So, my name is Bogdan Aleku and the topic for today would be business logic flaws in mobile operator services. For those that you don't know me, if you think about me, I work as a system administrator as day job and during my free time when I have it, I like to break a lot of mobile related stuff. I started on this path a couple of years ago with monitoring GSM networks by using net monitor tool from an old Nokia phone and then continued with voice over IP and finally got to GSM and mobile phones. If you want to keep in touch with me, you can find me on Twitter or on my website. So, the goals for today would be for you to have a really high overview regarding SIM toolkit, what it is, how can we exploit it. Then I'm going to present you a couple of business logic flaws I've identified on some carriers and I think you're going to find them really interesting. And also in the end, if there is a way to protect from this attacks that I'm going to show you. So, we're going to cover SIM toolkit, HTTP headers, data traffic, extra digit and summary at the end. So, who has heard about SIM toolkit? Okay. To keep it simple, think about it as a platform for the carriers in order that they use it in order to install applications on your SIM card. This is how SIM toolkit icon looks like on an Android device. On some other devices, you might find them like an extra menu with the carrier's name like orange waterfall and so on. And from this SIM toolkit menu, you can find things like exchange rates, the weather, how is the weather like, or calling customer support, so different activities. And if you think about it, it's a pretty good thing because you have these applications on your SIM card and no matter what phone you use and you put your SIM card in, you still have these applications so you don't need to install anything else in order to have them. Since these applications sit on your SIM card, the carrier has a way to update these applications or modify them or delete them and so on. So, for example, if the customer support number changes, the carrier will send an over-the-air update which is basically a text message to your SIM card saying that the SIM card should update the phone number for the customer support. This message is kind of special message, a common message. And in order to have this common message, they make use on the SMS of the user data header. The same user data header is used in cases like when you go over the 160 characters limit and you go concatenated messages, so you have two messages which are concatenated into one message and this makes use of the user data header. Of course, and also in cases for who remembers the old Nokia ringtones, they also used user data header. This is how the comment packet looks like for such a SIM toolkit, SMS. So, as I said, you have the user data header and then some other fields like comment packet length, command header length, security parameter indicator and so on. The most important one that I want you to keep in mind is this security parameter indicator. The number that you see below represents the number of bytes each element has. So, this all these specifications can be found on JSON specs. In order to also have this comment, you also add other two important fields, data coding scheme and protocol ID. By setting the protocol ID to 7F, it means that you do a SIM data download and data coding scheme to F6 means that this type of text message is directly addressed to your SIM card. So according to the JSON specification, what will happen when you receive such a comment message? The phone will transparently pass this SIM message, this comment message to your SIM card and will not alert you in any other way. So, basically when your carrier sends this comment message saying, okay, I want to update the number for the customer support, you will have no idea that you have just got a text message. As I told you, keep in mind security parameter indicator. So, you're sending this comment, but you need some kind of acknowledgement to know that this comment message has been received. And this is called proof of receipt, which can be set in the first two bits. If you set it for example to 01, it means that you always want to get a proof of receipt. So no matter if there was an error or there wasn't any error, you will always get a proof of receipt. And how you get it, you set it in the bit number six. And there are two ways of getting this proof of receipt back. By SMS submit, which means by a regular text message, which is sent by our SIM card, or by SMS delivery report, which is like a delivery report when you send a comment text message and you want to know if the target person has received your text message. So again, we have this structure and we need to fill in the elements. The user data header, the protocol ID, the data calling scheme, we have presented you, and then the others. And as you would imagine, in order to make this update of the customer support number, you need to have some proper security keys. But if you look at this example, you will see that Cypher ring keys that are KIC are set to zero, because I do not care about Cypher ring keys at all. Why? Because of the security parameter indicator. If we drill down to this security parameter indicator, you will see the first two bits are set to zero one, meaning that I want to get a proof of receipt, always get a proof of receipt, and I want it to get by a text message. So basically when you're, when, if I'm going to send this text comment message to you, what will happen, it will get to your phone. The phone will pass it to the SIM card. The SIM card will try to execute it. It will see that I don't have any proper security keys. But in return, it will send me back a text message without you controlling it, without you even knowing it. And in order to make sure that how the things are like, here is a screenshot of a wire shark capture. And as you see, the comment is to send short message. And it has been initiated by the card application toolkit. So it wasn't a human initiated action. So SIM card automatically replies to the sending number. There is nothing in your inbox, nothing in your inbox. Basically you will have no idea that your SIM card has just sent a text message back to me. Only if you look at the, on your below, on your detailed core records, you will see that sometimes your SIM card has just sent a text message to someone. So let's see it in action. So here I have the destination number. I have the user data header, the binary data, the fields that I filled in, the protocol ID and the data code in the scheme. And I have the target phone. On this phone, this is a prepaid phone and there is, its balance is zero. So I have no credit on it. So it will try to send a text message. But since it has no balance, I will get the text message from the carrier saying, hey, you don't have any credit, you need to refill. Okay. Now once I submit this, it says sending. And there is no way to stop this. I can push any button. The SIM card just sends, tries to send a text message. You cannot control it. And it keeps trying to send. If I hadn't looked at it, I would have no idea, I just did this. So if it's in your pocket, you will have no idea that your SIM card is trying to send a text message. And I also got some text messages from my carrier saying, you do not have enough credit for sending SMS to this number. But I didn't send any text message by myself. The SIM card tried to do so. So maybe you will think that, okay, this is maybe not something, I don't know, important. Let's say I can make your SIM card send the text message back to me. Well, maybe that's not a big deal. But let's think on some other way. So let's say, you know there are services that allows you to send a text message from any number. So you can send someone a text message coming from whatever number you want. Now, let's say you also have a premium rate number, international premium rate number and you send a comment message coming from the premium rate number to some target phone number. What will happen, the target phone number will send back a text message to the premium rate number you have. So you're paying like a couple of cents for sending a text message and in return you get 20 times more. So it's a pretty good conversion rate, right? And the target phone, as I told you, some phones don't even show that there is a text message sending in progress, even if you keep your eyes on them. So until you will get your monthly bill, you will have no idea, you have just sent text messages to premium rate numbers. Now, let's talk a little bit about HTTP headers. The easiest way you can think about them is by identifying the browser you're using. So if you're browsing from Firefox, let's say, that browser will have specific HTTP headers. If you're browsing from Safari, it will have other headers and so on. Now, with this in mind, there are some, most of the carriers have a mobile page where you can find your balance, you can change your services, you can download ringtones, videos and whatever. This page addresses usually m.carrier.com, so the carrier name. If you try to access that page from your computer, you will most probably get something like this. So they will detect that you're not connected to their network and they tell you, okay, you have to connect to our network in order for us to show you the page. But in some cases, if you pretend to be browsing from a mobile device, they will display this page. So what I did was to use a Firefox extension called user agent switcher and I identified myself as an OKE71 phone. And once I did that, I got the display page of the mobile page of the carrier. But it was just a general page because I was not authenticated, so I could not see any balance. I could not download any ringtones. I couldn't do anything. Well, this is how the things are started to get interesting. The operators, the carriers know how to charge based also on HTTP headers. So the idea was to, well, sniff all the traffic that my phone does and see if there are any HTTP headers specifically identifying my phone number. But I failed at it because there weren't any HTTP headers. Then after some mordiging, I found a research paper by Colin Molynder called Privacy Leaks in Mobile Phone Internet Access where he noticed that when someone from a mobile device was accessing his website, that carrier was also sending the phone number. So he did a list with all the HTTP headers that the carrier was sending and published it. And the carriers are no longer sending these HTTP headers. OK, so they are not sending the headers. But what if I will inject the headers in the traffic? So I chose a couple of HTTP headers, which identified the phone number. And as their value, it is the phone number in international format, so with the country code. So now I can access that mobile page of the carrier from my computer by identifying myself as a mobile device. And I can also authenticate myself by injecting these HTTP headers. And what happens now, I can see anyone else's balance, I can change their subscription plan, I can refill any other account and stuff like this, whatever carrier allows me to do so. And some carriers are even tidying up the phone number with the bank account, so you can even see the bank details of that specific customer. But I didn't stop here. Remember when there was a time we had to call Internet with our phones? Well, I was surprised to see that there are still carriers who still have CSD. So think about it just like a dial-up connection from your phone, right? So the carrier has dial-in number, you set up a dial-up connection from your phone to that number, and you're browsing the Internet with 9.6 kilobits per second, which is around 1 kilobyte per second, pretty good speed, right? Well, but since it's just a phone call, it also has the vulnerabilities of a phone call, which are caller ID spoofing. Now, guess what was my reaction when I first set up a dial-up connection to a voice over IP provider, which was spoofing my caller ID and then forwarding the call back to the dial-in number and I was authenticated. So this is just the target phone, it's the screen of the target phone. And also I have connected a mobile phone via Bluetooth because I want to have a GDSM modem attached to my computer. So first, I'm calling myself on my own number with my own number. So this is what it means, own number. So this works. Then I'm making up the dial-up connection. As you can see, I'm using a pretty old Nokia phone. And I'm connected to the carrier's network. What is the goal of this? Is, well, if I do the caller ID spoofing, will I be authenticated like any other user and incur charges to that target account? So once I'm registering to the network, I'm going to check for my balance in order to see the initial balance and the after attack balance. So the current balance is 6.05 euros. Next, I'm going to choose something to download and I'm choosing some image. It goes pretty slow because, remember, I'm browsing with one kilobyte per second, so. And it also goes, the call goes internationally. So, okay. I'm choosing some image which costs 1.99 euros. And once I click by now, I will get a text message on the target phone. So the thing worked, apparently. And it says thank you for your purchase and so on. So now I'm going to check again for the balance. So previously I had 6.05 and this one costed 1.99. So now I should have 4.06 euros. Any data have 4.06 euros. So the attack was successful. Just by spoofing the caller ID, I was authenticated like any other customer. Let's talk a little bit about data traffic. Let's say you have a prepaid account and you have some data included in your subscription. You have no more money on your account and you have finished all your data in the subscription, what will happen? Will you still be able to have data connection? Well, you will still be able to have data connection, but the only page you will be able to browse would be the carrier's web page because maybe you want to do a refill and browse again the internet. While I had no more money in my account, then I thought, well, what would happen if I perform a DNS query? So I tried to find the IP address of google.com and I got a reply from the DNS that my carrier was using. Okay, that works, but what happens if I use open DNS servers? And I also got a reply from open DNS servers, although I could not browse any web page but the DNS replies worked. So then I thought of this, what if I set up a VPN server on my cable connection at home and make that server run on port 53 UDP, which is the DNS port, and then set up the VPN connection from my phone to my server. So think about it just like a regular VPN connection, but this VPN server is listening on port 53 UDP. And guess what happens? You have free internet. And even though I had a speed limit, now with this method, the speed limit is gone. But I didn't stop here. Since I'm living near the border at home, I thought, okay, what happens if I force my phone to connect to a network across the border and try the same? And it also works in roaming. So right now, instead of paying $12 per megabyte, I'll let you guess how much I'm paying. Next, the extra digit. I'm pretty sure you have here a flat rate plan with unlimited minutes inside your operator's network. So if you're from Verizon, you will have unlimited minutes in Verizon. But if you call to AT&T, for example, you will not have unlimited minutes. And you also have mobile number portability. So you can transfer your current number to a different operator. Well, let's think of this scenario. You have two mobile numbers, two phone numbers, into A operator.  If you're calling now from the first number to the second number, you will be charged like calling across the network from A to B. But in some cases, if you'll try the same second number, but add some extra digits at the end of it, the carrier will have no idea that the number has been transferred. So you will be built like calling inside the same A operator. And also, it also works the other way around. So if you have two different numbers into different networks, and you decide to transfer the second number to the A network, if you're going to call with extra digit, you will pay more. Because it will not know it's in the same network as yours. So this on this side, it's not so good. But if you have them on different networks, then it will be even good. So let's see how that worked. So here I have 2077 minutes inside my whole network and 58 minutes national minutes and international minutes. So what I'm going to do, I'm going to call a regular 10 digit number, which has been transferred in the same network as mine. So it's the second case scenario where I am paying more than I should. Now I'm going to check again for my balance. And now I have 2076 minutes. So one minute has gone from the national minute plan. Now I'm going to dial the same number again, but add two extra digits at the end of it. I'm going to add one five at the end. Okay. I'm going to hang up. Check again for the balance. And now I should have 2075 minutes national minutes. But the national minutes have been the same. And you see it has been deducted from the 57 minutes, even though the number is in the same network. So I wasn't deducted from these minutes, but from the minutes to other networks. And what's even funnier is that on some carrier, this P, first when I dial the number, you see it has a P at the end, which means it has been transferred. And it has been deducted my call from the 150 national minutes. The second time added two extra digits. And this one means unknown. So I have been deducted from the unknown plan, which means I will, I get to talk free for the supported number, even though I do not have unlimited calls. And if that doesn't work, try with all of the digits. One carrier was working, worked with this attack only if I had used one digit. And that digit had to be number two. I have no idea why. But if I put two, then it worked. Well, after reporting this, the carriers, most of them have fixed it. So now when I'm calling with the extra digit, I get a voice prompt back saying you have dialed the wrong number. So I cannot longer dial myself the wrong number. But how can I make the carrier dial the number instead of me? Well, it's pretty simple. Make call forwarding for all calls and to the call forwarding destination, put the wrong number. And once your call will reach to that forwarded number, your carrier will successfully dial the wrong number for you. So it will still work. As a summary, I'd like to start with some reply I got from customer support. Our technology does not allow unauthorized access. Occurrence of errors in billing regarding data traffic or voice is excluded because of their technology. Okay. Alien technology or test yourself all of this and maybe reponent your carrier. Check if your carrier allows you to disable premium rate numbers access. This way, you will at least be protected from the SimToolkit command attack. The carriers can filter all this SimToolkit messages. But until now, I haven't found any of them that will do this. Because they could say only add out SimToolkit messages that are coming from specific numbers. And the other ones just drop them. Also do not rely on the color ID. There are still a lot of services that rely on color ID. And they consider this as a good authentication. This is really not proper authentication. Do a proper authentication. And to show you an example of some really good authentication, I don't know why sound is not working. I don't know if you're going to hear it. So basically what I'm doing now, I'm calling the customer support of some carrier in U.S. And I'm using Skype because it's free to call 100 numbers. And if you're calling the customer support from a different network, it will ask you to authenticate by inputting, by entering your number. Your number, right? To all your account balance, press one. Payments, two. All right, payments. Please enter your billing account password.  It has the password I need to enter. Well, what do I have to lose? Let's enter some passwords, random passwords. Your entry does not match our record. Maybe better luck next time. Please press the corresponding keypad number. Entry does not match our record. Maybe third time. I don't know if we implemented this, but I love this guy because usually on the third failure attempt, you get kicked out. But in this case, on the third failure attempt, they let you in. How cool is that? If I knew that previously, I would have tried it on so many way systems. Really? Just enter three wrong passwords and you are in. Okay. Okay. To summarize, this is the good authentication. So thank you very much for your attention. I hope you enjoyed all the things I showed you. If you have any questions, you can follow me on Twitter, send me an email address or on my website. Thank you once again.


Hey everybody, it's Jennifer Gonzalez from Cult of Pedagogy again. We're talking again about make it stick and In this video, I'm going to review chapter three if you don't know what I'm talking about this summer We're reading make it stick Which is a book all about the science behind learning and everything I've read in it so far It really has got some good stuff about the way we do things now to help ourselves and our students learn versus how Our brains actually work. So it's got a lot of really good classroom applications. Okay And also, I'm going to be writing a review on this on July 15th So if you want to be done with a book by the time I do the review then have it done by July 15th Okay, chapter three is called mix up your learning and here's my takeaway from that The way that we practice learning right now for the most part when we're developing a new skill A lot of times what we do is we'll practice that one skill over and over and over again until we master it and Then move on to another skill and then practice that one over and over again And what the authors of this book are saying is that that is actually not the best way to learn things that it's better to Space out your practices. So do a do a little get it get a little bit good at it And then wait a while especially if you can sleep in between the practices something about sleeping really reinforces it And then do a little bit more and then space it out and then do a little bit more and that that space that little Bit of forgetting is actually better for learning Another thing they talk about is interleaving which is taking one skill practicing it a little bit then moving right to another skill And practicing that a little bit and then going back and forth instead of just mastering one skill and then stopping and moving to another one Again, this is something that can be very frustrating for learners because a lot of learners would prefer to Master something first before they move on but the science is saying it's better to feel that frustration Of going back and forth that you actually can learn things better So the way we can apply this to our classroom practice is you know If we're going to do a big review instead of doing one big review before a test Think about doing lots of mini reviews the whole week doing five minute reviews instead of one big one And teach this concept to your students also when they're studying for a test Instead of one big cramming session at the end have them think about doing five minutes a night Over time so anyway, that's chapter 3. There's definitely a lot more in it than what I just covered But this is a some big takeaways anyway So if you want to join us, I'd like to hear what you think about chapter 3 So give me some comments below and I'd like to hear what you think about it And if you'd like to join us, there's still plenty of time July 15th Come on over to called to pedagogy.com and you can find out about where to get this book. Thank you


Somebody told me that Petco Park has the best food in Major League Baseball. Let's go try it out. The Try Tip Barbecue Sandwich. 9 out of 10. Good, not great. Barbecue sauce makes it so good though. I've heard a lot about these Try Tip Nachos. Somebody actually specifically said that I need to get these. Yeah, yeah. 10 out of 10. If you come to Petco, you have to get these. So good. This is Biria. This is Chicken All-Fest store. I'm gonna do an 8. If it wasn't so hot, it probably would do better. But like, I just burnt nothing out of my tongue. It's good. It's a little weird though. That purple stuff is like hibiscus salsa. I'm gonna do an 8 out of 7.  You can't come to a baseball game without getting a hot dog. I put ketchup on mine, no mustard. I don't want to hear it.  We're changing that sandwich score to a 6.5. The bun kind of ruined it. Pretty drastic, but it's the right call.


Hey, folks, Jesse here at Mountain Vidal. Beside me today, 2019 Ram 3500 with our 6.7 liter Cummins in this package of monotone collar all the way through. We have our towing mirrors to go with it, our lane assist. Inside we have the Laramie Trim package, so our 12 inch screen power sunroof. We have air trailer brakes on this one. Lift it up, lift it down, make it easier for you. And in the back you can see the amount of room is incredible. Here we have the all weather mats as well. This Patriot Blue folks looks amazing. This color is fantastic. With this sport package we have the monotone that goes all the way through. Our chrome badging, back up camera, class 4 receiver, spray-in bed liner, LED lights, our trailer wiring's inside as well with our fifth wheel and goose neck prep package. And again, in the inside with the black color looks amazing. We have our black tubular running board to go with this. This Ram will tow your trailer anywhere and everywhere. Come on down to Mountain Vidal and get this in your stable. Come on down.


Welcome to the RF Elements Unlicensed Podcast, I'm Caleb, we've got TaSos over here, hello. And this week, we are excited to be hosting Elijah Zeta from AirBridge Broadband in Idaho, so say hi Elijah. Hello, hey. So we'll get to your story in one real quick one second, but before we do, TaSos give the good people out there their call to action. Yes, don't forget to like, listen or subscribe to our channel right here on YouTube or anywhere you download your audio podcast like Spotify, Google and the other one. All right, Elijah, so really appreciate you taking the time to talk to us today. You know, you're a busy guy and everything. So we're excited to kind of hear about, you know, what you guys are doing out there. But I guess first, you know, kind of give us some history, how you got started in the industry, how you you found yourself in this position, how you you've turned into here and just, you know, what you're doing out there. Sure. Yeah. So it started, gosh, probably about almost seven years ago. I was doing just a lot of just odd jobs here and there. We'd whack in just what handyman stuff like that. I had a little computer business on the side where I'd fixed computers, things like that. I've always enjoyed technology, computers and IT. And long story short, there was a guy named Bruce who started a he wanted better internet at his house, no matter how much he begged and paid the wisp of the day to get him better internet. They just wouldn't do it, right? And so he contacted a nephew of his who was a part owner of a wisp down in Utah, and he helped him get better internet to his house. Well, of course, his neighbors heard about it, wanted on it, their neighbors, their neighbors, their neighbors. So anyway, one day I heard about it and I called the guy and got on it. I was great, a lot better than Hughes net and all the others. And anyway, so gosh, a couple of years of using this guy's internet, I called him up one day and he was like, Hey, would you like to work for me? I never met the guy day in my life because he actually lived a few hours south and he, so he'd come up and work on it and things like that here and there. So he moved down down to near Boise. And so never met the guy day in my life. And I was like, yes. So he had heard heard about me just through some of his other customers. I had worked on their computers and things like that. So he heard my name floating around. And so I was, I was, I was super excited and worked with him for a couple of years. I did installs, technical support, helped him with infrastructure, just kind of wore all the hats. That was, he had about 150ish customers at the time. And that was called backwards wireless. And anyway, about a hundred and when you got to about 180, 190 customers, he was kind of, he kind of wanted out. And so he contacted some friends of his. So long story short, some friends of his started Airbridge broadband, bought him out and I came along for the ride. That was about six, seven years ago. And so throughout the evolution of this, I've seen it go from about 150 customers to bit over 5,000 right now and growing, growing rapidly. Um, I've done everything from installs to infrastructure, to office, network administration, currently doing network engineering. Uh, so I've kind of, I've kind of worn all the hats currently wear multiple different hats when needed. Uh, but it's, but it's been a fun ride and, and got to loot, see a lot of cool things, meet a lot of cool people and just do some, do some amazing things. Well, I mean, that's, that's a cool story. You know, it's a familiar one. So many of these whiffs over there. So started up because they're like, Hey, there's no internet or, you know, someone rolls up with the, the free internet sign on the side of the van and they're like, Hey kid, you want to come in here? So, um, but yeah, it's, it's always a really good. Well, I was going to say it is the topology around here is really difficult. We have a lot of hills and valleys.  And so there's just a lot of rolling hills, valleys, mountains and things like that. So it's a really tough area.   And they, they said we'd be doing good to get a megabit per second. And so, um, yeah. And so, uh, you know, when I, when I first started with airbridge broadband, I think, I think we immediately put it to like 50 megabits per second over the wireless. And so, um, it's, it's been a lot of, been a lot of fun. That's cool. So, um, you mainly residential or you've got business mixed in or kind of what's the spread there? So we do residential and business. We don't, we don't differentiate, differentiate between the two. Uh, so our, we have, our plans are for businesses and residential. Um, and so we do have more residential than businesses, but we do have a ton of businesses, uh, just because we are more reliable, faster, better customer service than really any of the incumbents and, uh, any, for anybody else in the area. So do you, um, do you have any like SLAs? I mean, it's the same for both. I mean, there's really no distinguishing between the two. So from our point of view, there's no distinguishing between the two. We have no SLAs. We don't have any of that. Um, we, we offer a flat fee, uh, 40, 50, 60 bucks a month, under bucks a month, whatever plan you want to go with, um, businesses, residential, get the same, get the same service, get the same quality of service, um, everything, everything's the same for us. Well, cool. How about static IPs and stuff like that? Yes, we offer public static IPs. If people want, um, we obviously nat a ton of IPv4 addresses often the majority of our customers, but if people want to a public IP, we do offer that service for an extra $10 a month takes less than five minutes to set up. So, um, we, we do offer that no, no monthly contracts. Uh, so, um, we kind of see that as we try to set ourselves apart from the, the competition, right? And so we do no monthly contracts. And we kind of, in a way, see that is helping hold ourselves accountable because we know that the customer can just call us up one day and say, Hey, I'm switching, right? And so it helps us keep ourselves accountable on the fact that we need to provide a good service to the customers knowing that they're not locked into a contract and that they can switch anytime. That was great. I mean, you know, as we all know customer service is king, especially when you're dealing with coming in user business or something like that. So, you know, when you're not the incumbent, you actually have to like compete and provide good services and stuff like that. But it's also really easy to take over market share.  So that's good coverage. Um, how much area do you cover? It's like just town cities, you know, if you were, if you were kind of going to go edge to edge on the network, you know, but roughly how far would that be? So right now it would probably take, gosh, I would say almost three hours north-south, uh, to, to go from one end to the other, uh, east-west would probably take two hours, um, ish mostly just because of the topography. So we cover in the town, um, although the biggest, the biggest town in this area currently that we coverage, um, has, I think it's 3,500 people in it or so. Uh, and so it's not a huge town, but there's a lot of other little towns here and there. And so we, we cover middle of town, outside of town, just about the whole entire area. Uh, and so that, that's about how, that's about how big we are. So you're doing mostly like, uh, mountaintops and stuff like that, or your towers on top of mountains or you down in town and maybe using the, the hills and stuff as isolation between your towers. So the way the topography is here is we actually have a few big mountains, um, on the side is of the prairie. We have a prairie here and then we have a valley down below. And so we kind of do both. We actually prefer not to put a tower up on the talls till. And, you know, we do have a couple of towers up on, up on some tall hills, um, but we mostly see those as last, last ditch efforts for, uh, customer hookups.  So, um, the, the probably 90, 95% of our towers are 40 feet or less. And, uh, we, we have 180 footer and 190 footer. Um, those are the tallest towers we have. Uh, otherwise we prefer to do a ton of smaller towers so we can get that density and we can get those short shots. So that's one thing that also sets us apart from the competition is the competition will have that really tall tower, five miles out of town, uh, that's on a tall hill and so by the time the RF gets to town, the RF will be, uh, weak and, uh, you know, a lot of noise and things like that. And so we're doing those half mile, mile, three, four, five mile shots. Um, we obviously do have those 10 mile shots out there, uh, but we try to make those more of an exceptions than, than the rule. Thanks. Interesting.  So that's those and I are both from regions that never actually see snow. So when we see people, you know, Idaho and then northern parts of the country and, you know, some of the work conditions they have to deal with, we're like, nope, not for us. It's not going to happen. So, but I imagine, you know, not, you know, having a lot of that infrastructure up on those ridges and that helps a lot too. You know, cause you're not having to spend two days to get up to a site to, to manage power and generators and all that. So very interesting. Okay. Yeah. Um, for your distribution, are you mainly five gig or are you doing some CBRS or kind of what some makes look like? So, um, pretty much all of the access points are five gigahertz. Uh, and then we, we did put up one CBRS access point. It was either late last year or early this year. Uh, so we did put up one CBRS AP. There's not that many people on it, you know, a few people. Um, but, uh, but the majority of the access points are five gigahertz and then the 90 plus percent of the back calls are licensed though. Um, so 90 percent of the back calls are going to be 11, um, gigahertz. Uh, well, I guess 24 isn't technically licensed, but it's not five gigahertz. Then you have 60 gigahertz, which is, I guess, technically unlicensed, but there's not much interference there. Um, and then we have licensed light, which is 80 gigahertz, which we have.  Um, and we do have a few five gigahertz back calls out there. I don't really like using them other than for like the outlying areas, uh, where there's not a lot of RF and it's just going kind of like that last hop to that last hour, there's only a few people coming off of it. And so it doesn't make, it's not financially sound to put, you know, $6,000 backhaul for a few people. And so in those cases, um, we were doing like PowerBeam 620s, uh, but then I got the rocket prisms, ubiquity rocket prisms, and I paired them with the RF element, uh, parabolic dishes, the ultra dish, and man, it made the world the difference between those two things. So cool. So, I mean, so that's, that's good, uh, using, you know, spectrum other than your multipoint spectrum, right? So a lot of ways, you know, we see them, they, they start with five gig on their multipoint and their point-to-point, and there's, there seems to be some transition point, right? Where you finally can afford, let's say, to go license, whatever. How did you guys start? Did you guys just start with, uh, licensed on your back calls or did you grow into that? So backwards wireless I was telling you about, um, was actually pretty much all five giggers just using PowerBeam M5 400. So, um, I go back in the M5 days. Uh, it was using pretty much five gigahertz, but as soon as Airbridge broadband came in, uh, it was pretty much all, all licensed 24 gigahertz. So one, one of the owners of Airbridge broadband, he, he's been in the business for 20 years. He's a super smart guy. Um, he's been a network engineer for, uh, multiple different wisps, and I've learned a lot from him. And so, uh, when he came in, he brought a ton of knowledge and pretty much started out with, with licensed back calls. Who were you guys using? For your license stuff? Uh, the AirFiber 11's, uh, is the biggest, is what we're using right now for the 11 gigahertz. Um, mostly ubiquity products still, um, for, even for the, the back calls and the, the point multi points, the LTU, uh, the prisms, um, for five, five gigahertz. We do have a couple other, like legal wave, six gigahertz and, uh, and things like that, but it's pretty much, uh, we have a few Mimosa B11s, but after comparing the AirFiber 11 and the B11, I prefer the AirFiber 11. I think it's a superior product, even though it only does 56 megahertz instead of 80. Um, I can take two AirFiber 11s, put a little, put them along the same path and, uh, get, I get way better, uh, service, I think, than, than putting up a, than putting up a B11. Very cool. Very cool. Um, have you guys looked at doing any fiber or, you know, is that kind of tough with your terrain and layout and things like that? It's really tough for the terrain. There's not a lot of ton of density here. Um, so there is, uh, there's a town, uh, up north that has some dark fiber that we're looking at getting, put, or put our equipment in and, you know, get on that dark fiber. Um, there is some talk about doing fiber here, not a lot. A lot of it's going to be done with the, the grant money that's going to be coming out because it's just really not feasible and viable for a small business to run fiber in the area, just because there's all only 1,500 homes here in town and the majority of homes are outside that area where you're at, you know, acres, two, three, four acres per lot, and it just becomes way too expensive to get fiber out to these homes. Yeah. I mean, and that really plays into the tool in a toolbox approach.  But I mean, realistically, every terrain is different. You know, I'm sure you're you got a lot of rocky sort of stuff I'm imagining in your ground. So to go dig it up and trench and everything's probably problematic. Your aerial stuff. I mean, I'm sure you're facing issues and stuff of that, too. So I mean, you've always got to have the density, right? So yeah, yeah, fixed wireless is definitely viable. It is. I can give you a really good example on different tools for the toolbox. So we have a bigger town, which is we're looking at you getting on dark fiber, right? And then, you know, here in town, we have wireless and possibly doing fiber. Then we service a town that's a couple hours away. And the only way to get there is over a mountain that is powered solely by solar that goes up and down during the winter, right? They have generators up there, but sometimes the generators don't work, run out of fuel, whatever it goes down. So we actually purchased a starling dish. And so in this town, two hours away, we have about five different towers and we have it all goes to to one tower. And then that one tower goes to the top of the mountain and outright. So we actually purchased a starling dish and we put it at one of the towers in this town. They have. So I configured it so that when the the the main link going over the tall mountain goes down, customer data automatically flows out the starling dish. And it was really cool. I don't know if you guys have ever heard of a tool. It's called Zero Tier. It does SD WAN solutions. It's a layer two virtual switch. It's a package you can put on micro tick routers of the new router OS seven. And so anyway, so I can put a on a router at our head end and a router down here. It's in its town called out city using zero tier. I can create a layer two virtual switch through the starling. I created an OS PF connection through that. And so then customer data flows out the starling management flows through OS PF a layer two virtual connection through OS PF. And so we can maintain management of all our devices in in Elk City, but customer data flows out the starling.  Just just get Starlink. It's going to be your best bet. And even we use Starlink on those outlying areas, just as a backup, just in case the main link goes down. So you have a lot of tools in two walks in and you can just use what works best. Yeah. Speaking of backup and stuff, I mean, what does LTE 4G 5G coverage look like in your area? So cellular is terrible in our area. You have the the one, you know, the one antenna up on the tallest hill that gets hits a lot of the area.  In fact, we promote a lot of times we promote Wi-Fi calling through like Verizon or something like that as as a viable solution to a problem for people. And so cellular LTE 4G, there really there is no 5G out here. And it's 4G and even the incumbent cellular provider is still running some some possible 3G stuff and older LTE stuff. So cellular technology in this area is quite behind the times. Yeah, sounds like it. Good for you. Right. Yeah. Yes.  You know, I like I see a lot of people fighting for, you know, going into high density areas where there's like nine other providers. It's like, why? There's so many other areas that you can choose that don't have that much competition. You know, so it's very cool, very cool. So you're on a sort of personal journey. You know, you're doing network engineering. How was that? Basically, it just all OJT, you know, just figuring out as you go.  So I've learned a ton from his name is Joe, one of the other owners of Airbridge. He's been in the business for 20 years. I've learned a ton from him. He's been a great guy to to learn from. He's got a ton of knowledge. So I've learned a lot from him. So I want to I want to definitely get a shout out to him. He's been a ton. Big help. Other than that, it's been on the job training and then as well as I've tried to further my education. There's not a as you I'm sure you guys are all the way out. There's no like WISP certification out there. However, I have done the best I could to I like I have my CompTIA network plus. I studied past for certified wireless network administrator. I've passed. I've done the ubiquity broadband wireless admin training. I've done the micro tech certified network associate routing engineer. Things like that. And so I think there's a CBRS certification. Gosh, I don't know. I think that's about it. So yeah, so I've done those those kind of things and just continue to try to educate myself. I I go over the CCNA stuff a lot. Not using Cisco specific stuff, though, it's kind of hard to learn the actual CCNA Cisco things. But even that stuff has some some great material in it. Yeah, a lot of good core information for sure. So you guys are primarily micro tape and the switching and routing son. Yeah, we're solely micro tech on the switching and routing. I'm a big fan of micro tech, as you can see. Me too. Yeah, I think they offer a lot for a little, especially the new generation of hardware that's coming out. I think that you can really do a lot with a little and it can go farther than a lot of people think, I think. I think you can do a lot more with it. So yeah, so we pretty much use we have some nittonics for the switching. We have some. Yeah, that's about it. But we've pretty much transitioned even to micro tech for the switching. The new CRS 300 series, the 328P is an awesome switch, I think, and configured correctly. I think they're awesome. We use the 1072s right now for some of our core and edges with a ton of 1036s for a ton of our towers and other 4011s for some of the smaller ones. And so we're I'm really excited for the new generation of hardware still waiting for for version 7 to become a little bit more stable and things like that. Still waiting. I'm really excited. I think the new hardware, the new switch chips are going to be awesome. Because one thing I heard is that the same switch chip that they have in like your your Marraki 2,500 $3,000 switches, they put in these new, you know, 300 switches, 2116s, things like that. So you get a really great switch chip, really good hardware. And I think I think my critique is is a great way to go. Yeah, I love all the the little things that Microtech does outside of this industry that you can do with it. I was just watching some cool videos of, you know, like GPS asset tracking and stuff like that because it can, you know, through the scripting language as and the USB interface, it can talk to a lot of other devices and, you know, relay that over an IP network and stuff like that. So it's really, really cool stuff. It is. And it's something to where you can actually still find consultants that are reasonably priced, right?  So very cool stuff. That's pretty much in general, though. I mean, that's why, again, I love this industry so much. I mean, you know, the the whips that are in here are so helpful with each other, too, right? So, I mean, it really doesn't matter what you're using somebody else is. And they're probably more than willing to help you, you know, or educate you or, you know, or try and solve that problem for you, which is really cool. Yes, definitely. I don't think I've ever seen a Verizon tech next to an AT&T van trying to help them sort out their problems. No, no. That's funny. So, you know, what do you think right now? You know, we're the industry or your business or maybe the industry as a whole is what are some of the biggest challenges you guys face on a daily basis or even big picture basis? So some of the challenges we face now is, I would say five gigahertz is becoming a little bit crowded. Thanks to our film that's helped a ton. So we're greatly anticipating the, you know, six gigahertz waiting for the gear to come out and everything to sort itself out through there. So waiting on that. Gosh, pricing on equipment. So our our our poo is a little bit lower than a lot of some of their wizards out there. And so we can find it a bit challenging to afford the higher end Toronto gear to justify that. And so so that's a bit challenging off, you know, some of the grants coming down the pike are going to be, you know, mandating 100 by 100 things like that, which is going to mandate, you know, we'll have to use the the Toronto, the canvium, things like that is as awesome as ubiquity is. And I love the ubiquity gear. It just can sometimes struggle a bit with the 100 by 100, 200 by 200 speeds, things like that. And so and as well as the grant funding coming down the pike is very skewed towards fiber. And so we're we're trying to make some connections, relationships there to show that, hey, wireless has its place. You know, satellite has its place. Wireless has its place. Fiber has its place. But, you know, some of the some of the other incumbents around here are trying to tell people that they're going to get fiber to those houses that are 10 miles up in the boonies somewhere. And it's just not going to happen. Right. And so I would say that's some of our some of our biggest challenges. And some of the biggest challenges we face. So I'm interested in your take on six gig, right? Because, I mean, it was, you know, it was all the rage and people are talking about it, not talking about it. Some people are waiting to build out, you know, for six gig, they don't want to build out any more on five gig. I mean, do you find yourself not going into a new area because you're waiting for six gig or something like that? Some new hardware to come out or, you know, do you guys, if you find an area, you just go into it with what you have. Yeah. So, yeah, we don't wait at all. I am greatly anticipating, you know, like the EP&P 4600 looks like it's going to be a great product line. We aren't waiting. We are looking to put up, you know, LTU, you know, wave, wave gear, you know, ubiquity wave, the 60 gigahertz, 60 gigahertz stuff. So no, we're not going to wait with the LTU and the RF elements and horns. We feel like we can just go straight ahead and plop forward. Yeah, for sure.  That is a small business kind of what we're mentioning about the customer's service side and reputation, you know, you get kind of dug in and as a local business, you know, they can get to know you personally and everything. And you're like, hey, we're here. So, you know, when the incumbents try to throw a lot of marketing bucks around or, you know, some of these grand people, the newbies that roll into town, you're like, look, we're here. We've been established here for a year or two, whatever the time is, you know. And of course, it's going to be, you know, competition is always a tough fight, but at the same time, like if you're not there now in the beginning of all this, then you're just going to get completely blown out of the water. So we've definitely been preaching folks, you know, don't wait for the perfect solution. Just get it done, get it done now.  Or feed them tasty brisket. They like that too. Yeah. So, yes. I mean, we feel confident in offering a hundred by twenty five off of the LTU, right? You throw up a 30 degree RFLman horn off the LTU. Even though a 20 makers wide channel, you get that 10X by 10X modulation. You can offer that hundred by 25. And we've been offering 50 by 10 off of the AC for five years, right? With the RFLman horns and even the AC gear, we've been doing that. So when, you know, when Airborne's Broadway first started, the fastest you could get was like three by one, right? For like 50 bucks a month. And you were doing good to get that. And we came in at 50 bucks a month and offered 20 by 10, 40 bucks a month gave you 40 by 10. And so we've been, we feel confident that, you know, just go where it's needed right now. It's available, right? You can do it. Last, last question I have about that is, so what is your, could we talk about the average use, right?   So I can't remember exactly, but it's about two and a half, 2.5, three megabits per second average per user, whether somebody has 150, 20 megabit per second. On average people use 2.5 megabits per second. You'll have that person that uses the full 20, uses the full 100. Sure. But, you know, it's not very much. And so, yeah, I think we push somewhere around 16-ish gigabits per second at our peak. And that's for 5,000 customers, so that's, yeah. So I'm kind of related to that too, you know, with all the different speed packages do you have, do people gravitate towards the higher speed packages or is like a middle mix? You know, what does that generally look like, some sort of bell curve or? Yeah, so it's a kind of a mix. So our area-ish here, there's not a ton of people that can really afford sometimes the higher plan. So we have a ton that are on the lower and a ton that are on the higher. So it's really a mixed of people that are on the higher and lower. It's kind of a 50-50 split. There's no, you know, it's not like we have 90% on the lower and 10% on the higher or vice versa. It's really a 50-50 split. How many people in your area are asking you when you're gonna have gig in it? Not much, not many actually. We have quite a few that want the 100 make plans and things like that, but we don't really don't get a lot of phone calls that want the like, you know, gig by gig or something like that. Yeah, I think a lot of people around here that, you know, if they can watch the Netflix, if they can, you know, play their games, they're happy and they're not really worried about the whole gig by gig. Exactly, if you have a reliable connection and they never get a hiccup, though why ask for anything more, right? Yeah, I really think a 100 meg is gonna be the sweet sort of optimal spot for a long time, right? So, I mean, most people could get by with a solid 20, no problem, right? Yeah, most, you know, I have some heavy users, but, you know, so much is going on, gotta have a gig, gotta have a gig. And I'm like, when are you really sickly gonna use all this traffic?  So, yeah, no, I think it's definitely a sweet spot. And, you know, with the current, the LCU stuff, you can do it, the AX equipment that we're gonna start seeing here pretty much in the very near term. You know, I think we're in a really good spot from a technology perspective. A lot of it is just marketing perception for sure. Yeah. All right, well, we've got a pretty good bit of information here, you know, it's always really interesting to kind of learn where people come from, how they get started, the different networks, you know, we've had some in the Wisp operators and they all run completely different networks and it's really good to get that sort of different perception or view on things.  Yeah, just a couple of quick things, couple of quick shout outs to our fellowmen. So when I first started with the backwards wireless, he was using nano stations as access points, right? And yeah, and then nano station M5s and we moved to the ubiquity rocket M5s with the ubiquity sector, so it was a good upgrade. And so the actual real first tower that we put up, it was ubiquity sectors with rocket 5ACs. Airbridge came in and put up a 90 foot tower with RF element, horns, prisms, and it was awesome. And, you know, I was doing installs back in those days and I would do an install off of the rocket at A5AC with the ubiquity sectors and I'm like, I've got perfect line of sight. I know it's pointed right at me because I'm the one that put the sector on the tower.  And so I was like, guys, we gotta swap this out for RF elements, horns and prisms. And I tell you what, we did, and this even gain isn't everything, right? The specifications you see on paper aren't everything. The ubiquity sectors technically might have more gain, but I tell you what, we swapped out that ubiquity sector for that RF elements in the prism and the signal dropped by like 10 dB, got like 10 dB better, perfect chains and everything. So RF element horns are the best. Another quick story I would say is that, you know, we put up a big tower and we put a 90 degree sector, symmetrical sector, right? Well, we quickly filled that up and we just put another 90 degree sector right on top of it. We quickly filled that up and put another and another. So at some point we have 490 degrees symmetrical horns all pointed in the same direction right on top of each other.  I mean, it was still really good, especially considering it's up on a grain style, a lot of noise and things like that. So we came in, re-engineered the site. We swapped out the 490 degrees symmetrical for four asymmetrical 20s. So we took the 30s and we swapped them on edge to do 20s. And so we have the same number of APs just, and the same number of sectors, but instead of 490s we have 420s. And I tell you what, that made the world a difference too. Yeah. And so it's definitely better to do it that way than the 490s stacked on top of each other. You have to do it at first, go for it, but I would highly encourage, you know, just do 30 degrees here, 20 degrees, whatever it's needed to try and get that density instead of stacking APs on top of each other. Learning curve, right? Yeah, learning curve. And I think I would say too, is that I think you can do a lot more with ubiquity and macro-tech than a lot of people might give the equipment credit for. I have seen, you know, KNBM, Toronto, it's all super great gear, don't get me wrong.  You're just not going to do that with ubiquity, right? But I do think that between RFM and micro-tech and ubiquity, there is, they can do a lot more I think than a lot of people can give them credit for. For sure, for sure. The rocket prism, I mean, all the ubiquity APs, those rocket prisms, some good-costing micro-tech routers, have made a lot of people a lot of money over the years. A lot of money over the years for sure. But yeah, it's like everything else, man. You just got to know what your tool is and how to swing it. So for sure, for sure. Yeah, I mean, if you need the Toronto, go for it. It's awesome gear, the hardware is great. It can, again, I mean, it can push 200, 300 megabits per second into a customer in places that, even like you're just, ubiquity just isn't going to do. And so if those are the, if that's what you're doing, that's what you need. But if what you're looking at is doing 50 megabits per second and 100 megabits per second, the RFM, micro-tech and ubiquity can do that, I think. Yeah, I mean, we still see a lot of people that are pulling both different styles, right? So yeah, high density and you need that sort of capacity or things like that. Go one way, the other areas, go where it's most cost effective, look at what your ROI is going to be and make the best decision for you, not just the near term or because it's fancy and shiny, but realistically thinking what it's going to look like two, three, five years down the road. So, yep. Well, very cool, very cool. Well, that's about everything that I've got. And I know a lot of you've got a busy day ahead of you as always, the adventures of a wisp. Always keep you on your toes, right? Yeah, wisp life, never a boring moment for sure, so. Never. I guess in closing, anyone looking to find you? You know, they got any questions or you don't want to talk about your experiences or anything like that. If you don't mind, we can throw your email address up or what's the best way for people to find you? Yeah, so the best way to find me is probably email is just alyja at airbridgebroadband.com or I'm also on LinkedIn. You can find me at alyjazata. I'm friends with Tossos and Caleb and some of the others in the wisp industry. So, just if you see me on their connections list, that's gonna be me. And that's pretty much where I'm at. I'm not too much of a social media guy. I'm not on Twitter and all that stuff. Probably best for your sanity, you say. Yeah, good for you. Good for you. Well, very cool, very cool. Tossos, people looking for us, where can they find us as always? They could find us on social media, anywhere on Facebook, Instagram and a lot of the wisp groups that are there. Of course, you could always find us at our website, RFelements.com, you could always email us, Tossos at RFelements.com, Caleb at RFelements.com and for anybody else that's out there, like alyja that might wanna be on the show, we'd love to have you on.  All right, all right, well, until next time, everybody. We'll talk to you later. Bye. See ya. Sit so long.


Welcome everyone and a particular welcome to Douglas Carswell, our speaker. I think as Douglas knows vast majority of us here would take a different view on European integration than you and certainly as a speaker myself I know that dealing with an audience who don't agree with you is always a tough thing to do or can be. It's more fun. It can be as well. So taking the time to come over and give us a view that we don't hear that often is welcome and we're looking forward to a good discussion. Just briefly on, most of you will know Douglas well, be familiar, but he was an MP for a very long time from 2005. In 2014 he moved from the Conservative Party to UKIP, resigned his seat and won the by-election. He didn't run again in 2017 since leaving politics. He co-founded a data analytics company. He's recently his latest book recently published progress versus parasites a brief history of the conflict that that shaped our world. And he's also involved in the Centre for Economic Education, a project which aims to educate, quote, educate wider public about social, the social value free market economics, individual, liberty and classic liberalism. Douglas. Great. Thank you. Thank you very much. Thank you for inviting me and thank you for all coming along to listen. I first came to Dublin to give a talk about what we now call Brexit before David Cameron had even agreed to hold a referendum. And I gave a talk a few years after that at the McGill summer school talking about why I thought that the left side could win. We hadn't yet had the referendum, but talking about why I thought the left side could win a referendum and what it might mean. On both occasions they were minority opinions amongst opinion formers, certainly minority opinions amongst those in the room. But in all the years that I've been talking about why I think Britain should leave, one thing I've learnt is that it's very human to believe whatever it is that we find most congenial. And I think there's been a lot of all too human behaviour both in London, Dublin and Brussels. People have tended to believe the things that they want to be true. This tendency to find certain things about Brexit congenial and to believe them I think is quite pronounced if I may be so bold in Dublin. I think it's also quite pronounced in Brussels, but I think also rather surprisingly it's also quite pronounced in London amongst the official administrative elite and the official administrative class there too. There's this tendency to view Brexit and to view the referendum result through what I might call the Fintanotul analysis. Now I'm sure that Fintan is a very congenial chap, I've never met him, but I'm sure he's very congenial. But some people I think tend to find his analysis of Brexit very congenial and I think actually it's a profound mistake. And I think on the basis of this flawed analysis, this comfort blanket thinking, certain key players have made some pretty catastrophic mistakes, the implications of which I think we are about to see unfold. What is the Fintanotul view? If I can characterise it, forgive me if I'm mischaracterising it, he probably puts it far more eloquently than this. But it's to basically see that the vote to leave was some sort of spasm, that the vote by a majority of people in the United Kingdom to leave was beyond mere eccentricity. It wasn't simply your neighbour being a little eccentric, it was caused by some profound psychological issue. Now I think I'm right in saying that the O'Toole analysis suggests that this is some sort of English based nationalism, a post empire English unhappy at their diminished status in the world. It's somehow a reactionary phenomenon, Euroskepsism, and that it's somehow backward looking and built on a dislike of abroad. Now this idea of Brexit as heroic failure, as sadopopulism, as self-pity, as Englishness that's lost its way, it might be very amusing. But I think it's profoundly wrong. It's not just in Ireland, I think, where this analysis has taken hold. I think in Brussels, where it's widely held that the referendum, even holding the referendum was somehow an insolent impertinence and a mistake. I remember shortly after the referendum result I went to speak in a conference in Brussels where there were all sorts of grandees and ex-eurocrats. And the level of sheer hostility, the inability of many of those in the audience to retain even an assemblance of civility, I thought was really quite informative and instructing. It's an assault on their world view. But what I think is even more surprising and genuinely surprised me is the extent to which the elite in London, the May government, the UK civil service and the broadcasters and the public intellectuals in Britain also share a variant of the O'Toole analysis. It's very widespread and it's seen, I think, negotiators on both sides of the table on Brexit and a sort of erroneous elite on both sides indulge in a group think and together they've made errors. I'm not going to sort of point my finger at any one side but I think as a consequence of this the overwhelming likelihood now is that the UK will leave the European Union at the end of October or shortly thereafter without an overarching, and I choose my words very carefully, without an overarching agreement. If the purpose of all the negotiation and all the effort and all that's been done over the past three years has been to minimise the result of the referendum. If that is your criteria of success I think you've got to wake up and recognise that in fact it's produced the precise opposite. We're heading towards not only rupture but restlessness. I will talk more about this but I think something has been stirred that may not easily be put back to sleep again. Now Mrs May I think bears a lot of responsibility for this. It's hard I think to overstate the stupidity of her administration. I don't want to personalise this but the stupidity of her administration and many of the things that they've done is difficult to exaggerate. This is purely my personal point of view but I think they were foolish to accept the sequencing. She was foolish to accept that a deal could in effect be interpreted to mean that departure had to be with Brussels permission. I think it was incredibly dumb whether you agree with leaving the European Union or disagree with it to talk tough about it but to also make it clear that you are unwilling to leave with no deal.  I also think she was mistaken for accepting or being unaware of the implications of the backstop when it was put to her. The border is a real issue and it needs solving and it needs serious people with serious solutions. It is an issue. No one wants to see a restoration of the physical border. Trust me on this I've been talking in Eurosceptic circles for many, many months, many years. I have yet to meet a single person in the United Kingdom who wants a restoration of a physical border. But I think the implication is that if we're not careful the backstop can be used as a means of tethering the UK to the customs union in perpetuity. I think the failure of the May administration is more fundamental. They didn't really see the need for change. They didn't really see the vote three years ago yesterday as a wake-up call to change. So what they carried on doing was basically the same mistake that British administrations have made for the past 40 years, which is to try to reconcile the irreconcilable. You cannot go to Brussels and acquiesce to things and then come back to the UK and talk tough in front of your voters. If you're not honest on one side or the other you end up going the way of John Major, Tony Blair or David Cameron on these issues. This failure from the May administration I think ultimately stems from a failure by the key players in the May government. And there was so low energy it's quite hard to ascertain sometimes who those key players were. The lights were on but not everyone was always at home. But I think they really understood the Vote Leave case. I can't think of a single significant Vote Leave team member who was giving the government significant advice on Brexit over the past 30 months. Successive Brexit ministers were put into the Brexit department and then undermined and undercut and quit. And if you look at the actions the May government itself, it was I would say a sort of parity of the Brexit case. They refused to be generous to EU migrants living in the UK. I mean it struck me as obvious as a co-founding member of the Vote Leave campaign that the sensible thing, the right thing to do would be to make a generous unconditional unilateral offer to EU nationals living in the UK. It would have struck me as common sense. For reasons that I think owe to the fact that the May administration believed that Leave voters tended to be xenophobic anti-immigrant nativists they refused to do that, which struck me as absurd. We ended up with I think what is close to the worst outcome. We threatened to be restrictive on immigration, to not have the freedom to do what for many people Brexit was about which is to liberalise on trade and open ourselves up to the world. And this unwillingness of her administration to push strongly for mutual standard recognition even if, and this may sound slightly counterintuitive, even if the only way you end up with mutual standard recognition is to start off by having it as unilateral mutual standard recognition. There was a sort of reluctance on the part of her officials to do this. So I think May's deal ended up with the worst possible outcome. Some people, I'm not going to say this myself, but some people have compared it to a sort of treaty that a defeated power would sign if it had been defeated in war, supplicant status, no trade deals and no trade autonomy. I'm not going to, and I think it would be impolite of me to point out errors on the other side. I'm going to just touch on them, but I think if we want to be fair-minded we've got to accept that there are also failures on the Brussels side. I think encouraged by the people who write for the FT and for the Economist, encouraged by former British prime ministers telling them to push for hard terms. The Brussels side was encouraged to be intransigent and encouraged to revel in this take it or leave it attitude.  Each one of them I think has served in effect as a party election broadcast for the Brexit party, but more of that later. Actions and words do indeed have consequences. The effect of this intransigence on the other side has, I think it stemmed from a belief that if they imposed really harsh terms they could force a fragile British body politic where there was no commanding majority in the House of Commons to rethink. That's not how it's going to pan out. That really, if that was the game plan, it's more Lord North and the 13 colonies than anything else. Let's look at what this approach has achieved. The May deal has failed, emphatically failed. It's gone through or tried to go through the House of Commons on three occasions. I can't think of a single other occasion where a government has tried to push something through like this. It has been comprehensively rejected. Now, the one concession, and the chief proponent of it has left office, or is about to. I wonder what more damage she can achieve in the next 21 days, but that's another story. The one concession that might have got her deal through the House of Commons, and I think it would have, would have been to put a time limit on the backstop. I think if that had been done, it would have been possible to persuade enough people to support it. Now, there are plenty of other things that Eurosceptics like me would find very difficult to swallow. Very hard to take. The fact that we would be bound by a common rule book. The fact that we would be bound by, in effect, rules made by people that aren't accountable to us. The fact that the European Court would continue to have jurisdiction. The fact that during the transition period, we would have no means of vetoing things we don't like. The one thing that people were not prepared to compromise on was an open-ended backstop. Why? Because people believed in insufficient numbers that it was a device to tether the United Kingdom to the customs union. And I think it's quite telling that that one concession that would have got the deal through, the other side was completely unwilling to make. Since the referendum, we've had what, in effect, I think you can characterise as a very unpleasant culture war in the UK. People who got along fine and didn't really know or care that much about Europe one way or the other have now been antagonised on both sides. Civility is a precious commodity in UK politics now. I don't regret not being in the House of Commons for a moment. But let's just look at what's happened to try to explain what's happening outside the Twitter reading classes. Three years ago, a million strong majority voted to leave the European Union. It was a clear question, clear emphatic crystal clear question. There wasn't anything in there about under what terms we should leave or whether we should stay in the customs union or whether or not there would be a withdrawal agreement. It was, do you want to leave or remain? More people voted to leave than voted for anything else in UK political history. There was a general election shortly afterwards and 80% of those returned to the House of Commons were for parties that had clear manifesto commitments to honour the referendum result. And it hasn't happened. It simply hasn't happened. Three years on, it hasn't happened. Worse has been this drip, drip, drip attack on the legitimacy of the vote and an elite that broadcasters in particular actions and words have consequences. There's been this false narrative that it's led to a surge in hate crime, which it doesn't matter how often you repeat the fact, it has not. If people think that this is going to erode the view amongst the majority of the population that Britain should leave the European Union, I think they've had the opposite effect. What's happened is it's radicalised people. I was a founding member of the Vote Leave campaign and I was perfectly willing to make concessions and I'm struck by the number of Tory MPs that I come across who wouldn't lift a finger to get us a referendum, who wouldn't lift a finger to make sure that we voted to leave, who now define their political careers in terms of their intransigence to anything. There are now a significant number of people who frankly didn't pay a great deal of attention to May's deal when she first proposed it and thought on balance it was a good thing and just get on with it, who are now adamant that they don't want there to be any deal at all. This is where we're heading. We're heading to a situation where the worst kind of Eurosceptics define what it means to be Eurosceptic. I'm not sure that this is really in anyone's interests. A party that was founded 12 weeks ago, stop and think about it, 12 weeks ago, is now leading the opinion polls in the UK. I don't just mean they won the Euro election, they won the Euro election by a landslide by the way, but if you look at Westminster voting intention and if you break Westminster voting intention down amongst key voters in key demographic seats, if you break it down by seats, these guys are heading to be the largest party at the next general election. I think in politics you need to learn to count. Don't take my word for it, look at the maths. May's unforgivable failing, as far as I'm concerned, is that she has put back in business people that I and others spent many, many hours and years in biotechians and a great deal of sweat trying to put out of business. She's put them squarely back in business. I think that there are certain Eurosceptics who are a little bit like the Quebec Party in Canada or the Scottish National Party in Scotland, where grievance becomes their main business. I was often baffled in the run-up to the Scottish referendum and I don't want to get drawn into that too much, but it strikes me as perfectly obvious that if you want most people to vote for a particular proposition, if you make your party synonymous with that proposition, you make it almost impossible for that proposition to get majority support. It's the way our democracy works. Most people will identify with a political party, but very rarely do more than 50% of people identify with a political party. Again and again and again we see the grievance-type Eurosceptics who it's almost as if non-delivery of the referendum result is in their interests, some might say. Let's take a step back. What is Euroscepticism? What should Euroscepticism be? I have spent my entire adult life pushing for the United Kingdom to leave and I've often been called a swivelide Eurosceptic and amongst a certain group of opinion-formers in the UK being Eurosceptic and being swivelide apparently synonymous. I think it's entirely legitimate and not extreme at all that a country should want to govern its own affairs. I think it's entirely legitimate that a country that governs its own affairs should find the giantism of the EU, a mid-20th century construct with an idea of a small elite deciding things from the centre incompatible with democratic self-determination. It's not extreme at all. It's a perfectly legitimate liberal, I would say, point of view. We're told that Eurosceptics are reactionary. Again, this is comfort blanket thinking. Why is it that Britain today is a more Eurosceptic country than it was in the 1980s and 1970s? If it's a reactionary phenomenon that's on the way, why is it growing? Are you going to blame this all entirely on the Murdoch press? We're told that there's something inevitable about the levers being in a minority. That's the insinuation of demographic change and the young. Very often, and I spent a great deal of my time in politics looking at numbers amongst particular demographic groups, this idea that there is an inevitable shift by the younger generation towards a less Eurosceptic Britain is a nonsense. Compare the attitudes not of people aged 20 today to those aged 40 and 60, but people aged 20 today to those aged 20, 30 years ago. I think there's clear evidence that the giantism, one-size-fits-all, top-down approach of the EU is inconsistent with the cultural values emerging through new technology that are commonplace amongst the younger generation. I think the biggest problem with the term Brexit is it encourages us to think of Euroscepticism as a British specific phenomenon. Now, I'm very flattered in a sense by this, but I don't think this is the case at all. I think it is the top-down attempts to organise a continent of 500 million people that is ultimately the central issue here. It is a disastrous way of organising the lives of tens of millions, hundreds of millions of Europeans. It stifles innovation. Since 1992, Europe has become less innovative. Its share of key indices has fallen. Since the Lisbon agenda, which we were told was going to make Europe by 2010 the most dynamic part of the global economy, Europe has quite clearly lost out to other parts of the globe. In fact, Europe is the one continent in Europe that is in a relative, if not absolute, time's decline. I think it's also pretty disastrous for democracy. We're told that Britain is supposedly undergoing a democratic crisis and it's about to all get terribly nasty, and there's some element in that, but I can't help noticing it's not quite yet where France is. It's not quite yet where some of our European neighbours are. I personally believe that the European Union is seeing much of the continent of Europe drifting away from a liberal democratic tradition to something that is decidedly more Hapsburg. It is moving towards a technocracy with a lot of innovation-sapping implications. If Brexit was an exclusively British phenomenon, how do you account for the wider discontent that motivates the electorate throughout the western and indeed non-western world? You might call it the broadband world, the world that has broadband. I think that we're seeing a profound shift in the relationship between the governed and the governing. The democratisation of opinion-forming means that we're seeing, if you like, a reformation packed within a short space of time. A priesthood of pundits is no longer able to define the parameters of political opinion. The political class is coming to realise that it's actually out of touch with a country that it believed it represented. Journalism, political journalism in particular, I think in the United Kingdom, has been found to be profoundly flawed. It's full of people who start from an assumption that we're heading towards a particular destination, and they then work backwards with a narrative to see if it facts into this. It's not only wrong-headed, it explains, I think, why political journalists in Britain have been catastrophically and serially wrong at understanding what lies ahead. My closing remarks, if I may, I think Euroskepticism is about far more than the UK. I think we're going to see a broad skepticism towards those who try to run a continent from the centre without accountability. I don't think it's a reactionary thing at all. I think what you're seeing in Brexit is a sign of struggles to come. Remote elites cannot run Europe successfully, and if they do, it will not be a happy, successful continent. I think Brexit is going to happen. It could happen in the short term. Jeremy Hunt, Boris Johnson, there's a temptation to think of Jeremy Hunt as soft on Brexit and Boris Johnson as hard on Brexit. You'll hear a lot about this from the opining classes in London. I'm not sure about that. Jeremy Hunt, since I was a teenager, I've known Boris Johnson for 20 years. Despite their own personal preferences, they both face some basic realities. Parliamentary arithmetic is the same, the unrest of the electorate is the same, and the extinction of the Tory party, if they fail to deliver on this, is the same. I think it pushes them in the same direction. If either of them gets in, they're both going to ask for pretty much the same thing, and that is for better terms. The key to better terms, the minimal is a limit on the backstop. Over to you. Today in London, a group of grown-up, level-headed, serious people are presenting a paper, the Prosperity UK group, The Alternative Arrangements. It's an attempt to ensure that no one wants a physical border. It's an attempt to try and address the question and resolve it. I think it can be done if there's goodwill there, if there's generosity on both sides. But I think unless whoever's Prime Minister can come back with a time limit on the backstop, I think the UK's departure in October, or shortly thereafter, I choose my words very carefully, is a certainty, almost certainty. Now you might think, hang on, maybe we can disrupt this whole thing, a Corbyn Government. Guys, do you really think that's going to put this to bed? Imagine the government fell, imagine Corbyn got in and there was an alliance of Corbyn and the SNP. Is this going to go away? Are 17.5 million people going to stop? There is no majority for any party in the United Kingdom Parliament in any election scenario, unless you're committed to delivering the referendum result. Look at the arithmetic in Parliament. Look at the arithmetic in an election. A second referendum people talk about. Okay, is the second referendum going to be a choice between remain or stay, in which case I think it would lack legitimacy for being rigged? Is it going to be a choice between no deal departure or remain? Well, unless the winning side gets more than 17.5 million votes, I'm not going to accept the legitimacy of that, and I don't think many people in suburban Britain are. This isn't going to go away. It needs to be resolved, and I think the fundamental thing driving it is that the European Union is not going to become a more successful structure. Every European Union elite, every group of technocrats has always promised the same thing. Always promised reform, almost always promised liberalisation. It never happens. It's a top-down, derogist system. It's not going to make Europe more competitive. It's not going to work better. It is a model that I think will decline and decay. I think ultimately the question is, do you want to have good relations with the UK when the UK leaves? I hope that the answer to that would be yes. My fear, though, is that if reasonable people don't make their voices heard, you will end up where you're in effect driven into a Euroscepticism defined by the worst kind of Eurosceptics. I feared at one time that after we had voted to leave, a wily establishment in London would be clever enough to make the concessions it needed to make to ensure there was no change. I've been genuinely surprised at the sheer stupidity of many of these people at the extent to which they've overplayed their hand. I think as a consequence of them overplaying their hand, my fear is not now that we remain in name only. It is that we end up doing things that sensible, mature liberal democracies shouldn't do. I think if there was a new Prime Minister and people were willing to hear them out, to listen to their answers and to give concessions on the backstop, I think a lot could be achieved. If that's not done, you're not going to stop Brexit. You're going to stop the sort of Brexit that I think is in everyone's interests. Thank you.