The purpose of Bougainville 2 is to improve our readiness from the smallest task from individual all the way up to company level tasks to prepare ourselves for the integrated training exercise. This is an important exercise to do to really get our timing and sequencing down and be able to use our supporting arms in order to accomplish the mission. I'm building proficiency and leading my section to better support the company in any kind of demolition, rockets needs. Range 10 really was the first time we were able to use deception shots with the Bangalore to actually focus the enemy in one place as we maneuver an element around and actually breach another side. From there we were able to get night rocket shots in using the 17s and accomplish the objective. Training makes us more combat ready. We're always doing live ranges out here with Bougainville 2 and the Marines get more training behind the gun. And as team leaders they get more training as team leaders and other billets. This is an important exercise to build camaraderie and teamwork within the platoon. I'm building proficiency as a squad leader to lead my squad and make sure that I'm ready to lead them into combat.


certain their Rails application is 100% security. Yes, Rich, I believe anybody else may be not. This is us, we've got a great introduction, so we'll just skip that. I started thinking about security seriously this past fall, but I ran into this article by Patrick Mackenzie, and he's writing the Diaspora code base, which is a Facebook replacement that respects your privacy. That code just went out on Alpha release, and he was interested in it, so he checked it out and thought he would look it over, and he was surprised to find several, he says numerous severe security errors, and in the summary he says the bottom line is currently there is nothing that you cannot do to someone's Diaspora account, absolutely nothing. In other words, the site is entirely hackable, you can take over, anybody's account quite easily. I don't know, but that scared me. Because I'm thinking, I said why don't I do Rails development? I know the basics of security, I've gone through all the security lessons and I know all that stuff, and it was scary to me, it bothered me a lot.  We did the Ruby coins, and someone had the great idea of let's put the coins online so you can actually go through the coins on a web page, and you can go through here, and you can see these are tests, we are starting equal, you can fill these things out, and when you fill them out with the right thing, the test turns green. Well we're actually typing in Ruby code at that point, and evaluating it in the browser, yeah you're laughing already, you know what's coming, right? Within two minutes of the guy who did this, he published it in our campfire room, within two minutes of that, someone did this. The answers which you seek are, and that's the Etsy password file. What he did, he typed in system Etsy password into the text box there. Well he thought, ha ha, that's clever, I'll fix you guys. I'll just disable the system command. No. So we switched to using back ticks. Okay, okay smart guys, we'll just disable back ticks. At this point he decided, alright I need a real sandbox to put this stuff in, and actually we're working on putting this online for real right now, and it's in a real sandbox. Theoretically you're not going to be able to break into it once we actually release it, but we're still playing around with these ideas. But the question is, you know we were playing around with this and we knew it wasn't secure, it was an internal thing, and we were just having fun with it. But in real life, what are the security concerns in real life? Just two, maybe three days ago, I saw this post from Martin Fowler. Anybody see this one? This is on ThoughtWorks.com, and if these guys don't know what they're doing, what hope is there for the rest of us? Evidently they have some malware on their website, it's transient, they can't track it down, it shows up sometimes in their Google reports. Sometimes not, they're not quite sure where it is. It might even be a problem with our passion. We don't know for sure, they are tracking this down. They're not suspicious and they think they've tracked it down and they're working at it. And if you see anything suspicious, let them know. But this is a tough problem to solve, absolutely. We've used five minutes now of our 30 minute talk. We are not going to be able to cover anywhere near all the security concerns that you have to think about when you're doing a website in the next 30 minutes. Absolutely no way. And I want to say, first of all, I am not a security expert. I did not study these things. These are just things I got interested in when I saw that posting. So I thought it would be a good idea to share with you some of the basics. These are the basics that you should be doing. First of all, you have a reading assignment. After you hear this talk, every one of you should go and read the Rail Security Guide. This is really comprehensive and really good. They cover things specifically with Rails. Another thing is that you can Google for this. Guidesrubionrails.orgsecurity.html. That's easy to find. The other one is the OWASP Ruby on Rails Security right up. This is a PDF. This is a hunking 48 pages of stuff that you need to know if you're doing a public website. And I'll say public website. If you're doing an internal website, there's vulnerabilities in those as well, too. This was a good guide to point that out. So that's your reading assignment after you get done here. But now for the fun. This is your typical setup for a Rails application.  Out of these components, which of them do you trust? Obviously not the browser. So that is totally out of your control completely. So anything coming in from the browser is suspect. You need to validate it, you need to check it for bad things, and you need to treat that data with the utmost respect. That includes not only data in forms, but also cookie values and URLs. Do not put critical data in URLs because they can be easily hacked. All of this stuff can be easily hacked. I've demoed that today for you. What else shouldn't you trust? Well, the database. You may think you have complete control of that database, but it is quite easy for a hacker to slip in data past your application. And just because it's in the database you control doesn't mean that it's good data and it's safe to display however you want to. Cross-site scripting attacks often come from storing stuff in the database that is later displayed to other users. So out of all these things, maybe you can trust the Rails server because that's where your code is running. If you can't trust your code, you've probably got bigger security issues than we want to talk about right here. But in particular, browser and database are the things you need to be concerned with. So we're going to start with the basic vulnerability.  And we have in our application, we picked an application that Matt and Jerry, in that case, did. It's a very nice movie night reservation. You want to watch a movie? You send advice to some friends and tell them what movies you want to watch. We played around with this application, and we have, let me preface this, all the vulnerabilities we're going to display today was not in his original code. We had to either change the code base or disable things in Rails for us to actually do this. So that is the good news in all of this, that Rails is actually doing a very good job of implementing security, but you need to be aware of what it's doing for you. So let's start with this. This is a simple finder, and we're filtering some text over all the users. We want to find all the users with a name like whatever the filter text is. And we're just interpolating that text right there. Do you see the problem? Everyone should see the problem with this. If you're doing anything like this in your application, you are at security level zero. Your PHP program, I might give you a pass on that, but in Rails, Zing, do not ever do this in SQL statements. I'm going to turn this over to my hacker in residence, Matt, and he's going to actually show you what it looks like. Okay, so there's a real quick demo. This is a general reference. The example app here is this Movie9 application. You make a movie, not a schedule movie, nice to be friends. We had to kind of bring in sort of an interface here that lets expose some of the exploits that we're showing. And one here, so we created this listing of users which you can kind of see. And adding in this filter that we're referencing here. So we can filter by name. So if I say I want to filter by, say, Jerry, and I click filter, and there we go. Now we only see Jerry, which is, you know, eminently useful. But what if we change this up a bit and if we decide that we're going to change what we passed in as our filter here? Notice he's hacking the URL directly into the URL. So just a little bit of extra, but what it looks like could be possibly some SQL in here. Sarah wanted this one. Oh, look at that. And actually our list is a little longer. And now you can see that administrator on our site is the electric which we're talking about. So we actually got Sarah's finished backing this and that. Hey, did you see how simple that was? That was just maybe six, seven characters that he had to type in to do SQL injection. And you could have done that directly in the filter box too. Could have typed that straight in. Yeah. Which, yeah, that's interesting. We could actually do something a little more complex with this here.  You have two question marks now. Thank you. Oh, look at that. And then we see the administrator's encrypted password. We have got encrypted password from the database. Ouch. And you take off the encrypted password. We're safe. You can crack that. And if the password is not a very good password, that is actually quite easy for hackers to crack. Sorry. Yeah. Yeah, he's got it down there. Actually, I don't know what man set up for his demo, but when I was doing this, all my passwords were passed with P-A-S-S-W-O-R-D. So that would have been really easy to hack anyways. Okay, so what has happened? We intended for a string like this to be interpolated by clever use of input from the command line, the commenting out of the remaining SQL and putting in a condition that's always true. We were able to dump the entire user database. We were able to use union commands within SQL to pull in fields that were not normally pulled in and get that data out as well. So if you can do SQL injection, essentially your database is open for any piece of information to be pulled out of it. Okay. This is the solution. Use the question marks and the built-in SQL-based interpolation here, where you pass it as a separate piece that is filled in. The database driver knows about question marks and it will fill that in without danger of SQL injection. It will quote the comments that will quote it, it quotes correctly, and you don't have to worry about that. So please, please, please do this. This is the most basic level of security. This is a big problem in Rails and this is one that I was aware of but not really worried about. And it turns out the way I write code, I would probably fall to this vulnerability. And now that I'm aware of it, I can code around it. I'm aware of that. But you do this a lot in Rails. User update attributes and you just pass all the parameters in the form that come in like that. We do this a lot. Matt, would you demonstrate? So we can click here and go into edit my profile and see how I can update a couple of fields here. I could change my name, which I probably won't, or I could change my email address, which actually does stay the same. But what I could do is bring in one of our favorite tools, a DOM inspector, and go into a little bit of direct DOM manipulation and possibly get around the intended security or the intended use of the app this morning. So go down and find one field. So we're going to find the email address field. And by editing this, say instead of email, if you recognize the standard Rails cram name, and we'll just say that it's true. So admin is the flag in the database that tells whether you're an administrator or not. Not a good update. He's gone from the regular user's list. Let's view the ad health variance. Mark and I hang out. Parameter hacking is trivial to do with debugging tools that are in Firefox and Safari and in Chrome. So what you need to do is if there are parameters in your class that need to be protected from general update, you need to do one of two things. Either this, you can use adder accessible and declare all the fields that a form is allowed to change. Or you use adder protective and declare all the fields that the form should not change. So two ways of going. Accessible or protected? Which should we do? Why? Why accessible? Byte lists are better. Byte lists are better if you forget something. You're still protected. Now a lot of people like to use protected because I've added a field and now my form won't change and I'm annoyed for a few minutes while I figure out why I throw up. I'm annoyed for a few minutes or you can suffer a major security problem. I would go for protecting myself against security problems and deal with the annoyance. The danger with doing adder accessible and that is what we do but the danger with it is if you forget to add it to any model it defaults to everything accessible. So if you're going to do adder accessible it's highly recommended to put something in config initializers that sets in just active record base and another issue is how do you decide which fields need to be accessible and which fields need to be protected and that's a choice you have to make. Essentially if the data is not owned by the person editing the field for example in user form I own my name, I own my password I can specify that to be anything I want it doesn't change, doesn't hurt the program for me to change it to anything that can be validated. The admin flag is not something that the user owns. So that's not something the user should be able to change really nearly in a regular form. So anything dealing with permissions anything dealing with roles anything dealing with security should be protected. Anything that is not determined by the person editing the form should probably be detected and that's kind of a rule of thumb Again, white list versus black list we're going to come across this time and time again I always prefer to white list the things that are permitted rather than black listing things that are not permitted because there are a lot of things that can't think of everything that should not happen because a hacker will think of something that you didn't think of white list only the things that are good. Cross-site scripting this is another common one and this deals with data in the database Let's go ahead and demo our cross-site Okay, I can do So I wanted to go ahead and create a new movie night here to fight all my friends plays, movies related to turtles that was a classic alright I could write in the notes scale I might do something like popcorn that might make sense make popcorn bold make popcorn bold that's true because everybody loves popcorn and it makes sense it's more strong I suppose I could do that it would be show this nice bold feel except for the styling that's actually turned out well I'll pick something else we really want to make sure people know that the popcorn will be provided we could get it all up in their face about it it's the spelling error because it would be okay it would be okay did we accidentally unhack our maybe did we remove the raw I don't think we did actually this is nice feature but you could pop up Java words from your notes right next movie night let's try that again so that's funny in all that jazz but we could do something more malicious I mean better with me acting is hard acting is hard I tell you usually just write jazz so there we go see what we've done we have dumped the entire cookie database for this site in this browser and we had to work really hard to do this actually notice that we have movie night session long session ID that is the critical piece by default now normally you can't do this in a Rails program we had to actually go into Rails and tell it hey it's okay to let javascript get your session ID Rails by default will prevent that so again this is a place where we had to work around Rails default handling to get that but if you can get the session ID you have control of the user you can copy that session ID to a different browser and take over that account yeah still that we were really just writing that cookie out to the user screen and that might confuse or perplex them but it's probably not going to get them hacked but we could take it one step further and instead of just writing out the cookie value right into the DOM in the image tag and in that image tag we point to the hacker's web server that we control writing in the cookie value this is part of that string so we loaded up we get a bad image showing up right there okay yeah so the image didn't show up but the request for that image went out to the hacker's web server and let's look at the web server's log right now oh look the log of the hacker's web server now has our session token inside of it that is how easy it is to grab session IDs and cookies if you have cross-site scripting enabled okay so the key is there are a couple things that enabled this I mentioned one thing earlier that we had to go and tell Rails it was okay for session cookies to be grabbed by JavaScript by default Rails says JavaScript cannot get to session cookies and that's a good thing do not disable that like we did that's one layer of protection the other layer of protection what really killed us though is that we were outputting raw data from the database without filtering it without doing anything now there are times you might want to do this if you want to allow markups such as bold or block codes or image tags or anything like that you want some HTML to filter through you might want to use raw you might want to use text style or markdown to go out like that or if you're working on an old Rails system you might just forget to put the h command on that you know the HTML escape command that's easy to forget Rails 3 defaults to putting that escape in which is a good thing so solution don't use raw if you need to use some htl markup use a flood list of HTML that is allowed do not use a blacklist and don't try to correct bad input right so here we're saying we'll just remove script commands well if the user input is something like this and you remove the script don't try to correct it reject it and look out for javascript that might appear in attributes that you wouldn't normally expect sanitize is a good method in Rails this is actually pretty robust OWASP the OWASP document actually gives praise to sanitize it says it's fairly robust you give it a white list of tags that you allow these are things that you might allow these are pretty safe you say okay only allow href and title attributes I don't know if sanitize checks those for javascript or not hopefully it does it's probably worth checking in sanitize if you don't if you ever use raw output sanitize cross-site scripting instance they are real in 2006 34,000 usernames and passwords were stolen from MySpace the cross-site scripting script that they used essentially used javascript to hide the entire contents of the page and then to insert a login form that was fake and sent the username and password to the hackers website he grabbed 34,000 names and passwords before they stopped that you want to mention talk about this one? I'm probably a member much more recently just last September Twitter was hit with the rainbow tweets worm it was a amusing someone using software for getting worm and had an on-mouser event that effectively was e-mailing some arbitrary script that could be entered via the tweet form which wound up sending a lot of people to some adult-oriented sites which is always good time that was very recent so it's still out there I mean even sites like Twitter fault-created that so check, check, check your output if you're using raw sanitize it okay this is a fun one privilege escalation suppose I have some code that looks like this I want to display a particular movie note so I grab the ID off of the list and I look it up and I display it in the form let's demo this so we go back to our friendly interface here you can see that I'm logged in like it was Matt for convenience I have accessible to me you can see a couple links to some of Jim's movie nights which he didn't see fit to invite me to but because we're not you wouldn't be interested in the movies I love Star Wars and that hurts me despite the fact that I'm not a number 4 not feel bad I would have been offended further had it been prequels but even though I'm not actually invited to this movie I can view it and in fact I could go ahead and vote but since I don't want you to watch Star Wars you're going to have to watch the movie actually what happened there is a very simple hack and even if we didn't put up that list of URLs there for him to easily click on he could have gone up to the URL bar and hacked in any ID for some night in there happen that you'll be watching later on February 9 so even if I don't tell about movies I'm watching he can hack the URL and get to it this is a called privilege escalation he's getting to data that he's not privileged to see supposedly would only give him URLs for his own he can hack in any URL he wants just go ahead and pull up those things ok so instead of doing this what I really should have done instead of doing a night find I should have started with the current user and asked for all the nights and then done a find based upon the nights of the current user if I had done this and he had entered in a night that did not belong to the logged in user he would have gotten a validation error and it would have failed for him so this is one that I tend not to use finders on associations maybe because I like to think of associations as just arrays and the fact that also active record stuff kind of messes with my mind so I tend not to do this and I think we're going to change that behavior because of this very fact alright we're at 30 minutes let's finish I think we're doing good here cross-site request forgery this is a big one how many people have ever seen the authenticity token in your Rails form how many people know what that does for you let's ask this how many people don't know what it does yeah exact this is a really really interesting one imagine that you're in your browser and you point your browser to the hacker webpage of course it's not called the hacker webpage he has some innocuous name like a bunnies and rainbow webpage very exciting yes and you pull down a page and within that page is embedded an image tag that whose source is themovieknight.com and lists a destroy URL for one of the movie nights so that gets loaded in the browser the browser that asks for the image by going out to movie night website and destroying one of the movie nights notice because your browser is still logged into movie night website it still has the session now the hacker website doesn't have your session ID he has no idea what your session idea is so he cannot delete it directly but by giving you an image tag he asks you indirectly to delete that to modify data for yourself without you knowing it let's go ahead and demo this one okay so we've done constructed a another page here which has been to entice you but there is the key aspect is there is an embedded form which is pointing across the movie night site this is on the hacker website this is on the hacker website but the hacker being enterprise knows a little bit about how Rails apps works and is embedded a hidden delete property there so if I go over to this awesome page like me to win I would like to win and I click the big red button oh Blade Runner Blade Runner 9 9 I think I actually that was a show now the problem is this is hacking is hard hacking is really hard I swear he did this right before the talk there it is there it is okay there we go cross site reference forgery it's different than cross site scripting where you load scripts in is using image tags directed to sites not necessarily belonging to you to actually do harm to the data okay so counter measures number one write your websites to be rustful if you do so then things like image tags will not work because the browser issues a get to do that you shouldn't use get to modify your data that's level one security however a hacker could very easily do this in fact that's exactly what Matt did in the demo he set up a form that issued the proper thing and so if you look at rails form that's generated with the helpers you will see a field called authenticity token and it's this really long kind of random looking value and that is generated based upon crypto security stuff within rails it's unique to this session and the hacker will not be able to get it remember the hackers on a separate website he has no idea what your authenticity token is so he cannot include it in any form that he will generate so when he issues this it'll fail because the authenticity token is not even found or not the correct one so that prevents that that is why you have authenticity tokens in your rails web forms now how many people seeing all this work which is using image tags I have to ask you how many people use a mail browser a mail client that automatically displays images for any email coming in anybody do that do you want to think about that for a little bit ok cross-site scripting since cross-site scripting runs a script in your browser you can actually access that authenticity token so cross-site scripting can still defeat this issue but that's a little bit different so you still need to guard against that this is really interesting in Mexico there tends to be a particular brand of router that is commonly used someone set up a CSRF attack that sent out a get request that went to the router reconfigured the router so the DNS entries for a particular bank in Mexico was redirected to a hacker site where he had a fake website set up that collected a whole bunch of bank accounts by using this cross-site reference forgery technique. Gmail assets someone once changed some administrators emails using this technique ok you want to talk about sessions moving? yeah I'll just talk about it really quickly I think we all probably recognize this fire sheep it's very notorious anybody running fire sheep in here right now inventory sessions moving right someone wrote that he sold it to basically an open wireless network would do packet sniffing and would look for recognizable session tokens being passed over the wire looking for common social media sites and you then could spoof service authenticate sessions by basically piggybacking your live session we could do a demo of this right now but no we're not actually going to basically around this you want to require SSL it's becoming more and more advocated for that you basically are just going to protect any portion of your site that is authenticated in session days by requiring SSL and then specifying to use secure cookies just like HTTP only is an option you can as well they be secure which means that they're only going to be passed back and forth if over HTTPS there's a rack SSL this is kind of a dropping solution but it is across the board it will force all of your requests and everything assets and whatnot to use HTTPS and it will automatically mark all cookies as secure okay that's a good time we're actually got about three minutes left here so let's just do a quick summary of things that you need to be aware of number one trust nothing this is the primary goal when you're doing security auditing I'm a very trusting fellow I do not think about people hacking on URLs or putting strange things in image source tags or anything that just doesn't occur to me my mind doesn't work like that but if you want to think about security you've got to get to the point where you don't trust anything that comes in from outside the program stay up to date on all the plugins and frameworks that you use they often put out security updates and if you get behind we've done some security audits on software that we have delivered and one of the things they ding us on is we're not using the latest security patches in the plugins and frameworks that we're using so keep up to date on that don't bypass the Rails built-in security measures 90% of the stuff we did here we were able to do because I went in and disabled the HTTP only thing we took off the protected attribute features we turned off authenticity tokens because that we were able to get by that don't do that there's a reason that all that stuff is there always scope your find by the proper privileges this is a habit I need to develop avoid using RAW and if you do use RAW you sanitize with white lists I would recommend you have an outside firm who specializes in security to monitor your program you as a developer don't think about security the same way these guys who do security audits do and it is well worth your money especially if you have a large public-facing site we've done it on several of our programs that we've delivered and it was very very useful and finally just be aware don't blindly do things because everybody else has done it think about what you're doing and be aware of the security implications of everything that you're doing in your website it was a little discouraging reading all the things that Packers can do but it was very encouraging to see that our software for the most part is protecting us and we need to be aware of it and work with it alright any questions in a minute or so we have left yes back there now the question is just a statement guys thank you very very much for this really important topic but let's sort of make aware there's an amazing resource called NetSploit if you've never heard of this it basically lets you do penetration testing on your own systems using a very nice rail interface interface go check it out Aaron Bedra has worked with that and Aaron is the one who actually did our security audit so yeah good recommendation anyone yes over here one other quick thing to inject and maybe we can talk about this afterwards but our team has recently learned in working with an external security audit company that many people now consider even Rails 3's default CSRF protection to be insufficient really and insecure and maybe we can talk afterwards about it because I just now learned about what it does the basic reason is that you only generate one authenticity token per user session and you keep reusing that for every form every submission and so if you're logged into the site for an hour that's an hour in which an attacker can sniff it with fire sheath or packet sniffing or something else generate a big red hot with your authenticity token and trick you into doing that you want to generate a new one every form so right but then there are difficulties and challenges with that so yeah that's a good point but it's also one more reason not that it's a catch all but to advocate for us so we're all definitely going to request read the documents that we put up there there's a lot of suggestions on how to manage sessions that we did not even talk about resetting sessions often changing the session IDs to keep that giving time to hackers to find that lots and lots and lots of good advice one more question yes so when you're trying to protect to get something like fire sheath does that implicitly until you upgrade your hardware since there might be a significant increase in degradation of performance and so everything has to be questions, protecting this fire sheath does that mean increasing your hardware because there's a degradation in performance because you're using each of them yes right you know what I don't know I don't know how big that performance degradation is right there's going to be a white paper actually that they did a study and related to gmail implementing and going into it and based on their conclusion was it's not costing us too much so it's not going to cost you too much certainly one way to be doubtful is to start with I tend not to use public conference wifi if I can avoid it seriously we had we were at a conference in January and I'm going to share this we had someone hack into some edge case laptops that were there at the conference and they came forward and they said hey we were bound your laptops were kind of open and we browsed them a bit we found some data that really shouldn't have been available there and we we were embarrassed and we sent around some memos and made sure that people tend to close down ports in their laptops in their conferences personally if I can avoid getting on a public wifi a Panera wifi or a conference wifi I try to tend to avoid it these days there's fire sheep I don't know if everyone's ever looked at that that's dirt easy to install in the firefox and it just you know if you're on a public wifi it just grabs all kinds of things there's a plugin from HTTPS everywhere for firefox it plugs a lot of those whenever I'm on a public wifi I always use that you can use a VPN when you're on a public wifi if you can set up a VPN that's an excellent thing to do and just use that explosively whenever you're on a public wifi there are things that we we really need to be aware of as developers we need to be on the cutting edge of this not be left-footed just to say real quick and then force tls is another one but the problem again like those things there's always a moment when it's going to fall down you know it's like forgetting login with the browser or something like that and really personally I much that's to start implementing just just force us to sell ok well thank you very much


I got to go do something Don't want to try to do is hook them under this thing and yank this down out of here.  I already had a bullet already had it in my head what I was gonna do She comes in you cuz I get my boots on babe. You can't go out there and cut that down. I Know I can't I've got other ideas though So now I'm gonna go look for the footage where that thing came down I don't think the ring doorbell picked it up because that's not a person. I Didn't mom heard it Well, it sounds like it's across the road that tree fell down. Did it just happen? Yeah, okay. Yeah, just happen That's what you mean. So I was looking over there and then I looked and I hear it Ain't across the road. It's here. That's pretty weird, huh? Yeah, very But they do that Those trees do that. Okay. Well, do any damage anyway, so that's a good thing No Uh-uh didn't hit no cars. They were going by or anything. Yeah, that's a healthy brand Well, I guess a fire would get up now. Yeah Yeah All right, I'll see if I can find that What is fun to fit? Well, I know that camera caught it. Yeah, I mean it would have caught it perfect You know about how long ago it was Just probably about nine fifty nine fifty four somewhere in there All right, because I went to check on her and she says I hear a branch that a tree fall down What? Yeah, across the road. I'm looking across. I'm looking at Jerry's house It's right here That's why I don't park my truck there Well, I'm gonna drag that around back I'll bring you guys with me and then I'll see if I can find the footage hang tight All right, let's see if I can drag that around back without Taking out the mailbox or something. Okay guys, so I got it to the side of the house We're gonna try to bring it back here, but this is all sand here. It's hard to pull in that stuff So I'll just cut it up there. I'll probably just use my reciprocating saw and Go from there. So I'll probably like Cut it six foot lengths drag it back here let it dry out a couple days and I'll I'll cut it up and we'll let it season so Good morning Now what you gonna do right check out the garden nice peppers peppers there That's a nice tomato Wow pretty cool Still got them falling off on the ground there. All right guys. Well Just a quick vlog for you. I sped some of that up so So you don't get too bored I'll see you guys in the next one Shaybear the myth man legend. I'm gone for now He'll enjoy the rest of your week. We'll see you soon. Bye. Bye and take care


You'll see in a minute that incapacitating is such an ambiguous term that it would be best not to have to use it at all, but we have to use it. In this particular lecture, we're going to talk about some other agents that are incapacitating, not by virtue of local irritant effects, but by virtue of some other effects. And what I'd like to do is talk a little bit about the definition of incapacitation, because that's a very misused word. We'll go over the history and the distribution of some of these things, and some representative compounds, and then a specific group of compounds, of anti-cholinergic compounds that we'll discuss. Now here are some people, you've seen this picture before, on more than one occasion. Are these people who are effectively blind, even though they're not really blind, if you could open their eyes, they could see, right, with mustard? But they can't open their eyes because it hurts too much. Are these people incapacitated?  They're incapacitated by virtue of the fact that because of a medical impairment, something that we could measure, they actually are disabled from performing their particular military mission. Well, incapacitating agents are agents designed to incapacitate people, but not necessarily in that way. Incapacitating agents are designed not really either to kill or to injure somebody seriously. They're designed to produce temporary inability to perform a mission, by disorientation, by other temporary effects, but the end result is inability to perform the mission. Now, what does incapacitating mean? Well, there's a general dictionary definition of incapacitating, isn't it? Incapacitating means something that renders somebody powerless as in an incapacitating disease. We don't have to refer to chemical warfare agents at all to use that term in that way. Now, we can also use incapacitating in the sense of an ICT50. Remember I said, what's an ICT50? It's the dose that causes incapacitation that is a certain effect in a given individual. So if I'm talking about an ICT50 for meiosis for nerve agent, yeah, I can use that. What did I say a better term would be? Effective CT50. Excellent, very good. An ECT50, because meiosis may be incapacitating if you have one MOS. It may not be incapacitating if you have another MOS. If you're a soldier firing a rifle and the person's in fairly close range, it may not be that incapacitating. If you're an aviator, very incapacitating to have meiosis. And then finally, the most specific definition of incapacitating is referring to this particular group of compounds that we're going to talk about. Now, remember, here's the general classification, toxic agents versus incapacitating agents. And the incapacitating agents include a compound called BZ and another compound that probably none of you has ever heard of that we're going to talk about. In fact, that none of us had ever heard of until very, very recently. OK, now, what kind of incapacitation do we want when we talk about incapacitation? Well, we want something that's not going to last a long time. We want something that's temporary. We want it to be significant enough that it will prevent the enemy from fighting us or prevent the criminals from hurting their hostages before we take them over, that kind of thing. And we want it to be non-fatal. Big push for that. And there are various ways that we can do that. We can give somebody terrible diarrhea. And as long as it's short enough on set, yeah, that may be incapacitating. But more the search in the last several decades has been not just for compounds that would induce diarrhea or nausea or hyperthermia or something buzzing in the ears but something that would produce some mental effects. Disorientation. Change in sensorium. Change in behavior. In coordination. Inability to focus on task. Now, how would we use incapacitans? Well, we could use them in the military. Large-scale battlefield use. Is that very practical? Not really. But special forces might use an incapacitant to take out somebody in a room this size, put a little hose through the door and give us something that we wouldn't know about until we're already disoriented and unable to resist. In civilian settings, where would we use an incapacitating agent in a civilian setting? Waco. Ooh, Waco. Now, that's a good example. Now, what were the constraints at Waco? What did we want to do? There were people there who apparently had hostages or at least what the FBI considered to be hostages. What were the goals? What would have been the goals? If somebody had asked you a medical, your medical opinion about what kind of an agent could be put into that compound in order to work, what would you say? What would be the criteria? Oh, yeah, put mustard gas in. I heard that. Now, that's a great agent. That probably would definitely put out of commission, if by that definition, if that's what you mean by incapacitating. But it will also hurt whatever hostages might be there, right? Whatever innocent people might be there. So you don't want any of the toxic agents. So mustards out, nerve agents out, cyanides definitely out, pulmonary agents are out. What about riot control agents? What was wrong with riot control agents? Obviously, riot control agents were used for a certain purpose, and in that they failed. Why didn't they work? Part of the problem was that these were explosive. It may have contributed to the genesis of the fire that destroyed the compound. But part of it also is that, first of all, you can have tolerance to riot control agents. If you're extremely motivated, you can fight through riot control agents. We know that from what happened in Vietnam, in the tunnels. Lots of people just stayed in the tunnels. And you could put as much riot control agent as you wanted. And as long as you didn't reach that extremely high level at which people would die, people actually could continue to fight. They weren't, in fact, as incapacitating as we wanted them to be. But more than that, there's enough time that you can warn other people and put on a mask if you have a mask. There are other things that you can do. We'd like some compound that would be such short onset that nobody would have time to warn anybody else. You'd become disoriented immediately and be unable to do what you're going to do. We'd like the effects to be predictable. In fact, we can develop a list of criteria, say, in military settings. What would be our criteria? Well, we'd want something that has a high potency. We wouldn't need too much of it. So we want something with a high safety ratio, like riot control agents. We want something that's feasible, maybe a fairly short duration. And we want something where the effects are reproducible and predictable. How reproducible and predictable are the effects of riot control agents on the body, physiologically? They're pretty reproducible. Almost everybody, unless you develop tolerance, will develop some irritation, eyes burning, coughing, sneezing, that sort of thing from CS. How many of you were in the gas chamber and didn't have any of those effects? Okay, so the effects are fairly reproducible physiologically, but they're not very reproducible from a behavioral standpoint. What is, what's, what your reaction to CS is may not be your reaction.  Well, let's look at it from a civilian standpoint. Okay, very short duration of effects, less than an hour. It would be nice also if we had a specific antidote, so that if any of the hostages really got a little bit of an overdose, we'd have something immediately to give to them to make sure that they came out of it all right. And again, reproducible and predictable. So far, that's been a search that's been largely fruitless. People, agents that have been considered are volatile anesthetic agents, you know, what's wrong with that? Okay, it's not predictable. And the other thing is, the safety ratio isn't very, isn't very high.  Same thing with sous fentanyl, some of the fentanyl congeners, the opioids, anti-psychotic compounds, haloperidol, and not a very, but what's wrong with haloperidol? Withalda. How long does it take to act? I mean, you don't have immediate, so obviously too long for that. People have looked at LSD, what's wrong with LSD? LSD is very disorienting to some individuals. Okay, again, and there are plenty of compounds that you can give to people where your reaction might be to be very dreamy and be absorbed in your own hallucination, your reaction might be to grab your rifle and be more aggressive. And as long as the effects are that non-reproducible, these compounds don't really work very well. Now, the last compound, the last group of compounds, the anticholinergic compounds, probably come closer to this goal than any of the others. And that led to weaponization in the United States of a particular anticholinergic compound that we'll talk about. But these things are not really new. The search for agents that are not necessarily toxic is an old search. We know that at least as far back as 600 P.C. we have people like Solon who threw roots of a particular plant into a river and the people that drank from the river got diarrhea, you know, incapacitating from a physiological standpoint, not necessarily a mental one.  And it was really good wine. Hannibal, the guy who crossed the Alps on the elephants would, when he was at sea, throw pots full of snakes under the opposing vessels. They didn't need to be venomous snakes. They didn't have to cause death by bites. Just the fact that snakes inspire fear was enough. And that created enough panic that it gave or at least he thought it would give an edge to his troops. And the same story, Belladonna alkaloids. Where do we find Belladonna? Where does Belladonna come from? The plant, what's the plant called? No, that's digitalis. No, that's opium. Deadly nightshade, okay, deadly nightshade. And Belladonna is the source of several anti-cholinergic compounds. What happens when we, you know, there are other anti-cholinergic compounds in Jimsonweed. Anybody ever treated a Jimsonweed? Very good. You're from the West? Yeah, okay, often there's people who do that. And what kind of effects do you get from that? Holocenations, ooh, very interesting. We'll talk about that. And of course, Hashish, the word assassin comes from Hashish because Hashish was fed to these people to give them, to inspire fearlessness in what they were to do. Now here's some Afghans and there was some concern that maybe the Russians in more modern times may have used some kind of an incapacitating agent in Afghanistan. We have no concrete evidence of that but there were certainly plenty of reports. There were also reports that the Soviet Union before its dissolution may have used these things internally. POWs came back saying, well, they used, the Koreans used some sort of weird thing on us to make us so that we wouldn't fight. We're not sure. We don't have any concrete evidence of any of these things. But there are plenty of reports. Military's been interested in psychedelic compounds since they were first reported. LSD, oh, you know, you can imagine what somebody might have thought the military or Secret Service potential kind of, for this kind of compound might be. But again, as we've said, the effects are unpredictable. Never did these things really pan out. However, the United States did go ahead and investigate one of the anticholinergic compounds in enough depth to weaponize it, put it in munitions, store it for a long time. Now, here's Iraq again and here's a munition with chemical agents in it. Until very recently, the chemical agents that we thought that Iraq possessed included GA, GB, VX, mustard, and very possibly cyanide, and nothing else. And that's one of the reasons that we dropped the incapacitating agent's lecture from this course. We used to have it and then we thought, well, you know, it was just BZ. We started to destroy our stocks of BZ in 1988. They're almost all destroyed. And there's not really any use anymore for giving this particular lecture. However, February 9th of this year, just last month from Reuters in London, Britain on Monday released what it said was new information on chemical weapons which were in Iraq's arsenal at the time of the 1991 Gulf War. We have recently received intelligence indicating that Iraq may have possessed large quantities of a chemical warfare incapacitant agent known as Agent 15, Defense Secretary George Robertson said. The Ministry of Defense described Agent 15 as one of a large group of chemicals called glycolates, that's the British spelling, which interfered with a central and peripheral nervous system. All of a sudden, incapacitating agents are back in the news. They may, in fact, be a threat. You may yet encounter them on the battlefield. So what are they? Well, the old way of classifying incapacitating agents was to say, some of them stimulate the central nervous system, some of them depress the central nervous system. Fairly general nondescript and not terribly useful classification. A more recent and better classification is to split these things into four categories. There are the CNS stimulants like amphetamines. Which one would amphetamine as a, I mean amphetamine will make people do weird things, isn't, why wouldn't we use that as an incapacitant? Makes you aggressive. Okay, because in a significant number of people it inspires greater resistance to the enemy and more aggression, okay. But there are a whole list of CNS stimulants that might be used, strychnin is so stimulating that causes convulsions. Well, obviously now we're going into the toxic group of compounds rather than just incapacitating groups. CNS depressants, depressants, barbiturates, opioids. Most of these have problems either in a safety ratio that's unacceptable or in a long onset of action. So they're not very useful. The psychedelics, again, problems with unpredictability. But finally, the delirians. The delirians include drugs like the ones found in Jimson weed that will induce delirium and hallucinations. And they're usually the antico-energics. BZ is one of them. Agent 15, we're not sure exactly what kind of an antico-energic it is. It may be a carbon copy of BZ, it may be BZ. It may be something closely related. So let's look at the whole class together since we're not exactly sure which glycolate may be used. Remember the Reuters report said these are a group of glycolate antico-energics. Well, glycolates are just nothing more than esters of glycolic acid, very simple compound. They all have the two carbons in the center and that particular structure that you see. Many of them also have a benzoyl group off to the side or a phenyl group off to the side. So there's an aromatic ring in there somewhere as well. And there's a wide variety of them. BZ is the one that we chose to weaponize and that we chose to investigate. And we do have field reports about how BZ affects people. BZ itself is the other kind of agent that's a solid. In fact, it's a lot like riot control agents in that. It's a solid, except that the melting point is so high that you will never encounter the melting point in the field. So even if you explode this with a munition, it always comes out as a fine powder. If the powder is fine enough, you may not be aware that you're inhaling the stuff. Now this is a difference from riot control agents. What's the onset with riot control agents? Immediately. You'll find out that that's not the case necessarily with antico-energics. Now what other antico-energics are there? Well, there's atropine. How do we know about atropine? I mean, what else do we use atropine for? Nerve agent, ooh, ooh, remember that. Because all of the antico-energics are essentially will give you the results of too much atropine, just in varying degrees. But there's scopolamine used in anesthesia. Ditropan also used sort of obsolete now.  Because it has antico-energic properties. And many of the antihistamines have antico-energic effects. Benactazine, deserves mention, because benactazine is an antico-energic that we actually used to use as an nerve agent antidote. There used to be something that we called TAB tab that was a mixture of three compounds, TMB for atropine and benactazine, which is this other antico-energic. But what do they do? They block acetylcholine. They're duds in and of themselves. Atropine doesn't really have, I mean, it has a few minor primary actions, but its major action is to block acetylcholine. And for these agents, we're talking about central effects and peripheral effects. And that'll become important in diagnosis because the patient will present to you with peripheral effects and also some very significant central effects.  So you remember this. You remember that another version of this was shown you earlier where we have the little green dots which are acetylcholine and they fit into the receptor and they push the button. And when the button is pushed, you get activation of the end organ. Note that with atropine, there's a little, I've drawn a little slot there so that it can fit into the receptor without pushing the button. The point is atropine can fit into the receptor and not activate it. The end organ isn't activated. The only, its main effect is to clog the receptor, to block it, to make sure that atropine or that acetylcholine can't get there. And again, of course, atropine won't fit at nicotinic sites, only at muscarinic sites. And you remember this. What was the problem with nerve agent intoxication? Effectively, too many green dots. And why did we use atropine? Because atropine was a competitive inhibitor of acetylcholine. That is, it blocked the sites. It was almost as if it were coating the muscle or the gland. Now, imagine that instead of having too many green dots, you have the normal number of green dots and you have the organ coated with atropine. What will be the effect of that? Decreased end organ stimulation. So, if the effects of nerve agent are end organ hyper stimulation, then what were those effects? In smooth muscle, for instance? In the eye, meiosis, bronchoconstriction, diarrhea. Okay, all of those things. And in smooth muscle, okay, in glands we had what? Secretions, sweating, lacrimation. Okay, well, those are the effects of too many green dots. What will be the effects of too few green dots? Just the opposite. So we're talking medriasses. We're talking urinary retention instead of too much. We're talking about constipation instead of hyper motility of the GI tract. We're talking just the opposite effects. We're talking about heat retention. Decreased sweating instead of increased sweating. And what do we say about heart rate with nerve agents? Is that a predictable indicator of intoxication? No, because it can do anything. It can go up and down.  But the nature of that tachycardia varies with the compound given. With atropine you get an initial brief tachycardia and then it's quite pronounced. With scopolamine, it goes up a little bit higher at the beginning and then it's really prolonged. It stays a long time. With BZ, you get tachycardia for a couple of days. And then as it returns to normal, the heart rate goes down to its normal and you may even become bradycardic. But if you don't know the time of onset of the exposure and you may not because these things don't give you any immediate irritant effect, you don't know what the heart rate, what information does the heart rate give you about this compound? Not much. So again, don't depend on the heart rate, just as you didn't depend on the heart rate with nerve agent, don't depend on the heart rate with anticholinergic to tell you very much about the compound. Now, the central effects, that is, the effects in the brain, in the central nervous system, they're qualitatively the same. Almost any anticholinergic will give you the same general kinds of hallucinations, the same general kind of stupor, but the dose varies. So for atropine, for instance, you're gonna need six to seven autoinjectors to give you marked confusion. Scopolamine, you need a lot less. With BZ, you only need one milligram to give you the equivalent of six to seven autoinjectors of atropine without nerve agent. And who knows what the dose for BZ is? Now, BZ, I mean, the dose for agent 15. So BZ, the official name is three, quenuclidinolbenzalate, that's my tongue twister of the day. And the reason it's called BZ is probably because the parent compound is benzalate, and perhaps also because of the buzz that you get, the high that you get from the injection of the equivalent of some atropine autoinjectors. The only incapacitant that the United States has ever weaponized, we started destroying the stockpile in 1988, almost all of it is gone now. If any is left, I'm not aware of it, but I'm not saying that there isn't some. And the point from this is that it's a solid, as we said before, the melting point is really high, so it's always going to be a solid. And it's extreme, it's odorless, you can have this, and there's no initial irritant effect, there's no initial behavioral effect, in fact you'll find out that the onset can be ours. So there's a latent period, just as there is with phosgene. It's also extremely persistent environmentally. So if this stuff is spread over an area, it can stay there and then it can be kicked up later by dust or whatever and still present a hazard. So it's usually dispersed as a solid, roots of inhalation obviously, roots of entry obviously inhalation is one, but ingestion is another, if the stuff is coating food or coating some other objects, or if you inhale dust and the ciliary mechanism brings it up to the nasal pharynx and you swallow the stuff, since it's a solid and it's very persistent, that's certainly conceivable. Or you can have absorption directly through the skin, especially if you have an adjuvant like DMSO that increases penetration of anything into the skin. We don't have a detector for this, so it won't show up on the M256A1 kit, won't show up on the M8 alarm, won't show up on any of these things. Now, what was the LCT50 for riot control agents? You don't have to remember the exact number, but it was pretty high, wasn't it? In, yeah, in the 60,000s, 100,000s, well, the LCT50 for BZ is even higher, 200,000, although it is possible to die from BZ primarily from secondary effects from hypothermia because you don't sweat anymore. But the ICT50 is fairly low, in fact very low, but look at the onset of effects. Half an hour to four hours, mean time of two hours, but it takes a while for the effects to come on. And when they do come on, and they may not appear until a day and a half after ingestion or inhalation even, but when they do come on, they stay for up to four days. And what are the peripheral effects? Well, we know the peripheral effects because they're just the opposite of what you've been drilled ad nauseam concerning nerve agents. So whereas the nerve agent effect on the eye is myosis, what's the effect of BZ on the eye? Medriasis, okay? Paralysis of a common day, okay, what are the oral effects?  Give you dry mouth. Since, and remember we said heart rate was unpredictable with nerve agents, well it's unpredictable with BZ as well or at least it doesn't give you a lot of clinical information. GI effects, remember what were the GI effects of nerve agent? Hypermotility, so nausea, vomiting, okay, diarrhea. So what were the effects here? GI shutdown, constipation, decreased mobility, no utility, decreased secretions.  And that can lead to heat retention, hyperthermia, and GI effects, nerve agents can make you incontinent of urine as well as the feces.  None, that's odd, because usually they do. But certainly that can happen with nerve agent incontinent of urine. Well what's gonna happen here, urine retention. And of course, since nerve agents cause fisculations and twitching and hyperactivity of muscles, what will BZ do? Where does atropine not fit? Nicotinic receptors. So you can't automatically say that you're gonna be weak from BZ. Now it so happens that most people do get weak from BZ, but we think it's a central effect rather than a peripheral effect. Since BZ and its congeners don't really fit into nicotinic receptors, they don't really block acetylcholine at those sites. But centrally, you do have some incordination, heightened stretch reflexes, ataxia, and sensations that are perceived by the casualty as weakness. Okay, now the central effects are wonderful. That's the reason that it's fun to give this lecture, because of the central effects. You start off, I mean there's some general effects on level of consciousness. There's drowsiness and more sedation and stupor, and if you give enough of the stuff, you can induce a coma. But, and there are also disturbances in judgment. And so people will make decisions that are inappropriate and they will confabulate, they will use profanity sometimes. But the really fun part are the perceptual changes. Because people will have hallucinations and illusions from this.  Okay, tell me what those hallucinations are like. They describe their hallucinations as, I mean, alterations and just, they could hear sounds and see, they could see sounds and hear visual cues. Okay, and that's very common with psychedelic hallucinations. You get sensory crossover from one modality to another. And also, the hallucinations often tend to be geometric and abstract. You see weird shapes and all of this, and they don't have a lot of connection to the reality. The hallucinations induced by anticholinergics are extremely vivid and real. The patient identifies something. It's an elephant or it's a tank or it's something, but it's not there. But the patient thinks it's there. And often he thinks it's there because of the visual clue of something little. He sees the flag or he sees a wrinkle in the carpet. And that wrinkle in the carpet becomes a large boa constrictor to him. But he knows it's a boa constrictor. He may be talking to him and he may be talking back to it. But he knows exactly what it is. It's not some ill-defined mélange of colors. And those hallucinations tend to decrease in size over time as well.  But it's something very, very concrete. And eventually there's a nap or something. Tension and memory deficits, deficits of expression and comprehension. So we have, you know, sometimes the speech is kind of slurred and senseless and doesn't make a, and it's almost as if he's half asleep and he's concentrating not on you, but on the ball game that he sees in front of him. And he's watching that on the television in front of him. Where there's really no television, okay. So a disorientation to time and place. I mean, this may remind you of people that you know. We may remind you of some of the speakers out here. It may remind you of some of the review sessions. But we are, I guarantee you, we are not surreptitiously administering anticholinergics here at all. Even though your mouth may be dry right now. Mine certainly is. One of the particularly interesting characteristics of people who have been intoxicated by anticholinergics is that they, you know, the old expression will gathering. It's from gathering something that's not really there. These people will pick bits of lint that they see on your clothes or on their clothes, but they don't even have to be on the clothes. They're picking it out of the air. And what this seems to be is kind of an automaticity of, you know, basic actions that are repeated. And the disrobing seems to be partly automatic and partly a response to the impression that these people are too hot. So these people are really fun to watch and they're fun to talk to. And one moment they can be, one moment they can be completely with you and they know where they are. And the next moment, they're back talking to the boa constrictor. And that's also one of the characteristics. So if you see somebody who's there or not, so what would be one of the important tests to distinguish this kind of effect from, say, anxiety or just confusion? What kind of exam are you going to do? Now let's see this exam. You're going to say, are you oriented to time, person, place? Can you do serial sevens? What's your short-term memory? Who is the president of the United States? People who are anxious and are having panic attacks can usually remember those things. They may have some deficit in serial sevens, but usually they can remember those things. People here, not only will they not know the answer, if they don't know the answer, they'll make up a great one. They can fabulate. Who's the president of the United States? Oh yes, it's George Fitzpatrick, yes, and his vice president, and they can go on like this, creating something that isn't there. Behavioral liability we talked about. And the other interesting thing is that as these people are coming out of this, all of a sudden they kind of realize, they begin to realize that what they thought was real wasn't, and then they get really paranoid, and that's when they really need to be restrained. And most of these patients actually will require restraint. Most people actually go through four relatively distinct phases. They slide into one another, but with the onset of a little bit of drowsiness, some mild CNS effects, some mild peripheral effects. Stage two, and that may not begin for four hours after exposure. It may not begin until much later if the onset is later. But then in the next page, they get really unable to walk well, and they may heat up because of lack of sweating. In other words, the peripheral effects become more pronounced. And here's where it is the most danger from dying from heat stress. And in the third place, in the third stage are the fluorid delusions, and eventually they sleep this thing off with paranoia in that phase also, as they're going to sleep and waking up. Now, I think that the two most useful slides in this lecture, or the slides that you're seeing right now, because when you see somebody with hallucinations, or somebody who is acting funny on the battlefield, what could it be?  What could it be? Well, there are plenty of things that cause what you see in the first paragraph. Restlessness, whiteheadedness, vertigo, the stumbling or stagnating, vomiting, anticholinergics will do it. Psychedelics will do it as well. Marijuana will do it. Alcohol can do it. But specifically, anticholinergics will give you this combination of central and peripheral effects. The hallucinations plus the dryness of the mouth, the urinary retention, the heat retention. And you'll have these, you know, you may have, classically, you may have these phantom behaviors of picking and mumbling, that kind of thing. You may not, the patient may not have a classic presentation, but classically, this is what happens. Now, what happened? How's that different from psychedelics? Well, remember, the hallucinations are a little bit different. They're more abstract, they're more geometric. People also are often, you know, inappropriately happy with psychedelics, right? Those of you who've treated psychedelics sometimes. Unless there's a really bad trip. And there may be some peripheral changes, but they're not usually, except for occasional medriasses. They're not the ones that we traditionally, that we characteristically associate with anticholinergic overdose. Now, marijuana, again, marijuana intoxicating, you know, people under the influence can be very, very mellow. That's a good term to use. And these people are, you wouldn't really describe an anticholinergic patient as mellow. He's more self-absorbed, and is on hallucination. It's not quite the same thing. And of course, with an anxiety reaction, you can, you know, sometimes people lose the loss of a limb. They can become apparently blind, even though their eyes are open, although that's a rare reaction. What do we call that? Conversion. A conversion reaction, okay? So, the differential diagnosis here is something that I think that you ought to keep in mind.  Well, we know it's gotta be solid. What does that have? What implications does that have? Well, it has implications for decontamination. It has implications for stirring up the stuff if you think the guy's covered with it. You don't want to inhale it either. Inhalation will be the probable root of entry, but be aware that there are other potential roots of entry. Do are the effects local or systemic? Systemic. That's what we worry about. We worry about us getting to the CNS and producing the hallucinations and getting to the peripheral end organs and causing hyperthermia, causing the other effects. Okay, and this kind of thing. Okay, treatment. Always, always protect yourself first. And then if there's general supportive therapy, well, you can do that. Well, the general supportive therapy here obviously is decon and soap and water's fine or brushing for clothes. Observation and, you know, most of these patients, as I said, really will require restraint at some point. When that probably also means early evacuation because they're gonna be in your way. They're gonna hinder you unless you restrain them and put them off to one side and it would be better even if you could just to get rid of them. Because their course will be prolonged. They're gonna be like that for three or four days. And in fact, nothing we have, even specific antidotes, nothing we have is going to change that. The antidote we have is something that will control the symptoms while they're there. But if you stop giving the antidote, the symptoms will recur. And what's the antidote? The antidote is, well, let me ask you. Let me back up and ask you this. Since the effects are those of atropine and atropine is used to treat nerve agent, what would be a good, and nerve agents are anti-colonesterases, what do you think would be a good category, a good candidate for an antidote to BZ or to Agent 15? Nerve agent. Nerve agent, you mean you want to treat these people with nerve agents? As a matter of fact, animals intoxicated with BZ have been treated and treated successfully with VX. Now I'm not suggesting that you carry VX to give, but you understand the rationale. You can treat an anti-colon, that is you have too few green dots. And what do you want to do? You want to make more green dots effectively. So if you administer something that's an anti-colonesterase that cuts down on the destruction of the green dots, well, you have more green dots. That's what you want. You want to increase the effective level of acetylcholine in the synapse and at the neuro-glandular and neuromuscular junctions. And the one that we use, that we tend to use is physis stigma. And physis stigma is nonpolar, so it crosses the blood-brain barrier. Do we want that? You bet we want that. Remember periodostigmine doesn't, under normal circumstances, cross the blood-brain barrier. And we don't want it to cross that because we don't want central effects. We don't want confusion. We do want this to cross the blood-brain barrier because we already have confusion and we want to get rid of it. And, you know, minimally effective during the first four hours, that's characteristic. If you had somebody and you knew that he was hit two hours ago, you can give physis stigma and typically there will be no response. But beginning at about four hours after onset, physis stigma is very good. And I realize I haven't put a dose up here, but the dose is usually about 30 mics per Kig, which translates to 30 to 45 mics per Kig, which translates to about one to two milligrams in a 70 kilogram person. Give that intramuscularly, IV can be dangerous for some of the same reasons that atropine given IV as a bolus can be dangerous. Precipitation of cardiac dysrhythmias. But you'd give one to two milligrams, re-evaluate, I mean, give another dose in 20 minutes if you needed to, and then re-evaluate in probably every one to four hours, you'll probably have to give more physis stigma. But you'll have to do that during the entire course because once you stop, the symptoms will recur. Side effects are cholinergic and you all know, how many of you have used physis stigma in clinically? Okay, so you know it's not something that you use with careless abandon. There are some significant side effects. So if these patients really do appear to be getting better or if they're not severely intoxicated, you may elect not to use physis stigma at all. But if you do use it, use it with the cautions that we've talked about, and what would the side effects be? They'd be cholinergic, wouldn't they? Because physis stigma is an anticholinesterase. So, what's an incapacitant? It depends on what your definition of incapacitation is. The specific definition for this particular class is a class of non-lethal chemical agents excluding the riot control agents because technically we don't consider them to be a part of this, although they're designed to accomplish the same thing. The incapacitation is normally derived because of the CNS effects, although there are peripheral effects as well. Only known weaponized agents are BZ, which we have, and Agent 15, and we're not exactly sure what that is, although it appears to be a glycolate anticholinergic, either identical to or similar to BZ. Delayed onset, okay, also occurs as a solid. Delayed onset, protracted course, up to four days. Labile presentation, the sensorium goes in and out, the hallucinations go in and out. Remember the combination of central and peripheral effects when you're doing a differential diagnosis of this, and the specific antidote is physis stigma, and that's all I have to say about anti-incapacitating agents, and if you're not completely incapacitated, you may ask questions. Sir, you said that if you stopped the treatment with phyto-stigming, that the symptoms and signs tend to recur, yes. Will they come back at the same strength as they were before you started the treatment, or will there be any decrease at all, or? No, they can come in, and in fact, if you use phyto-stigming and then stop it, the clinical course tends to be prolonged. You tend to prolong the clinical course. So once you start it, you want to stay the course with it, but yes, if you stop it, the clinical symptoms can come back full-blown, just as full-blown as they were.  Yes, ma'am. I was wondering, you were talking about BZ degradation, or you were talking about BZ remaining in the, yeah, how long does it remain in the environment? Does it break down? Do we know this? The studies that I've read indicate that it can be around for a long, long time, and part of this is the fact that it's just a very stable, the crystalline structure, et cetera, and the fact that its solubility characteristics are such that it just doesn't seem to break down in the environment. It's one of the most stable chemical agents that we know of. Now, we already know that mustard can stay around for how long? Months sometimes, okay? This probably can stay around almost as long or maybe even longer than mustard.