Security Considerations for a Connected, Highly Volatile World: Expert Insights from Joel Thayer
Regardless of an organization’s size, before implementing any software, it is crucial to understand both its security implications and its underlying nature. Software often handles sensitive information – hence, any unchecked vulnerabilities or hidden threats can lead to data leaks, operational disruptions, or regulatory penalties. Reviewing the software’s development and origin helps uncover potential geopolitical or vendor-related risks and ensures it aligns with compliance standards and the organization’s IT roadmap. Moreover, a thorough evaluation process enhances cybersecurity, fosters trust among stakeholders/consumers, and ensures uninterrupted business operations.
To shed light on this topic, we spoke with Joel Thayer, President of Digital Progress, who offered deep insights into software security. During our conversation, Joel underscored the far-reaching impact of everyday software choices on organizational security and outlined the critical factors tech leaders should consider when evaluating or standardizing third-party software. He also discussed recent high-profile cases, such as the U.S. government’s ban on Foxit, highlighting the real-world implications of geopolitical and vendor-related risks.
With his insights, let’s explore how organizations should think about the tools they use every day – especially document management and collaboration platforms – and the implications they may have for protecting sensitive information.
Q. Before we dive in, would you give our readers an overview of your experience and responsibilities? Can you walk us through your professional path and how it led you to your current position?
Thayer: My name is Joel Thayer, and I am the president of the Digital Progress Institute, a think tank based in Washington, D.C. focused on advancing bipartisan policies in the tech and telecom space. I’ve founded my own law firm, Thayer PLLC, and was previously an associate at Phillips Lytle. Before that, I served as Policy Counsel for ACT | The App Association, where I advised on legal and policy issues related to antitrust, telecommunications, privacy, cybersecurity and intellectual property.
Q. What are your top priorities right now as a leader, especially when it comes to security and protecting sensitive information?
Thayer: At the Digital Progress Institute, we believe strongly in establishing universal privacy rules that protect consumer data across the Internet and ensure those decisions are in the hands of consumers, not companies.
A recent Pew Study shows that 73% of Americans feel they have limited to no control over how companies use their personal information. And the reality is they don’t. We sign privacy policies that are filled with so much legal jargon that it may as well be unintelligible to the average person, and presto! Our data is now their data. The problem is not just that they sell our data to third-party advertisers, but also to those who use our data to create fake images, curate biased news feeds, conduct elaborate scams, and even engage in espionage.
Q. From your perspective, how critical are document management and PDF tools to an organization’s operational level?
Thayer: In industries like finance, real estate, and healthcare, PDFs remain the backbone of everyday business workflows. Globally, 98% of businesses use PDF as their default file type for external communication (Mobiqode, 2025). Over 2.5 trillion PDFs exist worldwide, with 290+ billion new PDFs created annually, growing 12% YoY. PDF is the web’s second-most-served file type, behind only JPEG.
Q. What factors do you consider when approving or standardizing third-party software in your workforce or work portfolio?
Thayer: When evaluating third-party apps or software, companies must assume that software from certain jurisdictions serves dual purposes: legitimate business functionality and potential intelligence collection for state sponsors who view American companies as strategic assets to be leveraged.
Q. Recently, the U.S. government just blacklisted Foxit—Chinese PDF software that’s been embedded across America’s most sensitive defense agencies. What is your take on this? Moreover, Foxit has development operations in China. How might this pose risks to sensitive government information?
Thayer: Foxit’s playbook is not new – it reflects the systematic nature of modern espionage campaigns that target comprehensive data collection across all aspects of technology infrastructure. In 2021, President Donald Trump banned Chinese apps like Alipay, CamScanner, QQ Wallet, SHAREit, Tencent QQ, VMate, WeChat Pay, WPS Office and their subsidiaries due to concerns over China’s “bulk data collection” to advance its economic and national security agenda. What we see here with Foxit is similar to the examples mentioned above.
What makes this particularly concerning is that PDF software processes exactly the type of sensitive information biometrics, R&D data, and government contracts that provides invaluable intelligence to foreign powers as they build their own military and technological capabilities.
Q. How should government agencies evaluate the national security implications of using software with foreign development ties?
Thayer: Agencies must recognize they’re dealing with adversaries who maintain direct relationships with foreign governments, regardless of corporate structure or public statements. The evaluation framework needs to account for the reality that certain countries use all available diplomatic, economic, and technological levers to advance their strategic interests.
Assuming that software with foreign development ties could serve intelligence collection purposes for powers that view imported American technology as a means of building their own advanced systems, including military AI capabilities, is the only way to safeguard critical government information.
Q. Do you think organizations underestimate the national security implications of everyday software choices?
Thayer: Organizations consistently underestimate these risks because they focus on immediate operational needs while adversaries focus on long-term strategic intelligence value. There’s a fundamental disconnect between how procurement teams evaluate software and how foreign intelligence services evaluate the same tools.
Q. What technical safeguards can reduce the risks of using Foxit (e.g., disabling cloud features, sandboxing)?
Thayer: If organizations are truly concerned about the sensitive information and proprietary data ending up in the wrong hands, then they should not trust software companies or third-party apps that have ties to foreign adversaries.
The foreign regulatory landscape continues to change rapidly, and the only safeguard is not to utilize questionable software.
Q. Should Foxit be restricted to non-classified environments only? Why or why not?
Thayer: Restricting compromised software to non-classified environments still exposes high-value information that foreign intelligence services actively seek. Government contractor data, personnel information, and operational details provide significant strategic intelligence regardless of formal classification levels.
Given that adversaries systematically overcollect information to build comprehensive intelligence pictures, any level of exposure contributes to their understanding of American capabilities, decision-making processes, and strategic priorities.
Q. If you were advising a Chief Technical Officer, what would be your policy/ security recommendation regarding Foxit?
Thayer: My recommendation would be to replace it immediately with an alternative not owned by foreign adversaries.
Q. Finally, what advice would you give other technology leaders navigating the tension between productivity and security?
Thayer: Technology leaders need to understand the origins of third-party apps and technologies. Continuous due diligence is necessary to safeguard company data in an ever-changing landscape.
Key takeaway for CTOs
As businesses continue to embrace digital transformation, the importance of software security will only grow. CTOs who prioritize secure software practices, assess risks carefully, and implement proactive controls will be better positioned to navigate threats and maintain operational resilience.
In an era where technology drives business success, security is no longer just an IT concern—it is a strategic imperative.
