So, hi, folks. Welcome. I'm here today with Lise Verano, who is just retired, one month of retirement from the city of Burlington after working for 58 years in the city. I don't know if there are many people who can just claim that distinction. Lise, tell me a little bit. What was the title that you had within the city of Burlington? My last title was finance and technology for fire and police department. And we first met a few years back. I think I was asking you for some advice around careers and I just was struck, who is this woman who's like put together, organized and commands the respect of so many people in the city? And you were working then inside the police department. But tell me a little bit about how you got started. Well, my first job was actually a microfilm technician at the Burlington Police Department and I was recommended to take that position. It was brand new, something that hadn't been done before in Vermont. In law enforcement, there was a federal grant and I jumped to the occasion and learned how to do microfilm, developing all the archives, filming all the archives in the police department at the time and developing the film, putting it in the sleeves and it was a three-year project. And what year is that? That was 1973. That's why May of 2023 was my 50 years and special for me. And it was a good number. So I did that for three years and then a position at the fire department came on. It was a business office position and I was really it was an opportunity to just create the office because it didn't really exist that way because of the times it was a lieutenant that had the position and he had left where he was asked to leave. And it was an embezzlement situation and they were looking for a finance person to come in and organize. And I actually didn't get the job because I was a woman and they had never had a woman in the fire department before and I remember doing the interviews and it was back in the day when all kinds of questions that were being asked would not be asked today. And I answered the question, would your husband think about this? Are you gonna have kids? All those kinds of things. And I didn't get the job and I remember being in the interview room right outside of the chief's office when the commission was doing the interview at the time. That's how they hired and there was all these men and five other guys that were there applying for the job and one of them had gone in the job and unfortunately he went out and celebrated and on Monday morning he wasn't able to come to work. He was in jail. Oh no. Celebrated. He was celebrated a little too much so the fire chief called me up and he goes are you still interested where you come up and my boss at the police department was like least go just walk down the street from 82 Southwoods Bay Avenue to 136 and you know walk in the door and they needed payroll and they didn't have payroll set up and I didn't know what how to how to take care of it so I had to figure it out you know just look at what was done before and pay the people the firefighters and that was the beginning of the fire department career and I did that for a solid 25 years and as well as going over then to the police department because I was asked to do that. So it must have been about 1976. And who was your boss then? Pat Brown. Pat Brown was the fire chief. Okay but who was your boss at the police? Mary Campbell. Mary Campbell. She was supportive of you. Yes she was very supportive. She actually hired me. She had worked with the high school to get some candidates that were business candidates and I was highly recommended with a friend of mine from the class and she did it for about a year and then she decided it wasn't for her and then I helped hire her replacement at the police department to do the grant so she saw that I wanted to get the job done I want to do a good job and bring new good people in and she says you'd be good at organizing the fire department business side of things that they needed you know it was just a different time so it's not no reflection on them it's just the way things were. Sure yeah and so you came out of high school you went to Burlington High School. I went to Rice. Rice High School. In the business program. Okay and tell me a little bit about who you were in 1973. Oh my goodness. And what you grew up in the area right. I grew up in Nalitz Bay on the lake right outside Lakeshore Drive and I. French speaking Well very French speaking that's where my whole French side things comes in. They were both from Quebec my parents they got married and moved to a country they did not speak the language all within a month had a child the next year and my father there's a whole story with my father I don't need to go into that but he he came to this country not having knowing how to speak to English he was hired at General Electric because of his meteorology skills helping fix the Gatlin gun and airplane propellers that were cracking in in flight and he basically walked in says your ovens too hot and your metal mixture is not correct I can help you fix that all in French to this guy he met at the gas station anyway so he got the job so I grew up not speaking English and I wasn't till I was in second grade that I was able to start communicating well and because we were only allowed to speak French in the house and we didn't have neighbors for the closest neighbors like half mile away and there was a French speaking mom there so she helped us transition and being the second oldest when one of six kids and I'd grown up with three brothers and three cousins the male cousins so I was around a lot of a lot of boys and just that was normal for me so I think that's why the the higher the police department and the higher at the fire department was just a natural it didn't it didn't faze me that I was amongst that male population yeah you know how to navigate so there are four of you growing up I'm gonna fix your mic real quick there you go you're fine there are four of you growing up in Mallon's Bay at that time there there were actually actually there were that's right there were four and then my youngest sister was born in Burlington and so now we had three brothers you know three girls and three boys and yeah so I went to you know Mounts Bay school there was no high school that's why I ended up going to Rice so 1973 I had just gotten married I met my husband at the police department or through his father who was a corporal there and we had just gotten married and you know I was looking to move on one career wanted to be a business person and these opportunities came up and what were you doing when you're talking about doing the microfiche that's 73 to 76 and the police tomorrow what what were you doing your oh so we had so Xerox and Kodak came in with the equipment yeah the camera equipment and there were upstairs at 82 Sousa Avenue there were all these files cabinets and evidence and and and reports were all kind of filed together and what they wanted to do it filled up a whole room and they actually had a pool table there as well but that's the only other thing it was in that room and they needed to get the files digitized and so Kodak and Xerox came in and showed me how to run the equipment the photography equipment and we actually filmed each piece of paper and had to code it and you know give it a name a file name and then we developed I developed the film and then I had a different machine that I had to feed the film into the microfilm sleeves and then the sleeves went into a another Rolodex kind of an old word but a Rolodex cut piece of equipment for people to retrieve the documents so did you recognize something about yourself in doing that work what did you what what did you recognize as your strengths you know I was this eight-year-old kid who brought the neighborhood together there was kids in the neighborhood and I would have a class in the basement of my house my father got me a chalkboard I was eight years old and I loved organizing things space projects I think I've always so I saw the microphone project as learning something new really excited about that and making a difference right it was meaningful work meaning they had to empty out all that space you know in the files and I just love the process I'm my family calls me the process engineer that we're all electrical engineers they're all electrical engineers and mechanical engineers in my family and I my degree was not in engineering was in business and so I just realized I enjoyed creating things so when I went to the fire department it was creating an office right from scratch right I mean the file cabinets were not really well organized you couldn't I couldn't find anything and I said you know what we're gonna start from scratch and I know how it's supposed to be I'm just gonna do it and the chief was just thrilled and within months he was you got this you just tell me what you need yeah tell me what you need to do your job and you're doing finance and payroll and sort of general systems management yeah we did we would call operations operations yeah business operations for sure and I was the one that actually would call people for job interviews I was sat on the interview boards for the fire department for the firefighters I would be the one that did the billing for ambulance ambulance service actually I brought one of the old very original onion paper because it was all typewriters back then it wasn't it wasn't computers right matter of fact one of the first personal computers in the city because Burlington Electric was well set up and the city of Burlington was had a main frame but I had a personal computer because the chief at the time from New York City so we need to get a computer I was like I know $8,000 some ridiculous amount what year is that 19 19 was a probably 1980 yeah I'd have to have my cheat sheet in front of me I don't want to misspeak and you're adult doing DOS oh yes oh yes oh yes and so anyway but before that we was all done on paper yeah and carbon paper yeah so you'd be sending out pills doing these over and over and over again it made no sense so when the opportunity to to update how we did what we did came up I jumped on that as well and created a program with Champlain College later on to do the actual accounting like an accounts receivable program I created a budget system that had encumbrances because not everybody was looking at encumbrances back in the early 70s I mean of course they did later right and I helped buy the city's first you know system but I always pride myself in seeing what needed to be done to improve things and then helping make a plan to execute the plan and make things better and then you have to refresh you have to look at it again you know a few years later and then update it again so that was a constant and how do you feel you were received by the people around you in doing that well two things first of all at the fire department it was hard because they'd never had a woman in the building and the wives of the firefighters were not happy about having a female work in there now I understand why they didn't hire me to begin with but I was focused on is doing good work fixing things making it better and making the organization accountable because that's how it broke it wasn't as accountable as it needed to be and I wanted to make sure there was a good cross-check system in place and so the firefighters were not all thrilled about the phone call saying hey you've been out for two days this is before keeping my this is before a lot of rules about what you cannot do so I would be the one calling up and say hey you've been out for two days because I have to do a payroll and you're going on your third day you you know are you coming back what's the plan where's your doctor slip so I was an HR I was H I was HR but I was also aggravating people for making those calls but as some people will tell you I was also the one calling I'm say hey you haven't interview you haven't responded saying that you're going to come and show up for the interview for a firefighter position are you still interested and and I've had a couple people saying if it wasn't for your phone call I I might not be a firefighter today so you know you you know you did your job when people years and years later will say thank you for those phone calls we ended up working the contract the fire contract I was on the negotiation team with the city of Burlington and the fire union and I always said the fire union the unions have to be communicating well with the administration in order to get a good contract that it works for both both the union already established when you the union was established at the fire department and police department wasn't that you know it had been a relatively newly established in 60s in the 60s but working with the the union and the firefighters and the chiefs you know just knowing what the agency needed and helping make the rules the regulations the contract policies did a lot of that in the early years the first maybe 20 years no there was no union and so when I came in I was the first civilian yeah I was the first civilian and I was the first female yeah and asked me was the union body because I was the only one and I voted to for myself to not be so when I hired start hiring staff there was a billion then we had to vote again yeah and at one and then at that point the choice to join the ask me union was made I was never union because I was management yeah from from the beginning so you when you're describing that you're describing a lot of human resources management tasks operation systems do you consider yourself in that a leader I never looked at it as being a leader but I I am told that that's exactly what I did the fire chief from New York that one that got the first computer made possible at the fire department he had promoted me as operations assistant which was a title that caused more problems because operations it's you're not a firefighter you're not I even thought about taking the firefighter exam I was training in the martial arts at the time I'm gonna make this I can carry the body across the line yeah exactly what the test was because when we do the firefighter entrance exam there was a physical fitness component to it yeah and I knew what it was I was already ready for it at home just from other things I mean on as an aside did you ever feel that that physical fitness test was biased towards certain body types or physical types because in in martial arts you learn how to use your body yeah and it's all about your logistic I was sure I'm short I'm a short person so for me the hardest thing was I was concerned about was the ladder putting the ladder on the truck yeah cuz even on my tippy toes yeah I didn't I would have to toss it yeah I just didn't have the height yeah so I never never pursued that angle but I just wanted to make a point it took a long time and I think they had to change the exam right to have the first I don't think the exam well there's a lot of there's a lot of history there I was a proponent of this was anyone who's first female fire yeah so yeah but but I was a proponent of not changing anything because it doesn't matter what your gender is whether you you just need to do the job can you physically do the job and if you can then you should do the job that is needed pass the tests that demonstrates the physical fitness requirements you know so I was never a proponent of changing it that happened years later and early on we had a female firefighter that was hired you know and again that there's it's just it's a cultural shift yeah I'm pleased to see some women female leaders in the fire department now and I'm excited for the future what that might look like but I don't I always believe people should be able to do the job do this the tasks and as I said I didn't feel I was gonna be able to do that latter thing and sure somebody else could accommodate and help alright that's not the point well interesting that so you know interesting to think about the ideas of leadership and leadership qualities and you've made it through I mean these are again staff positions management positions at your serving at the will of you the fire chief or the commission but you've been through multiple mayoral tenures multiple police chiefs multiple fire chiefs so talk a little bit about that what have you seen let's just focus on your your immediate supervision leadership what of the changes been like um I always just did what I felt needed to be done and looked at what needed improvement and so it didn't matter who the chief was I felt my job was to establish communication and the style of communication is based on an individual not a title respect had to be there obviously but I always found a way to work with the different leadership styles I was facing to make them successful and that same with the mayors you know and knowing what was needed in the city at the time talk can you just get into that a little bit when you talk about leadership styles can you give a little well sometimes people come in so you know I've had a lot of fire chiefs a lot of interim fire chiefs I had a lot of police chiefs a lot of interim police chiefs yeah so you know there's a small number of actual people that made the list right but everyone comes to the table with their own I don't know if it's an agenda but certainly their own mission what they like to accomplish in three to five years I think it's three to five years basically that's pretty much what the turnover is so what do we need now and the person that's hired because I hired I help hire with being on the interview boards for several of the fire chiefs and when I did that I was look what do we need now what type of skill set that we need to bring to the table because it changes why it could be administrative it could be operations it could be just basics it could be community relations it could be you know what is it we need so for me it was helping them identify the low-hanging fruit to make them successful to make it them be bought into the organization because not everybody always agrees right who should it be but for me my job I saw as make it work yeah no matter who it is make it work make them successful and that obviously makes the higher-ups that the mayor would be successful you know and working with the city attorneys and HR and the budget side of things of course which is a big deal yeah it's a big part of what so it's yeah at some point you move from the fire department and then it becomes a position where you are working for both the fire department and the police department talk about that when did that change happen well that was in in the works for almost eight years before it actually happened and there were a lot of iterations of how to merge fire and police you know fire and police administration public safety officer that is fire and police and there was years of turmoil about all that and then came a time where they asked me specifically to go over and probably four years after they had asked me I wanted to make sure the air was right for the merge of administration to work and Elena Ennis was hired as was the first female police chief at the Bernalton Police Department and she said at least you know I need you to come in and do that's before Kevin Scully was right after Kevin Scully right after Kevin Scully okay right after Kevin Scully okay yep Kevin Scully was there for a long time and she's I'd like you to come in and do for the police department what you did for the fire department those are the words and I was like well I can do that and and she goes what do you what do you just like Pat Brown what do you need and and how is this going to work and I pretty much established the parameters and she took me to IACP I came wearing that pen International Chiefs of Police Conference the very first year I was there in 1990 1999 I should say and that opened up a whole new world for me and it gave me resources and tools and people to just tap the shoulders on about each little thing that I thought could be improved but one of the things we were trying to do is dispatch on fire police dispatch and just that was always a hard hard area to address so I do a little bit of work with that and there's a list I talk in terms of consolidating in terms of well the consolidating simply meant well it simply meant I would now be responsible for both the fire budget and the police budget fire technology and police technology and there's a lot of situations around all that and take too much time to talk about it but the point was it was in one person so I was the one person I'm sorry I keep talking to my good and I was comfortable with that because to me I had the mission I had the vision I had a plan for each of these aspects and I said I needed a team I brought my assistant from the fire department but it's part of the merger plan anyway although now it's gone back okay so you know what it's oldest new again kind of thing it happens a lot that's okay so she came over with me and then I hired the specific people for specifics task I hired the very first network administrator there was no now a lot of people did a network administration work but there was always an add-on to their jobs and I said we need someone just focused on this and because again there was some some history that needed to make sure it was never repeated and this is making sure your network systems your infrastructure infrastructure works yeah so well that's actually as part of it so the hub grew into a network center yeah and I wanted to make sure it was well designed well protected well redundant there are redundancies you know that we have at One North Avenue that we didn't have before and people probably think it was always there but it wasn't and that's why you'd have networked down in collaboration with the state of Vermont the state of Vermont was leading the the CAD RMS records management and dispatch world and there was a lot of changes that happened through that we now have a product that's called Val core that was developed through Burlington Police Department a chief Mike Schirling at the time was instrumental and then now it's a statewide system and that collects data and it's what you were out on your I know we had it on the chief was doing their report because we record the Burlington Police Commission meetings and he does reports they are using that Val core system to tell the story the data yeah to tell the story of response police response and resources right the way that works is that the dispatch center gets the call goes into the system the dispatches is assigned to officers fire you know fire and police have their own right now but then it becomes an incident and then what you see here on your screen was the incident data I think we forget and I think you know one of the things that I just think is so amazing about you Lee's is that you can help tell the story of how these systems really there's policy there's like there's leadership that makes policy on this level and then there's the systems and then there's people the operations decide how you know when you put a street and it decides how people are going to move down that street if you put a sidewalk are people in a safe or not so just like you know I'm just how have you come to embody that from that eight-year-old who's teaching classes you learned along the way so on the fire department side the first cat or a mess system was well I shouldn't say cat or messes it was a records management system was reporting to the state with reports to the federal government I was one of the people that helped design the very first DOS base D base system again with Champlain College who offered some support services and and then it got your your impetus then was to report on what you needed to report to the federal government or the state better better more efficiently bringing efficiencies to manual systems yet I just said that so probably that's what I did yeah and then to take to make sure that the data was easy enough for people to put in to make it accurate you know everything goes through learning curves yeah even today the brand new systems people have to learn a new system got to make sure it's not you know garbage in garbage out is not not a good thing so I did that so I came to the police department with that having done that way back and so when the idea of the canned systems that were available we're not doing what we needed to do for reporting for operations for the chiefs for the battalion chiefs or the deputy chiefs for that matter at the police department we needed to we that's how Valkor came to be is that we just need to design our own you created your right because Burlington was was pretty diverse with its population with its schools with it's just like a big city and a tiny little place and we needed to do more at that time than what maybe a lot of the smaller communities needed to do that they could use a system that wasn't as elaborate and so we keep even today we are still trying to improve the systems and how do you learn about those those pressures where do you learn about those pressures how do I improving those systems I hear people I hear people will complain about how cumbersome something is how time-consuming something is or or if I I listen I guess I listen to what people are saying and watch what they're doing or questions that are being asked that can't be answered easily I'm like there's an answer for that we just we just got to figure out how to get the data get the information and build the system if we have to yeah so let's just take a couple of minutes to talk about your your tenure through the city for the last 50 years through multiple mayoral ten years and is there anybody that stands out to you or anybody that you had that anybody that you want to remark on well I think there's some interesting fun stories I'll never forget when Bernie Sanders was mayor and I was at the fire department and I was wanting to do a ambulance fee increase and I and the mayor and the city council needed to approve those things and I remember going up into his office and he said it was such a casual person yeah keep talking he was such a casual person different from what we had had before and so out of respect for him and trying to help him be successful he didn't wear a suit and tie oh no he did not wear a suit and tie and Bernie I hope if you see this you forgive me I remember walking into his office and he had his feet on the table on his desk crisscrossed he had holes in his sneakers his socks were pulled up his hair was the way it is and I'm sitting here talking to him I'm trying to be I'm trying to be me I'm more formal that way right I'm just being respectful and I'm am I am I getting through and he goes yeah whatever you think wait well yeah I know but mr. mayor this is important that you understand this means an increase to the tech to the citizens when they get a transport by ambulance yeah and I want you're gonna they're gonna call you and complain that the fee went up I want to make sure you okay no I understand you know and he was very clear but very relaxed about the whole thing and basically I think what it came down to this is while you've been doing this a long time I'm sure this is gonna be fine I said okay so then I went to the treasure and let the treasure know as well what was happening and of course the chief was already way behind me with it was he hadn't thought about increasing my increase but I'm looking at the budget I'm looking at hadn't been done for like 10 years and it's time yeah so so that was an experience that I'll never forget yeah and what did you learn I mean what did I tell you I think I learned that people are going to are themselves and they have different styles it doesn't take away from the role that they play the responsibility they have and my job is to help the community at large right at the end of the day it's the community at large that I was trying to help just because I raised it in an ambulance rate it had because I wanted to keep the ambulance in service I wanted to make sure it was operational and supplies and everything else you know everything was going up the other mayor that really and I'm and this is kudos to Morrow actually because he when he came in as mayor he was the first mayor that came to the fire station and asked questions of the command staff and was myself in the chief and he was probing questions wanting to understand after he'd been elected already yes after he had been elected but it was it was not common for a mayor to come walking in and saying I want a meeting in your office ask those questions so I give him a lot of credit for researching and listening at you know to what what we thought that had never happened before and so over the years you know when there was a big change about to happen it was it's comfortable enough for me to talk about those things and what it meant here's the pros here's the cons you make the decision and that's just not the mayor is the chiefs the deputy chiefs whoever was in charge of taking action my I saw my job is informing them giving them the information of if you do this this can happen these are the choices this is the risk assessment you know this is the potential downfall at the end of the day it's your decision yeah so you know again with those those big leadership changes in 50 years you must have seen things that propelled change either for the good or the bad or there are other moments in time that you felt like we were getting things done in a good way or getting or you know there's been falling back yeah there's been several of those I mean that's life right those five-year cycles I tell you about I mean a marriage is like that too sometimes you know you've got the really good years you got that's not good and then you get a year you're really insane that's a smooth that's nice a community is I think I think the hardest one for me and I'm afraid this is sort of political now and I don't tend to do the politics side of things but it was really hard when the defund the police happened I didn't understand it I didn't I didn't I wish I could have had more conversations with the people who felt so strongly about wanting to do that but it's almost like there was other forces at work and I remember telling the the police officers in a meeting in a row and roll call and the chief's meeting saying this is this is a phase we've been through really tough times before and we've come out of it we'll be okay and a year went by and I'm like man this is not getting better this is getting worse so that was scary that was that was really hard to to be wrong to be wrong about my rose-colored glasses being solid and that things would get better it took a long time I think we I think there's some shifts happening now that put us on a better path but when something breaks down it's like a bad habit you know you it's easy to start a bad habit it takes twice as long to undo a bad habit right whether it's smoking whatever it is and people don't realize how fragile a good system is if you if you bring it break it down so much that it's got to really start over yeah so you felt like the you felt like the folks that were calling to defend the police and then the decision of the city council was the the negative impetus yeah and was there anything that was learned during that time as well during the I'm not I think people are still learning unfortunately I don't think it's I don't think it's fully recognized people are starting to reckon people who felt strongly about why they wanted to defend what was sad about that is by doing that they took away the very programs that they wanted they said they then said they wanted and needed and now the program was was decimated and there weren't people to do the work so that's sad that's very unfortunate and then rebuilding it in a different way is what's possible now and I always look at what is possible what's the future you know the possibilities are out there we really have to work together talk understand not just talk but understand where you're coming from why what is exactly you know if we could have gotten really good answers about that as opposed to pointing to the rest of the world the rest of the country because Burlington wasn't that and yet it was in people's minds and therefore fighting that that that fighting that yeah and this is that this is the place between the sort of the political leadership where policy happens the operational and management who understands and then the people who are doing the work and there's you know where's the place that those all come together you know in in certain ways it's in a person like you in that job but how do you make that institutional wow wow they're like life lessons right the people doing the work do not forget everybody that does anything is a part of the solution and they typically are doing their job 100% every single day doesn't mean somebody doesn't make a mistake doesn't make some you know stuff happens but they're doing the work the and the management is just trying to organize people and give them direction when when the two don't when the two don't come together in a clear way that's when you have this lack of lack of focus and direction so it would be best if and I believe there is a future where everybody is communicating well and clearly about the mission and break it down into pieces go with the low hanging fruit it always works you go with the lowing fruit because establishes relationship and possibilities and all of a sudden you're talking to someone you didn't think you had anything in common with but you do and I do this on my personal volunteer work every single time you bring the right people together there's a conversation that's going to happen and people may see something in someone that didn't see before but you have to have your eyes wide open and if you're only focused on an agenda because of the sake of the agenda then I actually don't have a lot of time for you just because that's just not going to be helpful I want to be mindful that I want to talk about your volunteer work which is you know first of all you were the president of the Burlington Rotary and the Burlington Rotary just celebrated its hundredth anniversary and I imagine you're still involved yes Rotary and then you're also the honorary consul to France as part of the Burlington sister city well in your work as part of Burlington sister city with Henri France so can you just talk about that a little bit your Rotary work your volunteer work and your counsel you know sure let me start at the short let me start again four minutes four minutes two minutes so so in in Burlington in the city of Burlington with my work I was actually asked to translate for Russian fire chief that was coming to Vermont to Burlington he was going to go to the 911 center in Montreal and I was the one that spoke French and the mayor had asked me then if I would be his and the chief asked the fire chief and the fire chief asked me if I would be his translator for a week and so I did and we took him to Montreal well that became the way you know the girl that speaks French the person that speaks French in the city and then a group bob kiss term had gone to well there's a several pieces there but people have taken making a trip to all Fleur France and all Fleur France is where Samuel Champlain came from and so they said we should have a sister city that's a port city it's on you know Burlington's on the port so we created the Burlington sister city in 2012 I was asked to go to a meeting and by several people and then I was nominated president of the all Fleur sister city and I said what am I supposed to do what does this mean she goes oh no you'll figure it out and we'll do it and that's what we did so I was the president of the all Fleur sister city and we've been doing a lot of good work take me too much time to talk about all that although I'll come back to you later and tell you about what's going on taxed okay another time and then in 2017 I was nominated I was made night I was knighted by the French government in France the president of France knighted me I'm not quite sure who put me in for that but thank you and and a couple years later Ernie Parmel had been honorary consul to France for 17 years and I had been partnering with him since 2012 and he said we see you're next you got this I said I don't know if I could do so we'll partner now he took care of the fun part I took care of organizing things so I was made honorary consul and and that's where I am today as far as my volunteer work I was with the Alliance Française for many many years I still am I'm a lifetime member now thank you Alliance Française and I was on the board and bringing French culture to Burlington to Vermont and I do that now I recognize some World War II veterans in Montpelier with the governor last year it was a really nice proclamation in Montpelier with the international flag raising done that for many many years thank you the Burlington fire department police department for the color guards that did the best presentation and in New England because we actually raised the flag we had the honor guard and the consuls in France and Quebec Canada just love doing it in Burlington because we had such a good presentation so all those things come together again there's a team behind every single one of these things I'm talking about these are sister cities amazing group of people that he has Française is actively working to get on the marketplace I could only get someplace to keep our cart but a lot of good work a lot of future projects Rotary and in fact is working with Brunner Rotary and on Fleur Rotary working together to do a sailing for Crohn's disease awareness like they did with polio the eradication of polio with Rotary like to do that with Crohn's disease it's a disease nobody wants to talk about it's very personal and so there's a young sailor sailing from on Fleur to Quebec to United States stumbling to Burlington on June 16th and we will be at the community sailing center and he'll talk about his life story of living with Crohn's disease so and yes we did the 100th anniversary of Rotary I had been the art I signed up to do the archives again archives are in my my history right there's the Lumiere project with a 180 Flynn Avenue trying to get France in to recognize the Burlington Lumiere North American factory right here right here in Burlington so there's a lot of good stuff happening. Well that is you know I did have the honor of getting to attend your retirement celebration at copper and I have a couple of videos here that we're gonna play at the end of this conversation we'll append them the mayor read a proclamation making Lee's Verano day. I love my middle That's right and we have a statement from Ernie Palmerlow to you as well that we'll share. I just thanks for sharing some of this you know I feel like we've just scratched the surface of who you are Elise but I really appreciate you taking time to share your story with us. Well thank you for giving me an opportunity to reflect a little bit I'm glad you were asking all the questions because I wasn't sure what we're gonna talk about so. Yeah and you have time now to spend with your family. Yes I have I have a son and a daughter one of my sons in Colorado my daughter's here in Williston with two grandkids here and two grandkids and so definitely looking to make more time with them my husband who probably has sacrificed the most because I you know I just I now have eight hours a day that is for me I'm trying to not fill it. You were probably working more than eight hours a day. I know I know well the eight hours comes from the eight hours a day or more 60 hours a week I was putting at the police department where my work my paid job and so now I have a little bit more time to just just slow down relax a little more about how much I want to do but I'm always going to be looking to what I can do to network people connect people with projects and opportunities and that's what I love to do is to watch people evolve just because you put them in touch with each other and you know I can see oh wait if you talk to someone so that will take that will roll come back let me know how you're doing I'll give you another I love doing that I don't think I can stop. Well thanks please fair or no thank you for joining us and if you've enjoyed this conversation or you'd like to watch other programming on town meeting TV you can stay tuned to the cable channel that you're watching on or you can find us at www.cctv.org and take care. Leaders roles are here with us today. Thank you. Where as the early years of her time with the city leads lead men first in the Merlin through fire department not only herself as the person we're going to play she created the first purchase order incumbent systems she secured the first computer and she purchased the first fire EMS system. It is quite remarkable the scan of operations releases presided over. Where as leads was instrumental to the police department's consistent success and ensuring balanced budgets and conceived and guiding projects such as the vehicle replacement plan and portable radio replacement plan and put her staff on the development of policy communication infrastructure and where as these oversaw the merging of the fire department of police department business operations and organized new business systems for the fire department sorry the police department which have included building a bridge between BPD in the state of Vermont Department of Public Safety to work collaboratively with technology supporting public safety communications infrastructure and supporting public safety IT and where as these contributions to the city have extended far beyond the workplace as she has devoted her free time to advance initiatives that promote collaboration and strength in community and where as these has led the own floors to see relationship the city of Burlington promoting our city's relationship with France from her involves of friendship and respect between our cities and supporting initiatives to benefit French American communities alike for which she was awarded by the president of France through the general of France in Boston in the rake of Chevalier for years of work on various French initiatives in Vermont and internationally really quite remarkable space and whereas these is dedicated and a dedicated member of the point the Rotary Club including serving as president I see so many members thank you so sorry I cannot be there today but I wanted to put in a few words to celebrate your 50 years which means you would have had a start when you were three I believe but anyway I just wanted to celebrate with you and all the people that are there to thank you so much for all of your support you know working with a consul general in Boston and working with Alliance France's and creating the sister city connection and all the things that you do for you know the French community at the city the fire the police you've been a right hand person for me for years working from the time we did the quad centennial and my position is honorary consul of France of Vermont and then turning the keys over to you so now I'm your right hand person so anyway you've done so much for the city you've done so much for me personally for the French community for the sister city relationship and all the things that you're the detailed person I was the fun person we made a great team and we will continue to support each other so I just wanted to say congratulations a few people have that length of time and this legacy so congratulations and all my best and when I joined the fire department almost 25 years ago at least was there her office was in the back where I'm training with now and she was there for everything she was she's probably between Lisa that's the first two people that I saw walking in the door and I knew instantly I was in good hands so when I promoted to the fire chiefs position just this past March one of the first people to reach out to me was Lisa and she just wanted to make sure that I was squared away by any questions please reach out and I did and we sat down and I just always appreciated Lisa for her knowledge and for her history of the city we had a bagel for coffee recently and she she entrusted me with some very important part of our artifacts full city reports rules and rights manuals handwritten by past fire chiefs like really cool stuff that she entrusted me with that magnitude of that is not awesome so from everybody in the fire department I want to thank you for your leadership over the years and I'd like to present you with a actually what could get me black so thank you for the great honor and recognition and dedication dedicated service in the fire department


Most currencies were started just because people trusted them. It was like the promise of gold or started out being shells, and you know, then it was gold, and then it was the promise of gold. And then it was a promise that the government would back you up, which is a little less of a promise. Well, and that was a given government, and that government was tied to a geographic territory. All of a sudden we have a currency that is not tied to a government and not tied to a geographic territory. Well, that frees us, because governments have always used that currency to control us in some ways, keep controls over that currency. Well, this frees us. We can operate across border much easily. We can move money across border much easily, much more easily, and we reduce the friction significantly. You know, you wonder why are those banks so big and those bankers all so rich? Why are they all dressed so well? Well, it's because two and a half to four percent of every transaction you ever do is picked up by the credit card company, and the bank gets the bulk of that. That would go away. And so you do see the banks feeling threatened here, and for good reason, because if you use Bitcoin instead of dollars, the banker doesn't control your Bitcoin. He controls your dollars. So I think you have this new opportunity for a currency that is frictionless, not no two and a half to four percent, transparent. Everybody can see exactly where it goes, so you keep perfect records. It is open. It's cross-border, so you can use it anywhere. You can go from one country to another, pull down your Bitcoin, and everything's fine. And it's a great store of value, but it's also going to be faster than the Visa network. So this is going to be one of those things where it's like it's a sea change. There is new technology, and it is better, faster, cheaper than anything else out there. We're going to move that way, and governments have to figure out how they're going to adapt to not controlling everybody through the currency.


Yn ymddych chi'n gwybod, mae'n gofyn, yn cael ei gweithio. Mae'r ffordd yma, mae'n gweithio ar y slot yn ddod ar y ddod, ac mae'n ddod yn bwysigol, ac mae'n wneud i'r ffordd ar y ddod yn gweithio, ac mae'r ddod yn gweithio'r ddod yn ddod, ac mae'n gweithio'r ddod yn ddod. Yn ymddych chi'n gweithio ar y ddod, mae'n gweithio ar y ddod, mae'n gweithio ar y ddod yn 2016, rwy'n gofyn i'n argyflwydu sgwr, ysgol Ffederal Rhigor.  Byddwch chi wedi fylech y troac oherwydd yddych chi'n gweithio, ac whatever is it, it's about making releases boring so that you can do them at any time during normal business hours in a... just at the push of a button. So we can get all kinds of changes into the hands of users safely, quickly, sustainably. Why do we care about doing such a thing? Well the main reason is we want releases to be painless boring events we can do at any time. You want to make it quicker to get functionality to users. We also want to improve quality and stability. Continuous delivery also, it turns out, reduces the ongoing cost of software development. So there's investment to do things like test automation and continuous integration and all these kinds of things. But that cost is amortised over the back end as your product evolves. And then finally, if you're doing it right, continuous delivery will make your customers happy because they're getting the things they want faster. And it will make your employees happier because they're getting to engage with their users and build stuff and get it out more quickly. So who here works in a regulated environment? Okay, lots of you. So you probably had the same experience that I have where you go into a regulated environment and you're like, well, let's do continuous delivery and people are basically like, ha ha ha, that's hilarious. You can't do that here. And so basically, most of my professional life since 2010 has been saying, let's try this and people are going ha ha ha, that wouldn't work here. So I thought, where's the place where I can go, where if we do that, it'll stop people saying that. And it turns out a really good answer to that question is the US federal government. Because it turns out it's extremely hard to get anything done in the US federal government. You know, shipping software is something that we all have to do at some point. I mean, you can only code for so long until you eventually have to release it. US federal government is one of these places where it's just incredibly difficult to do that. Shipping software should not be rocket science. But we can certainly learn lessons from rocket science. Any time you're going to launch something, you need a checklist, right? So before we release, we're going to make sure that a whole bunch of things are in place and working properly before we can launch. So if you go and actually do some research, which is what my boss did, my boss, when I was working in the government, had a spreadsheet where he listed all the different regulations you had to care about if you were going to launch something and how many pages they were. And so it turns out there's a lot of things. There's a bunch of laws and other documents that you have to follow, such as records management and associated bits and pieces. Privacy acts are very important. We want to keep our citizens' data safe. There's the very ironically named paperwork reduction act that we have in the USA.  A huge document called the Federal Acquisition Regulation, which governs how the government is allowed to procurement. There's something called the Anti-Deficiency Act, which means they are not allowed to spend money that hasn't been appropriated by Congress, because back in the day, 100-something years ago, what agencies used to do is spend all their money on things and then say, oh, we haven't got any money left. And then Congress would basically appropriate more money because they had to do something for the next six months of the year, so that's not allowed. Can't do that anymore. There's something called the Economy Act. Can't remember what that is. Have an e-government act to make it possible to e-govern. A whole bunch of other things, various provenances.  And then we have to follow rules that the White House sets out. The kind of thing that the White House deems that agencies have to do is it's created by the Office of Management and Budget. This is a whole bunch of circulars that they produce. Something very important in the US government is the Federal Information Security and Management Act, which determines the risk of the services that you produce and what the appropriate, and directs the National Institute of Standards and Technology to produce a set of policies that we have to follow, a couple of which are here, the Information Processing Standards, which determine what the risk is of different government information systems and what the various controls that you have to put in place when you launch those are. 140-2, which governs cryptographic modules in government services and hilariously was actually referred to in an episode of Silicon Valley, I nearly fell off my chair when I saw that. I was not expecting that at all. A bunch of special publications that FIPS produces, which list all the various parts of the risk management process and the controls you have to implement. 853-4 is this enormous document which lists all the controls that you have to implement in government information systems. And there's 800-53A, which lists how you test those controls and document the testing of those controls, and so forth. Lots of special publications. What else? I'm trying to move forward from some of these. The hilariously named Einstein system, which is about packet detection and making sure that bad things aren't going through packets, basically preventing attacks by using packet inspection. FedRAM, which allows us to reuse approvals for information systems between agencies and then a bunch more OMB memos that we have to care about that come out of the White House. How many pages roughly do you think we're talking about here? Any guesses? Between 2,000 and 10,000. It's less than 10,000. Are we pleased to hear? 8,000. It's about half that. It's 4,006 pages. This is the complete set of things that you have to care about when you launch a government information system. And not all of it is necessarily very clearly written or unambiguous. So actually working out how to interpret those regulations is also somewhat problematic. I wasn't quite sure how a Jewish reference was going to go down here. Apparently it's okay. 800-53, this is the one I was talking about which lists all the different controls. So these are all the controls that you have to care about implementing everything from, and you can't really read it, but basically everything from making sure you've got fire extinguishers in your data centres and making sure that everything has timestamps to making sure that your telecommunications services are set up properly. And it also lists, based on whether your system is low, medium or high impact, which controls you have to care about. And for each of those controls, there's a sub-control. So AC2 account management, there's things like, do we remove temporary accounts in a particular time? Do we disable inactive accounts? So basically, before you can even think about launching a government service, an information system in the federal government, you have to know which controls you're going to implement, and then you have to implement them, and then you have to test your implementation, and then you have to document the testing of the implementation, and then you create this enormous packet that gets signed off by someone called an authorising official, which is someone in an agency who's authorised to launch it. And the problem is that takes a really long time. We worked out it takes between six to 14 months to go from dev complete to actually being in a position to launch something during which time you're going through this process. So that's very troubling in terms of your ability to implement continuous delivery. You want to implement continuous delivery, every significant change you make is going to take six to 14 months. That's a bit of a problem, particularly because actually what we're finding now is that pretty much any significant system is the target of advanced persistent threats.  So the question is how quickly can we detect and remediate problems? Prevention isn't going to stop attacks. You've got to be able to remediate really quickly. The first question when the vulnerability is discovered in a library is which of my production systems has its impact and how can I remediate those production systems but the new version of the library without the floor and launch as soon as possible? So we wanted to address this problem. One of the ways that we wanted to address it was by building a platform. It turns out that most of these controls are actually implemented at the ops level rather than the dev level. There's a lot of those controls that are about how you run your data centre and those are actually things you can build into cloud platforms. In fact, this thing called FedRAMP that I mentioned earlier, what that allows you to do, according to the way FISMA is written, every agency that wants to use, for example Gmail, has to independently test and approve Gmail. There's a lot of agencies in the US federal government, like a lot. If the Justice Ministry wants to use Gmail, they have to go through this whole six to 14 month process and then say people at GSA where I worked want to use Gmail, they have to do it all again. Now that's clearly absurd. What was invented was this thing called FedRAMP which allows you to basically reuse other people's authorisations. Or in fact, FedRAMP will do what's called a pre-approval. They'll go through the whole process for you and have it signed off by the CIOs of the Department of Defence, Department of Homeland Security and GSA, and then other agencies are like, well that seems reasonable, we'll just say, well they've already done it, we're just going to approve it. That's really good. It allows you to only have to approve a particular cloud-based system once. And you can do this for infrastructure providers as well. So there are FedRAMP approvals for AWS, for Azure, for Google Clouds, Salesforce and so on. And what they do is they say, well we've shown that this set of controls are implemented in a way that's satisfactory. And so if you're building on top of that, you only have to worry about the residual controls, the ones that we haven't already shown that this service implements. And that makes things a lot easier. So if you're building on Amazon or any one of these or Google Cloud or any of these platforms, you only have to take care of the residual controls. We worked out that actually you could implement a lot of these controls also at the platform let. So by building a platform that took care of a whole bunch of controls, what that meant is if you launched a new application on the platform, you only have to take care of those controls that aren't implemented by the platform and the infrastructure. So FedRAMP website, we built this thing called Cloud.gov, which took about a year to build and then about another year to go through the process to get the provisional approval. And it's actually in use by a whole bunch of different agencies right now. So it's built on AWS, that takes care of a bunch of controls, and then Cloud.gov takes care of another bunch of controls for you. And the coolest thing about Cloud.gov is the fact that the domain Cloud.gov was available. We were extremely excited when we actually saw that Cloud.gov was available and we bought it straight away. And it takes care of the 325 security controls that you have to implement for a moderate impact information system, 269 are handled by Cloud.gov. And apps that you deploy on top of Cloud.gov, we only have to worry about between 50 and 56 of the residual controls depending on what exactly it is that you're building. So that's huge. Now, instead of having to document and test and document the testing of 325 security controls, you only have to care about between 50 and 56. That's a massive accelerator and your ability to take stuff and put it like. So when people talk about platform as a service, often they talk about it as a way to deliver applications faster, but for us it was actually about risk management and about building secure, robust systems and about our ability to meet our compliance concerns. And that was actually the primary driver. And that was really interesting for me because I never thought of a platform as a service as a way of actually meeting compliance and risk management concerns. So that was really great. The whole inspiration behind Cloud.gov really was Heroku. And my first experience with this kind of technology was Cloud Foundry. So Cloud.gov is Cloud Foundry running on Amazon Web Services. Cloud Foundry is designed to be Heroku that you can run in your own infrastructure basically. And my first experience running that was taking a little app that I'd written and deploying it by typing CF deploy and it just running in production. And I'm like, that's amazing. Just being able to take code on your laptop and type CF deploy and then have it run as a one liner. Just completely blew my mind. But now there's a whole generation of people who are growing up who have only experienced that way of deploying things. I once was trying to, someone who was new, and I just got a role as a DevOps person. And I said, what does DevOps mean to you? And she said, it's all the things I never had to worry about when I was using Heroku, which I thought was a great definition of DevOps. But the great thing about a platform as a service is you can just deploy into a production-like environment from day one. So if you saw Dave Farley's talk earlier, he was talking a lot about production-like environments. Well, if you've got a platform as a service, you've got a production-like environment that you can just deploy to and develop on right from the beginning. It's amazing. The reason that a lot of people don't like platforms as a service is that they constrain what you can do. There are certain things that platforms as a service make it hard for you to do. It turns out that many of those limitations are actually good limitations when you're building distributed systems. So, for example, in a platform as a service you can't actually write data to the file system. That's not something that you're normally allowed to do. That's because it's a terrible idea and you shouldn't do it when you're building distributed systems. So people complain about the limitations of them. I think in many cases those limitations are actually good things and they'll stop you from shooting yourself in the foot and making poor decisions that actually won't be very good things to do when you're building distributed systems. It means that you can do push-button deployments. Enterprises who are adopting continuous delivery often ask, should we have a centralized toolchain or should we let teams use whatever toolchain they want? When you have a platform as a service there's a really nice boundary which is CF deploy or whatever command you use to deploy your software. So what we did in the GSA General Services Administration which is where I was working was we let teams use whatever CI technology they wanted. They could use CircleCI or Travis or whatever, but there was this really nice boundary which was that at some point in your deployment pipeline you'd press a button and it would run CF deploy with the credentials that were required to deploy and off it would go into production. So that nice boundary is a really nice way to think of what's the responsibility of a central team that's managing the platform versus what are we going to let individual teams do and what flexibility and autonomy we're going to give them in terms of their ability to build and deploy stuff. The most important thing obviously is that most of the controls are taken care of at the platform level. And then finally, what we were able to do is create templates for all the compliance documentation that you had to have in order to put a government information system live.  And as a result of this we could get systems from DevComplete to live in a matter of weeks, which was a huge improvement over the many months that it took to take information systems live if you're not deploying on a platform as a service. So platform as a service is a very powerful way of accelerating your ability to meet your compliance goals. So what are the principles for building such a thing? Number one, you want everything to be self-service. I talked about this this morning briefly but I just do want to reiterate this because this is one of the things that I so commonly see people getting wrong when they're using or when they're deploying an enterprise cloud. So quick show of hands. Who here is working at an organisation where you have a cloud that you deploy to?  So if you have to raise a ticket or send an email in order to get the resources you need if you can't just self-service them through an API put your hands down, who's still got their hands up? Anyone? Like maybe four of you. So NIST, the National Institute of Standards and Technology in their definition of cloud computing which is NIST special publication 800-145 which is I think NIST's shortest publication. It's like five pages which is just amazing. They list these five characteristics of a cloud. Number one is on-demand self-service. A consumer can unilaterally provision computing capabilities such as server time and network storage as needed automatically without requiring human interaction with each service provider. And right there, most enterprise clouds implementations I've seen like don't meet that. So you haven't got a cloud. What you've done is you've replaced your data centre with something else and not changed any of your processes and thus the outcome in terms of your development process have not changed at all. If I'm a developer I still have to raise a ticket and wait for someone in order to get the resources I need. That's indistinguishable from having a data centre. So what have we actually done to improve our ability to deliver software? Practically nothing. So there may be other benefits, but time to market is not one of them. That's usually problematic because the whole point of a cloud is to enable things like faster development. What we found when we surveyed people last year in the state of DevOps report is that only 22% of teams who thought they were doing cloud actually met the five criteria set out by NIST. So this is hugely problematic. One of the things that a well-designed platform as a service does is it has a nice simple ACL model that enables you to deploy stuff to the paths without interfering with other people's stuff. This is a huge problem if you've deployed to infrastructure as a service. How do you manage multi-tenancy? How do you manage a situation where there's multiple services or teams deploying to your infrastructure? So this is something that we face a lot. Actually when I joined ATNF, which is the team I was working on in the GSA, we basically had a single Amazon account and we just gave a whole bunch of people administrative access to the Amazon account and let them go nuts, which is what developers want. Developers basically want to have root access to their infrastructure account and to go mad. So we let them do that. We're like, okay, let's try that out.  And I had no idea what I could safely delete. There's just huge amounts of boxes and databases and load balancers and security groups and very few people had bothered to label any of that stuff. So it's like, well, can I delete this load balancers? Will that do nothing or will it bring downvote.gov? That's the kind of question that I don't want to have to answer for every single configuration in my infrastructure account. That's terrifying. So that's a huge problem. How do we deal with multi-tenancy? What you need to be able to do basically is garbage collect.  Actually, in the government, we're not allowed to pay for things that haven't been funded with appropriated funds. You're potentially breaking the law even. So, you know, if you have this kind of one infrastructure account that you put everything in all these different services, what you're going to find is there's going to be very large maintenance costs to maintaining that.  Then the moment you put a barrier in front of it, you don't have a cloud anymore because you're asking people to send emails or raise tickets to create resources and then we don't meet the definition of a cloud. So, you end up with all this sprawl. That's really problematic. The other thing you can do is create multiple accounts. So, multiple infrastructure as a service accounts, one for every service, and then you can give a team their own account and give them complete control over it, but then what do we do about shared services? You don't want to have to access 20 different logging services to work out what's happening across your whole enterprise service portfolio.  You don't want to have to create and configure those independently for every single account. So, that's a problem. You also don't want different teams doing things in different ways. It becomes very hard to... As we do in the government all the time, you have a vendor build something and hand it over to you and then another vendor builds something and hands it over to you and they're built in two completely different ways. That, again, is a huge ongoing maintenance cost. So, that's problematic. So, this is where a platform as a service can really help you. You also would need to ACO or you would have to go through that whole risk management process for every single service if you deploy to infrastructure as a service, whether that's for one account for everything or one account per service. So, platform as a service, you only need to get that authority to operate, go through that risk management process once for the platform. It also deals with role-based access control really, really well. So, this is the thing that I really love about Cloud Foundry. It has this amazing role-based access control model where you create an organisation and then I can give the keys to that organisation to a team building a service and then they can create spaces and apps within that organisation and deploy stuff to those services and apps and that doesn't interfere with anyone else's stuff. But then, if an app they're building, they want to end of life it, they can just destroy the app and it garbage collects all the associated services, like the database or any authorisation stuff they've built or the TLS endpoints or whatever, it'll garbage collect everything. So, what that means is A, the different tenants can't interfere with each other's stuff, but also we have a great solution for clearing things up and making sure that people aren't getting bills for things that they don't need anymore or that we have those things that we don't need anymore still lying around in our account. So, the role-based access control is fabulous. I can't overemphasise the benefits of that. Again, platform as a service imposes a lot of limitations. In many cases, those are good limitations that you actually want to have in place for distributed systems. Significantly reduces the maintenance and operational costs. I spent much less time worrying about how to maintain applications over time with a platform as a service. It was great. The only thing I cared about was where did this code to run that was used to build this service come from? So, where in GitHub does this source code come from? Once I had that, I could, if I needed to patch something, I could just patch it in version control and then press a button to deploy the new version. The maintenance was super easy for me. It was really great. The third principle for building a platform as a service that I think is really important is to use native cloud primitives. What I mean by this is a lot of people move to the clouds and then they start buying commercial firewalls and deploying them to the cloud because we've been using Cisco in our data centres, so we're going to use Cisco in the cloud. Don't do that. Use security groups or whatever the equivalent is in the cloud provider you're using. It's much cheaper and there's a much lower maintenance cost over time. People roll their own databases instead of using the database that the cloud provider provides. That's a terrible idea as well. Don't install MySQL to your infrastructure account. Just use whatever native databases the cloud provider provides because it will substantially reduce your ongoing maintenance cost. People worry a lot about vendor locking with clouds and having multi-cloud provider solutions. I actually think in most cases that's just not a real worry. All the cloud providers... No cloud provider I know has ever increased costs. They all drive down costs all the time. The cost of actually doing multi-cloud is extremely high and it incurs a substantially higher ongoing maintenance cost. Just use whatever primitives the cloud provider provides to maintain those over time and patch them and do all those things that you care about. Sorry about that. The next thing is everything must be reproducible from version control. What that means is not just the apps that you build but also your platform as a service. The code for that must be reproducible from version control as well. Obviously you're keeping all your application code in version control so you can redeploy your apps, but we should be able to redeploy our platform as a service from version control as well. All the codes for cloud.gov is in version control. It's in GitHub. You can go to github.com. You can run your own cloud.gov. You can actually just go and install your own cloud.gov. Finally, and for us the really big thing was making sure you can take care of compliance at the platform layer. This for me, for a really long time, I was a grumpy old man about containers and I thought it was massively over-hyped. Then what I realised is in cloud.gov you can run virus scanners and intrusion detection software on your hosts and then deploy your apps on top of that in containers and then app developers don't have to worry about installing Nagios and intrusion detection and virus scanning and all that stuff. That completely changed the game for me. I'm like, yes, containers are amazing. I love them. That's fabulous because you can put all that stuff in at the platform layer and just deploy your apps on top of it. It takes care of so much stuff. The only other thing I want to talk about is the importance of managed services. When you're deploying to a cloud, you have to have things provided for you like databases, for example. Cloud Foundry and other platforms as a service make this super easy. What you can do with Cloud Foundry in particular is it provides extension points which allow you to just self-service a database instance or some other external service for your app with a one-liner. We actually built a plug-in so that you could do TLS termination. What it would do is you would self-service TLS termination of your app and it would spin up an instance of Cloud Front to do CDN and it would self-service a SSL certificate using Let's Encrypt and deploy it and it would rotate that certificate every three months so you never had to care about your SSL certificates again. Given that one of my biggest jobs or, I guess, most failure-prone jobs was making sure that everything had valid SSL certificates, you do not want to go to your federal government service and find that the SSL certificate isn't valid anymore. It's a really bad luck if you're a government for your SSL, for your services to have expired SSL certificates.  Having a service which would just automatically rotate those SSL certificates every three months, that was amazing. It was really, really huge.  I think the important thing also to point out here is the amount of stuff you have to build that's not just containers. A lot of people think that building a platform as a service is just Kubernetes. That's not the case. There's a huge amount of other stuff that you have to build alongside that. The container scheduler is just one piece. Having log aggregation, making those logs searchable in a multi-tenant way, having alerting, having managed services, routing, all these kinds of things. There's a whole bunch of other stuff that you have to worry about in addition to your container scheduler. So don't think you can just install Kubernetes and have a platform as a service. You have to care about all this other stuff as well. If you want to know more about what we did, we wrote up a white paper. You can go to devop-research.com and there's a white paper on what we did and the principles that I talked about today and a lot more length. Hopefully, if you're building cloud infrastructure in a highly-regulated environment, that will be useful to you because it's got a lot of the lessons that we learned doing that in the federal government. Next time you meet someone and they're like, oh, that sounds great, but it won't work here. Well, we can do it in the US federal government. We can do it anywhere. That's my main lesson. If you haven't already, please take the State of DevOps survey this year. That's open for the next month or so. It takes about 25 minutes. Really appreciate your time. It helps us learn what works and what doesn't work and how to get better as an industry. So please do that and get all your friends to do it if you possibly can. We have a bunch of time for questions. One thing I wanted to understand was what challenges did you face from federal government or a pushback given that it's a complete mindset shift, right? Losing control, everything to cloud now. So what challenges or pushbacks did the team face while trying to implement this? There's a huge amount of fear, uncertainty and doubt when moving to the clouds. There's obvious things like the best practices are very different. The way you need to work is different. The processes change. There's just a lot of... You've just got to learn a whole bunch of new stuff when you're deploying to a cloud infrastructure. Fundamentally, a cloud infrastructure, the biggest paradigm shift is this idea of disposable infrastructure and disposable resources. The idea that rather than having servers that sit around for a really long time and have really high uptime when we care about uptime, you don't care about that at all in the cloud. You should be able to just kill something and have it instantly replaced in a way that's completely invisible to users. So that's just one example of a paradigm shift that goes all the way from how app developers think about stuff and the idea of disposability of resources and being able to autoscale and being able to... One of the things that's really cool about it is if we found a library with a vulnerability, and this actually happens pretty soon after we had Cloud.gov working, it was really simple to patch it. If it was on one of the stacks that was used, you could just push out a new version of the stack with a one-liner with a fixed library and it was fixed straight away. That really helped people understand the benefit that came along with that. So people think disposable resources, that's a complete paradigm shift when we're like, okay, but we can roll out a new version of a vulnerable library so the entire application, our entire set of services in less than 24 hours from when the new version is available, people are like, oh, that's really great, and it was. That's like a really huge benefit. The really weird one we faced was procurement. So in the federal government everything has to be procured or the easiest way to procure things is fixed cost. Because they used to buying like fighter planes and printer toner and stuff like that where you pay a certain amount and you get something in return. Now obviously, Cloud doesn't work like that. You pay for what you use and it's not just that you pay for what you use, you're also paying based on the end you use the usage of the service as well. So there's this double source of variability. Like, you know, I might build something and scale it up and scale it down and that might incur costs, but then if I get 10 times the end user usage of it, that's going to increase the cost as well. So procurement people really hated that because of the unpredictability. And again, the Anti-Deficiency Act means if you spend more than you're supposed to spend you have to write a letter to the president and my boss once had to do that because we exceeded our expected costs on the Cloud. So the procurement people were very, very nervous about that and didn't like it at all. I actually had to make this very complicated spreadsheet where we listed our predicted usage of every single Amazon service and then I did this thing where it's like well, what's the standard deviation and then adding a crazy spreadsheet and at the end of it I'm like, well, I've basically added this huge buffer for the expected costs to take care of potential variability and what that meant is we were spending much or we appropriated much more money than we could possibly have needed to take care of these extreme end cases but our assumptions were totally invalid because we used a normal distribution to predict what the usage would be and of course that's not how Cloud works. It's basically more like a power law curve which you can't model statistically very easily.  So that was really hard and I think what you've got to do in a regulated environment is have cost control so basically say well you know and again a platform as a service will let you do this very easily and say well you're only going to be able to use this many resources and if you go above that we'll just limit your ability to use further resources so you can manage the costs. So that was definitely the weirdest one but a lot of it was about education and about training and about having people incrementally move to the cloud rather than trying to move everyone all at once just to get rid of a lot of the nervousness about actually moving to this completely new paradigm. Yeah. Yeah. Thank you. Hi. Hi Jess. Thank you for wonderful session and providing cloud details about the insights on cloud deployment and delivery. My question is, as of now in our organization we are using cloud foundry along with some different half pipe and mechanisms. Would you like to give us more insight about the common platform which we can utilize for different languages like Java, .NET and the most the problem area is the SQL databases, Oracle database has to be under again a cloud and all. So would you like to specify one common platform where we can have it? Yeah. So Heroku has this concept and a build pack is basically like a stack. So you can see here this middle layer is the application stack. So we provided and basically what that is is that's like a container image which has like a whole bunch of stuff. So we had one for Java which had like some version of the JPM and some associated bits and pieces. There was one for .NET. There was one for PHP. There was one for Node. So there's a whole, I think there was like seven standards build packs that we provided. And so your first stop was to use those. And if you used one of the supported build packs again that we took care of a lot more controls for you because we configured those build packs in such a way that they met the controls. If you wanted to roll your own thing we would let you do that but then you had to take care of a whole bunch more controls because you were basically responsible for making sure that stuff was patched up to date. Whereas for the build packs that we provided, if a CVE came out we would say okay well what build packs does that impact? Okay now we'll push out a new build pack with the fixed version of that library or middleware piece and again you can redeploy all the applications there completely transparently with zero down time with the new version of the build pack which again it's just amazing, amazingly powerful facility of a platform as a service is this ability to transparently upgrade your middleware with no impact on users, it's amazing. So that's what we did for that. For databases we provided access to RDS basically, Amazon RDS via managed services so you could self service certain pre-configured RDS instances we provided I think Postgres and MySQL but RDS and the equivalent in the other cloud providers that you can get pretty much anything you want through those so that's what we used for databases was what the native platform provided with a thin wrapper so that you could access it as a managed service from your app and then it would provide the credentials to connect via environment variables to the apps. Over here. So the question is do you face data retention constraints for government services? Yes, that was one of the things that the application developers had to determine.


Hi, my name is Ana Pijuan and I'm doing the Master in Biomedical Research at the UPF. I choose the Master of Biomedical Research because I want to do a PhD. It's a master of one year of duration. It's organized in three months of lectures and six months of practices in the laboratory that you choose. Hello, my name is Kastin Kipa. I'm from Germany and I'm currently doing my PhD in Biomedicine. Before that, I studied my Master's in Biomedical Research at the UPF. I came to do my Master's here in Barcelona at the University of Pompeo-Fabra because it gives me a broad insight into this working field and I really like the courses that are offered and this international program. I'm Fred Satchabiegui and at the moment I'm working at Hathor Institute of Medicine in the Laboratory for Neurodegenerative Research. In the past, I studied the Master of Biomedical Research at the University of Pompeo-Fabra in Barcelona. The field of studying at the University of Pompeo-Fabra is the presence of good professionals, of good professors. At the PRBB we have a lot of different centres and you have experts in all different fields working very closely together. A student should come to the UPF to do the Master's because they not only teach you theoretical skills they also teach you how to do research, how to think in a scientific way and how to explain your research. I'm interested in finding biomarkers so new innovative tools that allow us to identify those individuals at risk of developing Alzheimer's in the future. I decided to do my Master's in Biomedical Research but there are other Master's in Bioinformatics, Clinical Analysis and Pharmaceutical Industry and Biotechnology. Actually, I think that this Master gets students ready to face the challenge that society will need to face in the 21st century.