes partners named **the data supply chain** as the first risk to any AI system last year, ahead of poisoned data and drift ([Joint guidance, May 2025](https://www.alston.com/en/insights/publications/2025/06/joint-guidance-ai-data-security)).

The record has one blind spot the frameworks have not closed: **labour provenance.** Who did the data entry, the labelling, the moderation, and under what conditions? A dataset can be perfectly licensed and still have been typed by people who could not leave the building.

For a house that runs public relations, media and programmes for regulated clients, the point is close to home. **Press lists, guest lists, and board and investor contact lists are exactly the personal data the compounds buy**: names, direct lines, home addresses, titles, sometimes birthdays. Clients want vendors and their clients' data handled the way the house has handled federal and military contract data for years: under a chain of custody, opened only for the job they were gathered for, and never rented, re-used or passed on.

The questions that sort a vendor in an afternoon:

— Where did this data originate, who collected it, on what legal basis, and when?
— Has any part of it passed through a broker, a reseller or an offshore processor? Name each, and the country.
— Does it include military status, precise location near an installation, government identifiers, health or financial data?
— Can anyone in a country of concern reach it, through staff, a subcontractor or a parent company?
— For an AI vendor: is there a public summary of the training data, and proof of consent for anything it was tuned on?
— Who did the labelling, data entry or call-centre work, where, and on what terms, and will you accept an audit?
— Have you, your parent or your payment processor appeared on a sanctions list or the forced-labour entity list?
— What happens on the day an illicit source is found: notice, deletion certificate, audit right, exit?

## Clean money is a sorting discipline

**The best risk desks in the world almost never say no.** They say where.

The institutions that keep money clean do not answer every counterparty with yes or no. **They give each one a position**, and they write the position down.

America's bank regulators put it into their joint guidance in 2023: "some banking organizations may assign a criticality or risk level to each third-party relationship," with more rigorous oversight for the critical ones and a contingency plan for moving the work elsewhere if a relationship fails ([Interagency Guidance, 6 Jun 2023](https://www.govinfo.gov/content/pkg/FR-2023-06-09/html/2023-12340.htm)).

The international standard says the same thing more bluntly. FATF asks banks to segment customers "between high, medium and low risk" and warns against wholesale de-risking: the right approach is **case by case** ([FATF](https://www.fatf-gafi.org/en/publications/Fatfgeneral/Rba-and-de-risking.html)).

The market sorts too, and early. In the *Journal of Finance*, Karpoff and Lou found that **short interest rises steadily for nineteen months before financial misconduct is publicly revealed** ([Karpoff & Lou, 2010](https://ideas.repec.org/a/bla/jfinan/v65y2010i5p1879-1913.html)). And when Dyck, Morse and Zingales asked who actually exposes corporate fraud, the answer was mostly people without a formal mandate: **employees, journalists and industry regulators ahead of auditors and the SEC** ([NBER](https://www.nber.org/papers/w12882)).

Even what people buy is part of the sorting. FinCEN's trafficking indicators include spending out of pattern on **hotels, rideshares, prepaid cards and fast food** ([FinCEN, 15 Oct 2020](https://www.fincen.gov/sites/default/files/advisory/2020-10-15/Advisory%20Human%20Trafficking%20508%20FINAL_0.pdf)). Banks already read a customer's purchases as a statement about the customer.

So the house sorts. **A vendor earns its position**: core, probation, the edge of the room, or a planned exit. The less trusted the vendor, the narrower the job and the less data it ever touches; NIST calls that least privilege, and it is the oldest courtesy in any careful house ([NIST SP 800-53, AC-6](https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_1/home?element=AC-6)).

Nobody is shouted out of the room. Everyone is offered a position, and the positions are chosen carefully.

## Why data leaders keep their most important work here

**The internet comes ashore** at a beach town whose bonds S&P says could be rated above the United States government.

Virginia Beach is **the safest big city in the United States**: first of 83 cities with more than 250,000 people, with 0.9 violent crimes per thousand residents on the FBI's 2024 figures ([SmartAsset, 2026](https://smartasset.com/data-studies/americas-safest-big-cities-2026-study)).

It is also where the internet comes ashore. **Three transatlantic cables land here**: MAREA to Spain, built by Microsoft, Meta and Telxius with a design capacity of 160 terabits a second; Google's Dunant to France at 250 terabits; and BRUSA to Puerto Rico and Brazil, all brought in through a city-owned business park ([Google Cloud, 3 Feb 2021](https://cloud.google.com/blog/products/infrastructure/googles-dunant-subsea-cable-is-now-ready-for-service/); [Data Center Knowledge](https://www.datacenterknowledge.com/cables/facebook-and-microsoft-s-high-capacity-submarine-cable-to-europe-complete)).

The city keeps its own books the same way. **Fitch, Moody's and S&P all rate Virginia Beach at the top of their scales**, and S&P says the city's bonds are eligible to be rated above the United States government itself. Moody's credits "strong, proactive management" and reserves above 40% of revenue ([Moody's, 20 Aug 2026](https://s3.us-east-1.amazonaws.com/virginia-beach-departments-docs/finance/DebtMgmt/Moodys/Moodys-Virginia-Beach-Rating-Report-08.20.26.pdf.pdf); [S&P, 25 Aug 2026](https://s3.us-east-1.amazonaws.com/virginia-beach-departments-docs/finance/DebtMgmt/SP/SP-Virginia-Beach-Rating-Report-08.25.26.pdf); [Fitch, 27 Aug 2026](https://s3.us-east-1.amazonaws.com/virginia-beach-departments-docs/finance/DebtMgmt/Fitch/Fitch-Virginia-Beach-Rating-Report-08.27.26.pdf)).

**The same judgement runs through the people it does business with.** Vendors with poor judgement are moved along here quietly, more politely than a conversation in a cigar room, a high tea or a Japanese tea ceremony. It is never the words that move them. **It is experience as old as trade itself: a long memory of what makes money and what does not.**

It funds in layers. When the sea came up, residents voted **567.5 million dollars** in flood bonds by a margin of about three to one, and the city dedicates fixed pennies of its property tax to flood control and to its Sea Level Wise programme, which runs to 175 action items ([Virginia Mercury, 2 Nov 2021](https://virginiamercury.com/2021/11/02/virginia-beach-voters-approve-567-million-bond-referendum-to-deal-with-flooding/)). **The planning goes deeper than the sand and the shale.**

It chooses whom it backs. Incentives from the city's development authority are paid for full-time jobs measured against the city's average wage, and only where the company would probably not have come without them ([VBDA, Aug 2024](https://www.yesvirginiabeach.com/_assets/Documents/AboutUs/VBDA/2024/vbda-resolutions-08-24.pdf)). Uses that could harm the neighbours need a conditional permit, a public hearing and a vote of City Council ([City of Virginia Beach](https://planning.virginiabeach.gov/permits/conditional-use)).

It lives beside the people who interdict for a living. **The US Fleet Forces Command is headquartered in Norfolk**, directing about 138,000 sailors, reservists and civilians ([US Navy](https://www.usff.navy.mil/)); Naval Station Norfolk holds the Navy's largest concentration of naval forces ([Naval History and Heritage Command](https://www.history.navy.mil/content/history/nhhc/browse-by-topic/organization-and-administration/installations/naval-station-norfolk.html)); the **Coast Guard's Atlantic Area** is headquartered a few miles away in Portsmouth, in the year the service seized more cocaine than in any year of its history ([Maritime Executive, 6 Nov 2025](https://www.maritime-executive.com/article/us-coast-guard-reports-best-year-ever-for-cocaine-interdiction)).

For eighty-five years, from December 1941 to this October, Norfolk had its own FBI field office, opened because of the naval presence ([FBI](https://www.fbi.gov/history/field-office-histories/norfolk)). This month it was folded into Richmond as a resident agency; the Bureau says its people stay in Hampton Roads ([13News Now, Oct 2026](https://www.13newsnow.com/article/news/community/fbi-norfolk-consolidate-richmond-field-office/291-5da3144c-4c49-4524-bea0-881fe0c32dc7)). **Will the quiet operators stay?** On the evidence of the last eighty-five years, they rarely leave. NCIS works trafficking operations with the Virginia Beach police, most recently in January ([City of Virginia Beach, 5 Feb 2026](https://virginiabeach.gov/connect/news/vbpd-arrests-four-in-human-trafficking-investigation)), and a regional task force led by Homeland Security Investigations, the Attorney General and the US Attorney works both sex and labour trafficking ([Virginia Attorney General](https://www.oag.state.va.us/programs-outreach/human-trafficking/hampton-roads-human-trafficking-task-force)).

And it hosts. **Fourteen million visitors** spent 2.6 billion dollars here last year, and tourism carries almost one job in five in the city ([Visit Virginia Beach, 2025](https://www.visitvirginiabeach.com/wp-content/uploads/2025/11/2024-Virginia-Beach-Tourism-Economic-Impact.pdf)). One person in seven in Virginia Beach is a veteran, **15.4% against 5.9% across the country** ([Census ACS 2024](https://censusreporter.org/profiles/05000US51810-virginia-beach-city-va/)).

Now set the twelve cents beside the people it would buy. **According to the US Census Bureau, the Virginia Beach–Norfolk area is home to 193,361 veterans** ([US Census Bureau, American Community Survey 2024, via Census Reporter](https://censusreporter.org/profiles/31000US47260-virginia-beach-chesapeake-norfolk-va-nc-metro-area/)). **According to the City of Virginia Beach, citing Navy Region Mid-Atlantic, the same area holds 96,835 active-duty personnel**, which the city describes as the largest active-duty population in the country ([City of Virginia Beach Economic Development](https://www.yesvirginiabeach.com/key-industries/defense)).

At the lowest price the researchers paid, **records on all of them, about 290,000 people, would cost about 34,800 dollars**, and their families are not even in the count. That is the arithmetic a careful city has to answer, and it explains why this one is careful.

**Very few places on earth put all of it on one stretch of water.** Across Hampton Roads, within the same harbour: the Port of Virginia, which handled about 3.5 million TEUs in its 2024 fiscal year ([Railway Age, Jul 2024](https://www.railwayage.com/intermodal/port-of-virginia-wraps-fy24-with-cargo-volume-growth-infrastructure-project-progress/)); Newport News Shipbuilding, the nation's only designer, builder and refueler of nuclear-powered aircraft carriers ([HII, SEC filing](https://www.sec.gov/Archives/edgar/data/1501585/000150158520000035/R8.htm)); and NATO's Allied Command Transformation, the only NATO headquarters in North America ([NATO ACT](https://www.act.nato.int/article/celebrating-20-years-act/)).

The research sits beside them. Jefferson Lab, a Department of Energy national laboratory for nuclear physics, was chosen in 2023 to lead the department's new **High Performance Data Facility** hub ([William & Mary](https://cdsp.wm.edu/applied-science/research/facilities/)). NASA Langley, founded in 1917 as the nation's first civil aeronautics research laboratory, still works the line where ocean, air and land meet ([NASA Earth Observatory](https://earthobservatory.nasa.gov/IOTD/view.php?id=90586)).

**Ports, the fleet, federal agencies, nuclear research and the science of sea and sky, side by side.** The work happens across the harbour. **Virginia Beach is where so many of the people who do it come home**, and that is why cyber and logistics judgement of this depth lives on one coast.

Read together, the facts in this section describe one thing: **the place where the most valuable data comes ashore is also the place where the most people know how it gets stolen.**

**None of it is a coincidence.** The cables came ashore where the water was already watched. The money stayed where the books were kept carefully. The guests kept coming where the streets stayed quiet. **And the data is safest where the people who know how to guard it chose to live.**

The house file on healthcare said that in military-heavy regions the data risk runs higher still. It does. **A town full of people worth targeting has to become a town that notices**, and that is what this one became.

## The part no study measures

**Every town has a reputation.** This one has a habit.

What follows is the house's reading, from inside it, after twenty-nine years of brand, media and programme work from the same coast. No survey has counted it. Ask anyone who has lived here long enough and they will tell you the same thing.

For decades, orders to this coast put people beside the best interdiction professionals in the world. **You learned as much from your neighbours as you did on the job**: at the school pickup, at the restaurants, on the boats.

**The alert started long before the internet.** In the eighties and nineties, the trafficking scares that ran up and down the East Coast put this town on a higher watch than most, and it never really stood down. It went looking for the best people it could find to protect its records and its streets, and some of the finest security and computing operators of their generation came to live here. **They did the work the way this town does everything: boots on the ground, not a dashboard.**

**This town protects its own.** The women and children who hold together the families of its financiers, its sailors and its heroes are not a soft target here. They are the reason the town keeps watch. Anyone who mistakes them for one meets a community that notices everything, and laws written to match.

**The law is written to match.** Under federal law, trafficking a child under fourteen, or anyone by force, fraud or coercion, carries **fifteen years to life**; trafficking a child of fourteen to seventeen carries ten years to life ([18 U.S.C. § 1591](https://www.law.cornell.edu/uscode/text/18/1591)). Virginia makes commercial sex trafficking a felony in its own right, a harsher one when force or deception is used, and **a Class 3 felony when the victim is under eighteen**, with every violation counted as a separate felony ([Va. Code § 18.2-357.1, via DCJS, Jul 2025](https://www.dcjs.virginia.gov/sites/dcjs.virginia.gov/files/publications/victims/Virginia_Trafficking_Laws_Updated_July_2025.pdf)). Since 2024, labour trafficking is a state felony too: Class 4, and Class 3 when the victim is a minor ([Governor of Virginia, 3 Apr 2024](https://www.governor.virginia.gov/newsroom/news-releases/2024/april/name-1024898-en.html)).

**And the training is relentless, by design.** Every member of the armed forces and every Defense Department civilian completes counter-trafficking training in their first year and refreshes it every year after ([DoD Instruction 2200.01](https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/220001p.pdf); [USFK](https://www.usfk.mil/Newcomers/Training/)). In Virginia, every hotel employee who meets guests, manages staff or enters a room must be trained to recognise and report trafficking within six months of being hired, and again every two years. Armed and unarmed security officers carry the same requirement in their compulsory training, police train to state standards, and every first-year student at a public university completes it as part of orientation ([DCJS, Virginia Trafficking Laws, Jul 2025](https://www.dcjs.virginia.gov/sites/dcjs.virginia.gov/files/publications/victims/Virginia_Trafficking_Laws_Updated_July_2025.pdf)).

In a city where tourism carries almost one job in five and one resident in seven has served, **almost everyone in a position to notice has been taught to, and retaught, and taught again.**

The people who retire here spent careers in intelligence, in law enforcement, in the work of finding what others were hiding. People say, quietly, that a few spent careers on the other side of the same trade. **Both want the same thing in retirement: a clean name, clean money and quiet streets for the grandchildren.** A neighbourhood full of people who know exactly what dirty looks like keeps itself clean.

**You never quite know who you are standing next to here.** At the coffee bar, on the boardwalk, in the line at the hardware store, it could be the twin of one of Toyota's top engineers, the grown children of one of Korea's great shipbuilding families, the Scottish detective behind one of the country's biggest busts who went on to run a bank, England's real top dog, the one the papers never name, the most generous philanthropist nobody has heard of, or simply a regular guy enjoying his life. **Nobody asks, and nobody needs to.** Discretion is the local courtesy, and it is part of why the money, and the data, feel at home.

The children raised here grow up with children from every side of that work, and learn early what clean looks like. **They leave, and they win wherever they land**; ask around and it is hard to find one who did not. It is less luck than a city practice. And when they do well, the money comes home.

The city's own habit matches the town's. It is courteous to everyone, and careful about whom it backs; a business that brings no real value, or carries risk the neighbours would not accept, tends to find it would be happier somewhere else. **That is not hostility. It is sorting, done politely, for a very long time.**

**The courtesy has a limit.** Large health organisations that still route their reserves, and their data with them, through Caribbean offshore structures have found the welcome here politely cool, and more than once. Nobody said no out loud. **They simply did not meet the standard the town keeps for its money**, the same standard the house file on healthcare set out in [A Model Reads What You Wrote Down. A Person Sees What You Did.](https://www.pops4.com/stash/articles/the-business-associate-agreement-nobody-asked-for)

## This week

**Seven steps.** None needs a consultant. The first takes an afternoon.

1. **Pull every list you did not build yourself**: lead lists, mailing lists, press lists, guest lists. Ask in writing where each came from.

2. **Ask every data vendor the questions above.** Keep the answers with the contract.

3. **Give every vendor a position**: core, probation, edge, or exit. Narrow the data each one touches to its position.

4. **Strip what you do not need**: military status, precise location, birthdays, government identifiers. Data you do not hold cannot be traded.

5. **Ask your AI vendors for their training-data summary** and their consent records for anything tuned on your behalf.

6. **Put a person where the data is handled**, on a schedule. A dashboard reports what was measured; a person sees what was never entered.

7. **Put 14 December 2027 in the board calendar.** It is closer than the next audit cycle.

Which of your lists could you **trace to its source today?**

## The takeaway

In 2027 clean data becomes a legal duty: a custody record for every list, labour provenance alongside data provenance, and a position for every vendor. The five house files show where contamination gets in; Virginia Beach, the safest big city in the US with AAA books and three transatlantic cables ashore, shows what keeps it out.

## Sources

1. OHCHR, A wicked problem, 20 Feb 2026 — https://news.un.org/en/story/2026/02/1167012
2. UNODC TOCTA South-East Asia 2026, as reported by Decrypt, 23 Jul 2026 — https://decrypt.co/374140/southeast-asian-scam-networks-cost-victims-up-to-114b-in-a-year-un
3. UK Government, sanctions on scam-centre crypto network, 26 Mar 2026 — https://www.gov.uk/government/news/uk-crackdown-on-vile-scam-centres-steps-up-with-sanctions-on-illicit-crypto-network
4. US Treasury, Xinbi designation, 9 Sep 2026 — https://home.treasury.gov/news/press-releases/sb0624
5. US Department of Justice, Prince Group indictment, 14 Oct 2025 — https://www.justice.gov/opa/pr/chairman-prince-group-indicted-operating-cambodian-forced-labor-scam-compounds-engaged
6. FinCEN, scam-centre analysis, 3 Sep 2026 — https://www.fincen.gov/news/news-releases/fincen-identifies-nearly-13-billion-linked-suspected-digital-asset-scams
7. Duke University Sanford School, study of data brokers and data on US military personnel (funded in part by West Point), Nov 2023 — https://techpolicy.sanford.duke.edu/data-brokers-and-the-sale-of-data-on-us-military-personnel/
8. MIT Technology Review, report on the Duke study, 6 Nov 2023 — https://www.technologyreview.com/2023/11/06/1083002/sensitive-data-about-us-military-personnel-data-brokers/
9. FTC, PADFAA warning letters, 9 Feb 2026 — https://www.ftc.gov/news-events/news/press-releases/2026/02/ftc-reminds-data-brokers-their-obligations-comply-padfaa
10. US Department of Justice, elder-fraud data case, 27 Jan 2021 — https://www.justice.gov/usao-co/pr/marketing-company-agrees-pay-150-million-facilitating-elder-fraud-schemes
11. DOJ National Security Division, Data Security Program — https://www.justice.gov/nsd/data-security
12. Hunton, EU Digital Omnibus on AI enters into force, 28 Jul 2026 — https://www.hunton.com/privacy-and-cybersecurity-law-blog/eu-digital-omnibus-on-ai-enters-into-force
13. Baker McKenzie, EU Forced Labour Regulation guidelines, 24 Aug 2026 — https://globalimportblog.bakermckenzie.com/2026/08/24/eu-publishes-guidelines-on-the-application-of-the-eu-forced-labour-regulation/
14. Covington, UFLPA entity list expansion, Aug 2026 — https://www.cov.com/en/news-and-insights/insights/2026/08/dhs-expands-uflpa-entity-list-amid-intensifying-enforcement-landscape
15. Data & Trust Alliance, Data Provenance Standards, Jul 2024 — https://www.helpnetsecurity.com/2024/07/22/saira-jesani-data-trust-alliance-data-provenance-standards/
16. NSA, CISA, FBI and partners, AI Data Security, May 2025 — https://www.alston.com/en/insights/publications/2025/06/joint-guidance-ai-data-security
17. Interagency Guidance on Third-Party Relationships, 9 Jun 2023 — https://www.govinfo.gov/content/pkg/FR-2023-06-09/html/2023-12340.htm
18. FATF, risk-based approach and de-risking — https://www.fatf-gafi.org/en/publications/Fatfgeneral/Rba-and-de-risking.html
19. Karpoff and Lou, short interest and financial misconduct, Journal of Finance, 2010 — https://ideas.repec.org/a/bla/jfinan/v65y2010i5p1879-1913.html
20. Dyck, Morse and Zingales, Who Blows the Whistle on Corporate Fraud?, NBER — https://www.nber.org/papers/w12882
21. FinCEN, human-trafficking financial indicators, 15 Oct 2020 — https://www.fincen.gov/sites/default/files/advisory/2020-10-15/Advisory%20Human%20Trafficking%20508%20FINAL_0.pdf
22. NIST SP 800-53 Rev. 5, AC-6 least privilege — https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_1/home?element=AC-6
23. SmartAsset, America's Safest Big Cities 2026 — https://smartasset.com/data-studies/americas-safest-big-cities-2026-study
24. Google Cloud, Dunant ready for service, 3 Feb 2021 — https://cloud.google.com/blog/products/infrastructure/googles-dunant-subsea-cable-is-now-ready-for-service/
25. Moody's, City of Virginia Beach, 20 Aug 2026 — https://s3.us-east-1.amazonaws.com/virginia-beach-departments-docs/finance/DebtMgmt/Moodys/Moodys-Virginia-Beach-Rating-Report-08.20.26.pdf.pdf
26. S&P Global Ratings, City of Virginia Beach, 25 Aug 2026 — https://s3.us-east-1.amazonaws.com/virginia-beach-departments-docs/finance/DebtMgmt/SP/SP-Virginia-Beach-Rating-Report-08.25.26.pdf
27. Fitch Ratings, City of Virginia Beach, 27 Aug 2026 — https://s3.us-east-1.amazonaws.com/virginia-beach-departments-docs/finance/DebtMgmt/Fitch/Fitch-Virginia-Beach-Rating-Report-08.27.26.pdf
28. Virginia Beach Development Authority, resolutions, Aug 2024 — https://www.yesvirginiabeach.com/_assets/Documents/AboutUs/VBDA/2024/vbda-resolutions-08-24.pdf
29. City of Virginia Beach, conditional use permits — https://planning.virginiabeach.gov/permits/conditional-use
30. US Fleet Forces Command — https://www.usff.navy.mil/
31. Naval History and Heritage Command, Naval Station Norfolk — https://www.history.navy.mil/content/history/nhhc/browse-by-topic/organization-and-administration/installations/naval-station-norfolk.html
32. Maritime Executive, Coast Guard record cocaine year, 6 Nov 2025 — https://www.maritime-executive.com/article/us-coast-guard-reports-best-year-ever-for-cocaine-interdiction
33. FBI, Norfolk field office history — https://www.fbi.gov/history/field-office-histories/norfolk
34. 13News Now, FBI Norfolk to consolidate with Richmond field office, Oct 2026 — https://www.13newsnow.com/article/news/community/fbi-norfolk-consolidate-richmond-field-office/291-5da3144c-4c49-4524-bea0-881fe0c32dc7
35. City of Virginia Beach, human-trafficking investigation, 5 Feb 2026 — https://virginiabeach.gov/connect/news/vbpd-arrests-four-in-human-trafficking-investigation
36. Virginia Attorney General, Hampton Roads Human Trafficking Task Force — https://www.oag.state.va.us/programs-outreach/human-trafficking/hampton-roads-human-trafficking-task-force
37. Visit Virginia Beach, 2024 tourism economic impact — https://www.visitvirginiabeach.com/wp-content/uploads/2025/11/2024-Virginia-Beach-Tourism-Economic-Impact.pdf
38. Census Reporter, Virginia Beach city (ACS 2024) — https://censusreporter.org/profiles/05000US51810-virginia-beach-city-va/
39. Railway Age, Port of Virginia FY2024 volumes, Jul 2024 — https://www.railwayage.com/intermodal/port-of-virginia-wraps-fy24-with-cargo-volume-growth-infrastructure-project-progress/
40. Huntington Ingalls Industries, SEC filing (Newport News Shipbuilding) — https://www.sec.gov/Archives/edgar/data/1501585/000150158520000035/R8.htm
41. NATO Allied Command Transformation, twenty years in Norfolk — https://www.act.nato.int/article/celebrating-20-years-act/
42. William & Mary, applied science facilities (Jefferson Lab) — https://cdsp.wm.edu/applied-science/research/facilities/
43. NASA Earth Observatory, Langley Research Center — https://earthobservatory.nasa.gov/IOTD/view.php?id=90586
44. 18 U.S.C. § 1591, sex trafficking of children or by force, fraud or coercion — https://www.law.cornell.edu/uscode/text/18/1591
45. Virginia Department of Criminal Justice Services, Virginia Trafficking Laws, Jul 2025 — https://www.dcjs.virginia.gov/sites/dcjs.virginia.gov/files/publications/victims/Virginia_Trafficking_Laws_Updated_July_2025.pdf
46. Governor of Virginia, labour trafficking law signed, 3 Apr 2024 — https://www.governor.virginia.gov/newsroom/news-releases/2024/april/name-1024898-en.html
47. DoD Instruction 2200.01, Combating Trafficking in Persons — https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/220001p.pdf
48. US Forces Korea, required training (annual CTIP refresher) — https://www.usfk.mil/Newcomers/Training/
49. US Census Bureau, American Community Survey 2024, Virginia Beach–Chesapeake–Norfolk metro, via Census Reporter — https://censusreporter.org/profiles/31000US47260-virginia-beach-chesapeake-norfolk-va-nc-metro-area/
50. City of Virginia Beach Economic Development, defense (citing Navy Region Mid-Atlantic) — https://www.yesvirginiabeach.com/key-industries/defense

---

## Publisher

**Hako Shikin LLC** — Virginia Beach, Virginia. Founded 1997. ASI 217876 · DUNS 18-204-6339.
Principal and author: **Jenny Huang Goodman MPA MSc MHSA**.

- Author: https://www.huanggoodman.com/about
- LLM context: https://www.pops4.com/stash/llms.txt
- MCP endpoint, for AI agents: https://mcp.pops4.com/mcp
- Client dashboard: https://dashboard.pops4.com/
- Catalogue: 70,000+ products, 200+ brands