Now if you've been a casual lurker of Wall Street bets for the last few years like I have, then you know that it started off as a bunch of degenerate gamblers, then the community changed to being the saviors of the internet by investing in GameStop stock and making hedge fund managers cry.  That's it. But during that whole period there were some investments that either blew up in their face or sometimes just blew up. Bruh. Now some of these investments got more pressed than others but in today's video I'm going to be covering some of the well-known ones and also some that you might not know about. We're going to be going over the best and the worst of Wall Street bets. So sit back, relax, gently tap that like button and let's jump into it. First one on the list is going to be hate my darn job. This one was last year and he posted a loss of $45,000 with the title. Can anyone guess when I discovered options trading? Now you're probably going to notice a common theme here. Most of the people who lose a ton of money do it with options as well as using margin. Now to be fair there are ways of option trading that actually reduce your risk. It's just that none of these degenerates use those ways and basic options trading is almost like a gateway drug to much worse types of trading. Now the losses on this one aren't astronomical by any means but I decided to put it at the beginning just because of the fact that it's going to be a common theme throughout this video. So this one I'll go ahead and put it into C tier. Next one on the list is going to be the MD one or the SMD one. Now this one was all the way back in 2019. So this is an OG degenerate we're talking about here. Now this person day traded AMD stock for over a year and I couldn't get too many details but apparently they started off with about $200,000 and ended with over a million. Now that's pretty impressive over $800,000 gain there. The only thing that's not impressive about it is it wasn't like a all in at once YOLO moment kind of did it gradually over a year. So for that reason I'll go ahead and put them into B tier. Next one on the list is McDonald's is my vice. Now this is another options trading story of course it was an option story where he started off with $350,000 and he planned on buying a house with that money. He went from $350,000 all the way up to 650,000 and did he sell at that point? Did he realize how unbelievably lucky he was? Of course not. He continued to gamble I mean trade options and of course he ended up going down to 175,000. So lost almost 400,000 from the peak and overall lost about $175,000. And the best thing about it is he didn't even tell his wife about what he was doing with the money. Ouch. I guess McDonald's wasn't his only vice. Now all joking aside this one is kind of sad. This guy obviously has some kind of gambling addiction and I really hope he gets help but this one was a really up and down story so for that reason I'm going to have to give it a tier. Next one is going to be C strife 007 and he lost over $400,000 a month and it was so bad that he actually got a letter from Fidelity.  That's basically what this is. When the company that's profiting from your losses sends you a letter asking you if you're okay that's when you know you have a problem. This is when you know you need to get some investment help or really just some help in general. Alright this guy is an absolute legend though getting a letter like that from Fidelity. He handled it really well obviously. Hope he has plenty of money and he's not running out of it but yeah I'm going to put this one into S tier. Next one on the list is going to be options 13 and you can probably guess how this guy lost money. Options. Yes he lost $400,000 in a year trading options on Robin Hood. But being on Wall Street Bets is like having your own private support group or cheerleading squad and they're always going to help you see the silver lining in anything and make you feel better about being a complete degenerate. Like this comment that said it took him six months to lose that last $2,000. So this one was a pretty big loss but it did also happen over a long period of time so for that reason I'm going to put it into D tier. Next one on the list is going to be an absolute legend. This is one that probably everybody knows about and that is deep value. Now I made a whole video on the GameStop incident where this guy basically went from $45,000 to $45,000,000. This was basically a 1000x game. Now he ended up not making that much because he pulled out later on but he still made more money than he could probably ever spend and he just comes off as a pretty level-headed and likable guy in general. Hey what's up everybody? Cheers! Happy Friday. Happy holidays. I hope everyone's having a great week. Surprise! Now I made a whole video on it but basically what happened is a bunch of rich douchebag hedge fund managers for no real good reason shorted GameStop and they all basically teamed up on GameStop and shorted it even though the only reason they were having lots of problems is because of the fact that they relied on foot traffic and of course the pandemic was happening so there was no foot traffic. Now if you're like me or many other people who grew up playing video games GameStop has always been an awesome place that we go to in order to look at different video games and sometimes play the consoles so this really struck a nerve with a lot of people around the internet and one of them was deep f***ing value.  They ended up losing billions of dollars and to this day people like myself still hold GameStop stock and I sleep really well every night knowing that I'm still squeezing a little bit of extra money out of some hedge fund managers. This one clearly goes into S tier, in fact he's really just in a tier of his own. Next one on the list is going to be Rolo 1. Now when it comes to degeneracy this one is just off the charts, this one is an 11 out of 10. This guy also went in on GameStop stock, he invested $35,000 and that turned into 5 million and for some reason he decided not to sell and this begs the question is there a number that is possible that that stock could have gotten to that would have caused him to sell? Is it 10 million dollars? Is it 100 million? Is it a billion? Is it a trillion dollars? He even could have sold off 10% of what he earned and walked away with over $530,000 but no he decided to hold on and it went down to 300,000. Now again I don't know too much about the details here but from the research I did do he still walked away with 10x gains so that's not bad but he could have walked away with enough money to retire himself, his parents and send his kids and his grandkids to college easily. Okay, holdling is not always the answer, sometimes you want to take profits. So this guy is just oh he's such a degenerate I'm going to put him into F tier. Next one on the list is going to be Admiral Surround 11. Now I take it back, I said that other guy was an 11 out of 10 degenerate this is even worse. So this guy put $90,000 in out of the money call options that expired in less than two days. Now I know most of the people watching this are not going to understand what that means at all but let me just say that the level of stupidity that it takes to do something like this is almost unfathomable and all you have to really do is read the comments to see what I mean. I think some of my favorite ones are it warms my heart to see people light $90,000 on fire while I'm just trying to afford dental care. Another one of my favorite comments said the SEC will use this image to say they need to protect retail investors from themselves. So this guy lost about $60,000 pretty much instantly doing this. Now this wasn't one of the biggest losses on the list. However, it's $60,000 in about two days. You know, I'm not sure whether to give this one S tier or F tier. I mean it's just absolutely horrible. I'm going to go ahead and put it into F tier. Next one on the list is another one that everyone is probably going to recognize and that is control the narrative. So this guy figured out how to exploit a Robin Hood glitch that turned his $2,000 into $50,000 in borrowed money. And then he bet against one of the most consistently successful companies in the world, which is Apple for basically no reason and immediately lost all $50,000 and recorded it live. And his live reaction to losing all of his money created a meme that will never die. Now this guy is an absolute legend. He's a meme. So you got to put some respect on his name. I tried to look up what happened to him and apparently he basically gave up gambling. I mean trading. And he posted this as a farewell basically saying that he learned his lesson. Now that was a very expensive lesson to learn. And not only did he lose his own money, but he actually went deep into debt. This one has got to go into S tier. All right, next one is going to be Dracheme 514. Another options trading story where an 18 year old went from almost nothing to $100,000. But did they sell? Did they realize that they were incredibly lucky investing in AMC stock at just the right time? Absolutely not. A better name for him would have been Mr. What's an exit strategy because he was up big and he ended up losing all of the money and more. So pretty impressive that an 18 year old was able to do that. Hopefully he learned his lesson. I'm going to go ahead and put the kid into B tier. Now the next one is a little controversial because a lot of people think this person faked their gains and that is Wall Street bets. God. So he basically went all in on Tesla with call options that expired the next year at just the right time. Then when he saw it skyrocket, instead of pulling his money out, of course he doubled down on the call options and he ended up with a portfolio of about $4.5 million from 45,000. But did he quit here and right off end of the sun? Absolutely not. He decided to pull what he called the big short after this and later posted that after his big short he was worth over $16 million. Now the problem here is he didn't really provide any proof whatsoever that this was his money. He very easily could have just photoshopped it or went into the source code and changed the numbers around and when confronted about this, it would have been very easy for him to prove that it was real, but he ignored it and decided to not do it. So this one I'm going to have to put into C tier. Although if it was real, this would be an S tier candidate for sure. Next one on the list is going to be anal farmer two. Now anal farmer two was a 19 year old that claimed he made about $100,000 doing online business and he basically pulled the same move we talked about before where he essentially put gasoline on a pile of money and then lit it on fire. The only thing is his moonshot bet actually paid off. His Robinhood account shot up to $343,000. Now incredibly here, instead of realizing his luck and walking away with his winnings, he decided to make an equally risky play. He dropped $170,000 into spy puts that were expiring the next day and he earned $277,000 in one minute and his account went up to $646,000. That's enough money to buy a house or maybe even two outright in cash. So did he pull his money out? Absolutely not. He tried to put gasoline all over his money again and burn it and this time it actually worked. He lost almost everything and went down to about $40,000. So at the end of the day, he ended up losing $60,000. And at this point, you would think it's the end of the story. He learned his lesson. He lost a ton of his hard earned money. Nope, he decided to YOLO the last $40,000 too and then ended up losing everything. So this one is just such an amazing story. There's so many ups and downs to it. How can you not give this one S tier? Next one on the list is going to be irony man. Now, this is a man who thought he found a loophole in the Robin Hood system and he basically used box spreads. He started with an initial investment of $5,000 and he used box spreads where if it would have turned out right for him, he could have made up to $37,000. But the downside of doing this is if it didn't turn out right, he could lose up to $500,000. That's right. He could go $500,000 in debt. Now, of course it didn't work out for him, but the broker pulled the plug on everything early and he only ended up going $57,000 in debt. Now, when he presented this absolutely degenerate idea on Wall Street Bets, people were trying to convince him to not do it. And here were his famous last words before he executed it. That's not how it works. I have no money at risk. Then he proceeded to lose almost 2,000%. And did he learn his lesson? Nope, he never quits and he still trades daily. When it comes to the percentage that he ended up losing compared to what he initially invested, this one takes the cake. And for that reason, it's got to go into S tier. Check out my stockbroker tier list right here. If you want to know what I think are the best stock brokerages. And also gently tap that like button, hit the subscribe button, ring the notification bell and comment down below any thoughts, comments, criticisms, etc. that you have on the video. And I will see you next time.


Why didn't the narcissist realize what they had? The narcissist didn't realize what they had with you Because they took you for granted They believed that they could find the same or better somewhere else By taking you for granted It made them miserable and dissatisfied and they attributed that miserable That misery and dissatisfaction to you They assumed that you are making them feel that way When they just couldn't be satisfied The narcissist is like a bucket with a leak at the bottom Nothing you do will ever fill them up. They will always be wanting more They will always be looking for more and there's really nothing you can do about that Narcissists are externally focused They are always focused on everything but themselves They avoid self-reflection Which means they avoid their own healing so they look for people and things outside of themselves To act as a band-aid Something to cover their wounds Something to distract them from their pain and shame But it's only a temporary solution It's only a matter of time until they realize that it isn't working The wound is still there because they refuse to acknowledge the wound They assume that you are now the cause of it Anytime that you bring up problems or issues in the relationship Any time that you trigger them to self-reflect it rips that band-aid off and Causes them to feel the pain all over again So by the end of it They just see you as a problem Because you're constantly trying to bring truth and reality to the situation and that's just something they don't want to deal with They want to play pretend They want to live in a fantasy They are arrogant and entitled They have to see themselves as being superior to everyone around them And if you're not going to validate that illusion They're not going to value you They're not going to see you as someone who has any use or importance When a narcissist gets involved with someone all they're really looking for is someone to reflect something back to them Their delusional sense of superiority the grandiose image Everything they wish they were and if you're not going to reflect that back to them They're not going to want to be around you anymore Narcissists have an exaggerated sense of their own abilities and importance They think that they can do better without you They think that they can find better and that's why it's so easy for them to leave you That's why it's so easy for them to not realize what they had because their minds are more focused on Looking for something else Rather than appreciating what they had with you remember Narcissists are like bottomless buckets Nothing can satisfy them the more you try to make them happy The more you're just going to drain yourself Until you have nothing left to give to them and that's when they leave their victims When they've already used up everything that you had to offer So by the time they're finished with you They raise nothing left for them to appreciate Because they've used it up already and that's why it's so easy for them to move on That's why it's so easy for them to forget about you The narcissist didn't realize what they had with you because they didn't realize what they had with themselves They lack consciousness and awareness They are unaware of their own wounds And they try to use you to patch them up when the wound was exposed again They then blamed you as though you caused it They used up everything that you had to offer Until there was nothing left for them to appreciate about you And that is why they didn't realize what they had That is why it was so easy for them to move on They expected you to heal them They expected you to make them happy When that is an impossible expectation for anyone We can only heal ourselves We can only make ourselves happy But that is something the narcissist will never comprehend They will always expect other people to fix them And when those people inevitably fail They will always hold them responsible But you should not hold yourself responsible for the narcissist's stupidity One day they will realize what they had with you One day they will realize everything you did for them And how you made them feel But by that time It will be too late You will have moved on And you won't want them anymore But eventually They will wake up and realize how easy life was with you Thank you for watching I hope this video has it with you Please like, comment, share and subscribe Click the bell icon to receive notifications for my future videos Check out the new Narx Fiverr website At www.narxfiverr.co.uk Where you can read my blog posts, book coaching sessions And join our support forum If you're allowed to donate My pay-up and link is in the video description Coaching inquiries, you can email me At coaching at narxfiverr.co.uk Thank you for watching and I'll talk to you soon


So, if anybody has questions please raise your hand, I saw that 3 or 4 centers had already raised their hands earlier, but I do not know if they still have that question. So, please raise your hand online if there is a question. So, we are going to Netaji Subash in Kolkata. Yes sir, my question is that you in the last point you what you have discussed that you cannot keep the password in a script file. So, usually when we go for the student project we use the session variable and which gone through the whole sessions say when we are swapping from one value to other page, on that time you usually use the session variable. So, you told me that you just keep in the config file. So, sir is there any problems if we keep it in the session variable. Yeah, the session variable is not an issue because you cannot directly access the session variable except through the application program itself. So, there is no security vulnerability in storing it in the session variable. The session variable by the way is never passed back to the user, it is completely stored at the application server. The user's browser only sees some session identifier, but not the actual session variable. So, there is no vulnerability there. Does that answer your question? Thank you sir. Vidya Pratishtan Pune, please go ahead. Sir, my question is how even the SQL injection at the database level. You cannot actually prevent SQL injection completely at the database level, but there are certain things you can do to reduce the vulnerability at the database level. But that actually requires cooperation with the application and I am going to talk about that in the next half of the talk. So, I will answer your question in that part. What is it? Knowledge Institute, Salem, please go ahead. Hello sir, is it possible to use a key distribution center in Manit? In Manit we won't have any nodes. So, all the nodes will be at independently. So, is there any possibility to use the key distribution center in Manit? So, that is a different aspect of security. I don't want to take that up here. I also don't know much about it. You should ask Professor Bernard those questions. It is not a database security aspect. Santhakajan and Maharaj, Bulldana, please go ahead. Good morning, Dr. Sudarshan sir. I do have one question. The question is how the, what kind of mechanism is provided to the security website, particularly HTTPS? Typically when we are doing internet banking, HTTPS occurs. What kind of security mechanism the database people is provided to the security side? So, HTTPS is at the network level and I am sure it will be covered in this course. If it is not already been covered, it will be covered. So, I am not going to repeat that. That is not a database level thing. So, this session is focusing purely at the database level. So, HTTPS protects the data in transit. It also helps to identify the website. So, you know that you are talking to the authenticated website rather than talking to somebody else.  HTTPS is supposed to protect against this. There are limitations. There is not a 100 percent solution because it is based on notion of digital certificates and if somebody is able to break into the certifying authority and create fake certificates then even which HTTPS you can get fooled. So, there is no such thing as 100 percent bullet proof thing, but it is basically making the task of hacking harder. So, again that will be covered elsewhere in this course. I am not going to get into further details. I am going to. So, we are going to assume that data in transit is protected and that you are not talking to a malicious server. You are talking to the actual database and security at the database and application program layer is what we are going to focus on. Thank you sir. We will take one last question before we get back. Vaishnav Institute. What should be the security measures in neural network DBMS? The network DBMS. Neural network. Neural network. Neural network DBMS. I think I do not understand what you are talking about. Neural networks are used for many tasks classification and so on. What is the concept of security there? I do not know. I do not see the connection with database security specifically. There are other connections with privacy and data mining which we will come to later in the talk. But at this point I do not have any answer to your particular question. Sri Shankaracharya Chhattisgarh. How can we break into websites using authentication bypass? So, that is exactly the example I had with SQL injection. I will go back to that slide and then after that I am going to. So, I am going to hang up on you and go back to the slide and explain that answer and after this we will get back to it. So, let us say that for authenticating the user, the application programmer had a query like this. Select star from user where user id equal to and this is a thing in let us say the type data in Java single code plus user id which is taken from the web application plus and now a double code single code close for the user id and password equals single code then the Java string closes plus password plus and then a single code to terminate the SQL string. So, this was the query that was constructed by concatenating user id and password. So, here if the user types instead of a real user id he types you want to get in as a particular user let us say x, y, z. So, the person types x, y, z code dash dash then what happens is that this whole query which is actually executed is just select star from user where user id equal to x, y, z after that everything is commented out. So, now the password is not checked at all and this is an example of authentication bypass using SQL injection. So, it is just that particular term authentication bypass which I did not mention earlier, but this is how this is one way in which you can bypass authentication. There are probably many other ways, but this is one particular way. So, that let us get back to the slides. So, where we were talking of passwords in scripts. So, coming back to SQL injection we had things like somebody who bypassed authorization that is one kind. Another kind was people who ran a delete star from our drop table or malicious things like that which go and modify some other table. So, the problem is that the whole application is running under a common privilege and the database authorization is doing nothing to prevent SQL injection. So, there is a question about can the database do something about SQL injection. So, the answer is not directly, but if you extend the authorization mechanism in certain ways which is not currently supported unfortunately you can partially safeguard against it is not a 100 percent thing. So, the key point here is that this particular user should have only had access to their records whatever their authorized to see and not the authorization to drop a table. But the problem is that the database has no idea who the application user is. It only sees the single user the application database ID which has complete privileges. So, what you would like is an SQL feature where two things have to happen. First of all the database should be aware of who is the end user accessing this particular application on whose behalf a query is being executed. And B there should be an extended authorization mechanism that allows the database to restrict that particular application user to only certain rows of certain tables. So, if you have a grades table it has grades of all students, but you want to restrict a particular student to see only their own grades not other student's grades. So, you need an extended authorization mechanism which can restrict people to see only some rows of a grades table not other rows. This is something which SQL does not support today although there are some extensions which I will talk about which can provide this partial. And it turns out that when the SQL authorization mechanism was conceptualized long back 20, 30 years ago the web was pretty much unknown. And the typical model was employee of an organization connected to a database either directly or through reporting interface and then ran queries on the database. So, then the database knew who that employee was and authorization made sense. But now that web applications are the dominant way of accessing a database that is pretty much useless and you need something different. So, today the fine grained authorization this is called fine grained authorization where you allow people to see only certain rows, but not other that is implemented only at the application level not at the database today. And because of this if you can bypass the application authorization some way you can do anything to the database. So, the applications implement certain checks such as which users allow to access which screen and then there are parameters in there. So, for example, there is a screen which shows grades to faculty members it shows students grades to faculty members. But it may look at the department of the faculty member and only show grades belonging to CSE or only show grades of CSE students not of other students. So, these are forms of access control which cannot today be implemented in SQL, but they are typically implemented in the application layer. So, you would like all these kinds of things to be done at some level in SQL itself. So, coming to this what is there today is application only in the authorization only in the application layer. And since you are doing it in a language such as Java or PHP you get a lot of control on what goes on. So, it is easy to implement fine grained authorization to specific tuple. And the authorization can be based on business logic such as this user is allowed to create a purchase order that does not go into steps of to create a purchase order you get authorization to this table and to that table and something else all that is encapsulated you do not have to worry about it. So, that makes life easier for authorization, but the drawback is the following that authorization checks have to be done in the application code in every single application interface has to implement authorization checks. Now, if you had the complete plan for authorization checks upfront you code it and the plan never changes may be it is feasible, but in reality over time authorization policies change. And sometimes when you tighten an authorization policy you may forget to fix one of the interface which was more relaxed. And sometimes they may be forgotten authorization check which we saw earlier. So, it is hard to check for this and the amount of code written the application is enormous checking this entire bunch of code for vulnerabilities is very hard. So, the problem is this is called the surface area of this code is very large the amount of code that is there is very large. In contrast if you could somehow do this in the database then the only way to access the database is through SQL query. So, if you have authorization at this level it is easy to enforce a policy, but it is difficult to enforce complex policies. Simple policies can be reliably enforced with no way to bypass it. So, it is not vulnerable, but complex policies are harder to enforce. So, what you need is a wire media between these. In particular what you need is some form of fine grained authorization in database. And one of the early databases to provide this oracle which implemented a feature called virtual private database. So, what this does physically is the following it provides a way to specify policies which act add automatically extra authorization checks to query. So, take this particular query here the user ran select star from grades. Let us say that this user is a student. Now oracle allows you to register a function with the table grade. So, whenever a query uses the table grade the function is called and that function is going to return a string which gets appended to the query. So, now that particular function can check what is the user the current user is a student in which case we will do the following the function returns the string roll number equal to user ID. Now, the user ID is taken from the application and is provided by VPD to the database system as a function. So, when the function SQL function user ID is executed it is going to return the ID of the user on whose behalf this query is being executed. Note that this is an application user the database really has no idea about application user. The database only knows one user which is the entire application runs as one user. The application knows about application user and is it is actually passing this information to the database through this function user ID. So, now the SQL query can run this user defined function user ID and get the ID and check that roll number matches ID. So, now the student can only see their own grades all other grades are filtered out. They ran this query thinking they could see the grades of all users, but low and behold all they see are their own grades which is what they are authorized to be. So, that is the physical implementation and there are many applications for this. One of the major applications is hosted application where you have a single database which is shared amongst many organizations. Now, some of you might have heard of companies like salesforce.com and other which allow you to run an entire application on the web you just create an ID for your organization create ID's for individual users and you are off you can learn it. Now, many different organizations may be sharing a single database. What VPD goal was was to ensure that organization a cannot by mistake get access to organization V's data even if a programmer groups up in the application program. So, in VPD what you enforce is that you get the organization ID and make sure that the only the rows belonging to your organization are visible to you. So, that is the check that gets added here instead of roll number is used for ID a more common use cases organization equal to your organization ID. And that ensures a prediction of different organizations from each other on the shared database. Now, that is Oracle's VPD other databases have provided some similar support, but it is been very limited. For example, DB2 supports something called label based access control and Oracle also has something called label based access control which is not quite as powerful as VPD, but it does allow many things to be done. And so, that can end is used by many customers. So, that was authorization at a fine grain level. Now, let us get back to the next level. So, what about insider attack? So far we have been talking of outsider attack. The outsider is trying to hack into the application or into the database and how do we predict. But most database is actually a lot more vulnerable to insider. For example, at IIT Bombay, there are all a grades, salaries, so many other things are on databases. And there are many people who are access to these databases. And as a result, there are many people who could potentially go in and modify the data. So, we are trusting a lot of people to not do anything back. And in fact, you know, people have lived up to the trust. By many, I mean something like 3, 4. I am not talking of hundreds. When you have hundreds, you have no idea what is going on. When you have 3, 4, people know that if something goes wrong, it will be traced back to them. And of course, you also make sure you pick honest people and do not allow access to others. So, among the things which any application system should do is to keep this, the database password of the master database restricted to a few people and do not give it to the development team. So, there is another. So, we have many programmers. We have four or five people with the master password. We have many people who develop applications, but do not have the password to the main database. They have passwords to a test database. They can run their application on the test database, but they cannot access the actual database. And that password is stored on a configuration file on the live server, which the others do not have access to. So, that is how IIT safeguards the database password. But of course, when you have something like RTO office, which inherently has a lot of corruption, even these few trusted people can become untrusted. So, you need to do something about it, which could involve maybe keeping audit trails of what happened, who access the data and I will briefly mention this later. But some researchers have been asking, why should we do it this way? Why should we have the application connect to the database is using a password? Can the OS authenticate the application to the database? So, this is called trusted application. So, the OS looks at the code of the application and knows that this code belongs to this particular application, which is trusted. And the OS authenticates the application to the database. So, this is, I do not know if it is there in products yet, but there is a lot of research on this and it is used for certain applications. I do not know if it is currently available for databases. I do not think it is, partly because the databases today tend to be decoupled from the application. So, now, we know that insiders can access the database. Can we do something to prevent them from doing too much damage, if they can access the data? One obvious thing is to have digital signatures. So, the person sitting in the data center, who has access to the database, does not have access to your signature key. So, the person who is updating the data, maybe a registrar or a professor or whatever, is able to sign the data and then, the signed data is stored in the database. So, this is good for certain things, which are updated rarely. You can have a smart card to store the key. So, nobody else can store it except the person who physically has access to the smart card. And so, the database administrator cannot do anything to that data to some extent. They cannot put new data, fake data, but they can very much delete data. So, if you have registered your property, somebody goes in there, deletes your registration and then, somebody comes in and registers your property again, you have a problem. So, this has some benefits, but it is not a 100 percent solution. There are lower tech solutions in use today. For example, if you register property in India, pretty much anywhere, you need a photograph to be taken at the registration center, so that they know that the person who owns the property is actually selling the property. The last bullet here talks of restricting access to the database. It turns out that many places had, every RTO have a local database.  So, these days, they have moved these to a central system. So, there are hundreds of RTO offices, but only one central database with all the data. And therefore, the number of people who have insider access is limited now. Instead of a few per RTO office or registration office, you have a few across the whole state or across the nation. So, then it is a lot more secure. And then, there are many more application level predictions against insider attacks. For example, multi-person approval is standard practice in banks and accounts. One person creates it, another person approves it. If one person's user idea is compromised, you can still guard against the other person. If one person is corrupt, you can still guard against illegal states unless the second person also becomes corrupt. And then, there is an issue of who gets authorization to do what. Now, there is actually a trade off here. One way is to be very careful in restrict authorization to only a few people. But practically, what happens is people go and leave. And if one of the people with authorization is not around, then others cannot do work which is needed for the organization to function. And so, in practice, authorizations are granted fairly loosely by destroying the prediction of the database. So, these are human problems. So, now if something bad has happened, you want to find out what has happened. Now, how do you do this? And you do this typically by using Nordic trade. I do not know if this has been covered in your course. It probably will be. But let me very briefly tell you what happens in audit trail. First of all, there is an application level audit trail. The application typically logs everything that was done. So, if a particular user is doing something which looks weird, you may not detect it immediately, but you may have a separate application running in the background looking at the log records and looking for patterns of fraudulent access. Supposing, for example, you have credit card authorization on a particular credit card happening in India today at 5 a.m. of 5 p.m. And happening in Russia at 6 p.m. Now, if that was a Russian website, maybe that is okay. But if it was a Russian shop, then it is impossible for a credit card to fly from here to Russia in a few hours. So, you know it must be fraudulent. If it happened one day later, maybe it is fraudulent, maybe it is not. So, depending on the history of the user's travel or whatever, the system may either block it or allow it. So, you can use the audit trail to find patterns and alert people. And if something bad has happened, you can look at the audit trail and see who accessed this data from where and thereby try to identify the actual human behind it. Then there is a database level audit trail which is even lower than the application level. It turns out that the way application is written today with a single database user, the database audit trail is not terribly useful to know who did it. But it might be useful to know what had happened. If you find an update has happened at this time, maybe you can correlate it with who was logged in from where and then narrowed down the user who did that particular update. So, even though the database does not know who is the user, you can correlate it with other log information and track it down. I think this is a good point to take some more questions before I come back to two research level topics which will be the last two topics for this talk. So, let's take some questions. BH Ghazi College Rajkot, please go ahead. Sir, my question is any particular tool for finding SQL injection for in a particular web server which we develop for each and every list out the particular where the look polls are there? Yes, there are a lot of tools which are available on the web you can search for them. So, most of them will look for form interfaces and then type in strings like what I told you, code star star star and look for error messages of various forms to be returned. So, I don't have a specific tool to recommend, but if you search on the web you will find tools for vulnerability analysis. So, if you have built an application, I would highly recommend you run these tools. Dronacharya, Farukh Nagar, Haryana please go ahead. Sir, my question is can database encryption and database user ID and password encryptions can solve the problem of database security over to you sir? So, there are many aspects to database security. So, encryption handles certain things. So, let's say you have a house with three doors. Locking one door is required to protect that door, but it's not going to protect you from somebody coming in through other doors. So, encryption is going to protect against somebody who gets physical access to the data may be by copying the disk or something and it is not going to protect against certain other things such as somebody using SQL injection to hack into the application. So, encryption is not going to protect against that. So, it is required for many things, but it's not the end all. So, there is no one thing which will cover everything. You have to take multiple steps to protect against multiple types of attack. You have to check for and rewrite applications to remove SQL injection. You have to make sure database passwords are stored securely. You have to guard against cross site scripting attacks. I didn't talk about it because I assume it will be covered elsewhere in your course, but when you build an application, this is a very important thing. You have to protect against cross site scripting attacks by essentially what is called sanitizing of user input. If you have not already seen this, you remove certain HTML commands from user input. So, when that is displayed, the ability to run cross site script attacks is removed. Then there are also things which can be done at the browser level to protect different, for example, you have multiple tabs open in the browser. So, script running on one tab might be able to access data, access sites which are opened by a separate tab. So, there are browsers like Chrome which actually run these in separate processes and protect against some of these attacks. So, there are many different things which need to be done. Only if you do all of them, can you actually ensure security. Even if you do all of them, there may still be holes you don't know about. For example, very recently, there was a hole in the SSH algorithm which was a bug which was found, which meant that intruders could actually eavesdrop on supposedly secure communication between browsers and web servers. So, that was discovered and then the web servers has to be patched to protect against that bug. So, if a web server is not patched, for example, it still remains vulnerable to that bug and then you have a problem. So, patching these things to fix security flaws which have been discovered in fix is another important part of security. So, there are many, many aspects even to just data security. Any other questions? Thank you sir. Perumail College. What is stored procedure? What is the difference between stored procedure and other statements? And last question is, where we can use the stored procedure effectively? A stored procedure is like a function which you can record in the database and then you can call the function with certain parameters. So, those parameters have to be of type string or int or whatever it is.  So, that is similar in some sense to a prepared statement in the sense that if that string has codes in it, it is going to add backslashes and so on. So, that what goes to the database is a properly escaped string and then the database is predicted from SQL injection. So, that is basically an alternative to prepared statements, but as I told you it is not a good alternative because you have to create a procedure for every single query that you might want to do. But there are certain cases where it is useful and could be used. So, the main use for stored procedures is when you want to do certain updates within the database without doing them from JDBC. So, if you have a series of statements that have to be executed, series of database queries, instead of back and forth with the application server and the web server, it is all done inside of the database server and that can speed up performance. So, that is one use. Second use is if you have certain things which you might want to keep one copy in the database of a procedure which you might need to update and you do not want to update the application program, but you want to update the stored procedure periodically that might be another reason for using a stored procedure. So, there are multiple reasons for it and most databases today support stored procedure. Does that answer your question? Thank you sir. Then one more question as we know that lot of security tools is available for cyber security. Likewise is there any tool for database security and SQL itself can be provide securities without using Oracle or nothing, the front end itself? So, in terms of database security, there are tools which are specific to, for example, tools which will look for SQL injection by probing system, but you also have static analysis tools which can look at your code and say that this part of your code is vulnerable to SQL injection. So, there are such tools which can analyze your code and look for vulnerabilities which are specific to databases. So, that is what you would use. Now, coming back to the second part of your question, I am not sure what you meant by at the SQL level. As I told you the authorization mechanisms, if extended today what is there is not sufficient to provide any meaningful degree of protection, but there are extensions which have been proposed in research papers and some of which have been implemented by some databases like Oracle, but they are not part of the SQL standard yet, which you could use to give some extra level of protection. Thank you sir. Techno India, Bengal, please go ahead. Good afternoon sir. My question is, instead of centralized database, if we keep our data in distributed environment, that is distributed database, what is the security issues there? And if data is, we keep data, there is, we allow replication, then what are the security issues in that case? That's a good question. So, first of all, there are two types of security issues here. The first is when you have multiple systems which store the data, you obviously have to protect all the systems, but today the, by far the largest use of this kind of distributed data store, they are actually ubiquitous today. If you put data on any website, nobody uses a centralized database to store your data. Every major website today stores your data on either on file systems for certain kinds of data, distributed file system or they store it on distributed data storage system. So, for example, Google uses something called Bigtable, other application servers use things like HBase, Cassandra and a variety of other systems which store data in a distributed fashion across multiple systems. Now, many of these systems really don't have any notion of authorization mechanism beyond some very simple authorization. They have a notion of login and who can, which logins can access which tables in the store. So, the entire owners of security is purely at the application program level. So, there is no further security at the data storage engine level. Now, with replication what are the extra issues. So, again you have to obviously keep all copies secured, but there is a new aspect which has come up these days which is protection against government. So, today if you store data on Google and Google stores that data on a server in the US, Google may take a lot of steps to protect you from hackers getting in, but Google cannot do anything if the government of the US asks for the data, Google has to give that data otherwise they will go to jail as per US law. So, in spite of all the protection which you thought you were getting from Google, the US government can get your information by just telling Google to hand it over. In addition to asking Google to hand it over which of course has some overhead because they have to tell Google, Google has to check it and give it back. They also have hacked into Google systems or actually hacked into the network to spy on traffic going to Google. So, that is another kind of thing. So, if your data is stored in the US, it is very likely the US government can and will get access to data if it thinks that you are of interest to them. So, that kind of vulnerability can only be avoided if the data never goes to US. So, many companies these days are seriously looking at storing data of India in India, storing data of US users in the US. So, that if they are asked by the US government to hand over data, they can legally say that look this data is owned by a subsidiary in India and we cannot access that, you have to ask that subsidiary. Conversely, if the government of India asked data about an Indian, the Indian subsidiary is forced to hand over the data, it is available locally. It does not have to go back to the US thing to say to tell them hand over the data because they will sometimes get into trouble. The US may say you cannot hand over the data, the Indian government may say you must hand over the data and now Google is caught in the middle. In fact, there is a mess going on in Europe right now where the European Union was bringing up some law on making search engines forget about history. That law is not actually complete, but meanwhile a court ruled that users can ask Google to delete certain data, certain search information about themselves. So, now a user can tell Google this newspaper published a report which was unfavorable to be deleted, it should no longer show up in your search results. And now this is a total mess for Google because how do they know whether this user is doing it in a genuine way or in a way to hide unsavory incidents from others which really should not have been hidden. So, it is a big mess and they are trying to resolve the jurisdiction issue, but even with that there is still a mess when you have idiotic laws like this. O. P. Jindal you will get the last question on this topic before I wrap up the session. Sir, is there any option of data hiding in database management system? By hiding what do you mean? If you mean encryption, yes that is one way to hide data from physically unauthorized users. Other than that the authorization mechanisms are the key way of hiding data from users who are not authorized to see the data. So, yes that is exactly what is the role of authorization mechanism. I hope that answers your question. I think in the interest of time I will stop taking further questions and wrap up the last few slides in my talk. So, now let us come back to a couple of research topics. I have finished with detecting security. So, the last few slides are on security in outsourced cloud databases and privacy. So, today a lot of organizations are looking at outsourcing their database. What do you mean by that? Setting up an ERP system, setting up storage systems, backing up the data and buying equipment to ensure high availability and so on is very expensive. An organization the size of IIT which has maybe 2000 plus employees itself finds that dedicating 40, 50 employees to this area becomes very expensive and smaller organizations really cannot do this. So, they would like to have somebody provide the entire application and the database and everything is out there in the cloud. So, that is called outsourced application. Now, there are certain people who are fine with completely outsourced application, but there are others who say that look maybe I will outsource my database itself, but my application program will run locally and I will have control on it. And the goal here is that you can encrypt the data stored externally and decrypt it within the organization. So, there has been a bunch of research on this model which says that look supposing I encrypt the data in the database, the database does not have the encryption key, the application has it. Can the application fetch from the database just the records of a particular employee ID 1, 2, 3, 4, 5, 6. Now, the data is encrypted in the database, the database cannot see this employee ID. Is it possible to fetch just the records for this employee without even telling the database what this ID is? So, can you do this? It turns out that there are certain limited places where you can do this. For example, if you encrypt the employee ID, when you run a selection query you will do the same encryption on the ID provided in the application program and send that encrypted ID to the database. So, the database is comparing one encrypted ID to another encrypted ID and it can fetch just that record. So, that is one way. Another way is to not encrypt IDs, but encrypt only sensitive data. So, these are in fact used. But now supposing I want to do more complex computation. I want to encrypt salaries, but I want to find the average salary in the database without transferring all the encrypted salary data back to the application server. So, this is not easy, but there has been a bunch of research on certain limited cases where you can do computation of certain forms addition and so on on encrypted data and fetch that result and sum back and decrypt it to get the sum. So, this is fairly tricky area, but there has been a lot of research in recent years on this. I am not sure it is practical. I am not sure it will even even become practical, but people are trying to make it practical. Now, even if you encrypt data and store it in a remote database, there are still many kinds of attacks possible. For example, a person who hacks into that database may replace my salary with some other encrypted value and if you decrypt it, you get a legal value which is not my salary. So, that application is not able to detect that there is a problem or it might just delete some records and the application does not realize that some records are missing. So, it deletes me totally. Application has no idea that my employee records have been deleted. So, even though the data is encrypted, that does not protect against certain things. So, how do you deal with this? There has been some very interesting research on data structures called Merkel trees which can detect such modification in a fairly efficient manner. I do not have the time to get into what these details are, but I just want to highlight to you that this is an interesting research area. So, a lot of research may be 5, 6 years ago it was a very hot topic. Even today there is some ongoing research in this topic. There are not too many practical solutions yet, but people are working towards it. So, at least some limited forms of protection can be provided for outsourced data. Now, the last topic I am going to cover is privacy. So, what is this about? So, there is a lot of data which you do not want to be let out to everybody, but at the same time you want limited information from that to be made available for the public good. For example, you have records of diseases which people have got. You really do not want to announce to the world that this person has a typhoid or this person has HIV and so on. There are laws about this. On the other hand, if I see a cluster of typhoid cases in a particular area, then I realize something is going on. There is an epidemic and it is time to have an intervention. Maybe the intervention could be to tell people, hey there is a typhoid epidemic in your area, boil your water and do not drink untreated water and that might end that epidemic. So, I need some information without revealing individual users information. So, this was done in the US in the following way. They said you can release anonymized information of medical data. You remove the name, but you want to know where epidemics are happening. So, you need a rough geographical area.  So, you need that. You also need to know the age of the individual because some things affect children, some things affect adults. So, they allowed these three to be retained and released. Unfortunately, it turned out that with just this three piece of information zip code of pin code, the gender and the date of birth. In a very large number of cases you can uniquely identify a person. There are not that many people with the same date of birth and gender in the same pin code. Actually, pin codes in India cover fairly large area. Zip codes in the US are more narrow. So, it turns out turned out that the publicly available medical records in Massachusetts could be used to find out the medical history of the governor of Massachusetts. Some researcher did this and announced this, which was a big embarrassment. So, subsequently there were laws which specifically say you cannot release these three pieces of information. You have to hide something in there. So, there are now laws about privacy. So, there is a trade-off there. There is another interesting case where American, so there are lot of people working on web search and web search quality depends a lot on search history of users. So, Google has access to that data. Microsoft has access to your search history.  Now, there were some nice people at American Online, a company which now is not doing well. But some years ago they were doing better and they said that, look, people do search on us. We will release anonymized information about searches to help academic researchers. So, there were nice people who put out the data. But it turned out that most people do what is called ego surfing. So, they search for their name on the database, over there. And then they search for their locality. You know, I search for Poway. I search for my name. So, now I know that this particular set of queries came from Sudarshan in Poway. How many Sudarshan are there in Poway? Probably not too many. And therefore, people can find out exactly what I have searched for.  So, that was very embarrassing. And in fact, some people in the company including some Indian employees were fired after this incident. So, that is a big problem. So, the question is how to balance useful of data which you reveal with while protecting privacy. And there have been a lot of interesting research in this area. It is a very active area still. There has also been a lot of government intervention in this area with laws on privacy protection. So, the Indian IT Act amendment in 2008 says things about this. The in the US, the HIPAA and Sarbanes-Oxley Act have legislated various things. In India, there is a conflict to some extent between right to information act and privacy which is keeps getting resolved by subsequent ruling. So, it is a very interesting area which many people will have to deal with going forward. So, with that, I will end my talk. Sastra Tanjavur, please go ahead. What are the problems that arise while migrating data from 1000 to 100. So, I do not know if there is any security issues here. There are a lot of other issues, performance and so on. Usually, cloud databases have extremely large volume. So, migrating such large volumes of data would overload networks and there are many other issues, but I do not think they are security related. So, I would not get into those other details. So, I think the question is if you can create a database slice for a particular user and allow them to only access data within that slice, can you safeguard against? SQL injection. Certainly, it would help a lot because if you only allow the user to access information in their own data which they are allowed to anyway read or things which they are anyway allowed to modify, then by doing SQL injection, they cannot touch any other data. So, that is related to the fine grain authorization which I talked about. So, if you are able to do that, you can get some good amount of protection from SQL injection. But if you code your application properly, then you get 100 percent protection from SQL injection. So, it is a good idea to do both. The checking the application, coding it carefully and checking it for vulnerability by static analysis is probably the easier solution which is what organizations are doing. But the other one could form a longer term solution for other classes of things. Does that answer your question or do you have more? Slicing techniques. Sir, can you suggest some good slicing techniques? Which slicing? No, I do not have any specific suggestion on that. Vivekananda, college, Namakkal. Good afternoon sir. My question is, in your security process, I mean the data information security process, how long we can expect the data information will be safe? Whether it is a follow up of members, authentication members, it is needed for the data information will be safe? Not quite sure I understand it. I think the first part of your question is, how long should you keep data? Is that what you are asking? Yeah. So, there are various laws on this and so most companies are required to keep certain information for a minimum period of time. For example, accounting information you may have to maintain by Indian law for, I do not know how many years, maybe 15 years, because still then the tax authorities can come back and question you about what you did back then. So, now for web services which keep individual user information, there are certain cases where they will keep history of what you did for a certain amount of time. Now, again there are some legal requirements. For example, the governments may say that you want to keep a history of accesses for three months or six months or so on and they will keep it for that much time. Now, many companies do not want to keep it longer for two reasons. One is that they may overload their storage or cost performance issues by keeping too much data. Or by keeping a lot of data, they may just invite more government queries on old data and cost more trouble for themselves in terms of employee time devoted to answering these questions. So, many organizations have policies that we will keep data for the time that is mandated by the government and then throw it out later. So, keeping data I do not mean your files, your files they keep forever, but log information and other such things which they will keep for some amount of time and then they will throw it out. Does that answer your question? Thank you. Screen level, what is the main focus of screen level authorization sir? So, pretty much any application which you used, let us say an enterprise system. There are many, many screens to do various things, maybe to create purchase orders, to approve bills, to update salvy and so on. Many ERP system has literally hundreds of thousands of screens, may be far more in fact. And different people are authorized to do different things, authorized to see or use different screens. So, this is what I mean by screen level authorization. So, if there is a screen to update salvy, you may not get it as a teacher, but a salvy clerk may get it to allow them to update your salvy. So, that is what screen level authorization is about. I think I should wrap up. Thank you very much.


The next item of business is consideration of business motion 9-621, in the name of George Adam on behalf of the parliamentary bureau, setting out a timetable for the stage 3 consideration of the bail and release from custody Scotland bill. I ask any member who wishes to speak against the motion to press the request to speak button. I call on Martin Whitfield to move the motion. The next item of business is stage 3 proceedings on the bail and release from custody Scotland bill. In dealing with the amendments, members should have the bill as amended at stage 2, that is SP Bill 16A, the marshaled list and the groupings of amendments. The division bill will sound and proceedings will be suspended for around five minutes for the first division of the stage 3. The period of voting for the first division will be 45 seconds. Thereafter, I will allow a voting period of one minute for the first division after any debate and that subsequent divisions will be 45 seconds. Members who wish to speak in the debate on any group of amendments should press the request to speak buttons or enter the letters RTS in the chat function as soon as possible after I call the group. I would advise members that there will be some comfort breaks and members will be notified of the timings and duration of the same in due course. Members should now refer to the marshaled list of amendments and we turn to group 1 decisions on bail, relevant information. I call amendment 67 in the name of Pauline McNeill, grouped with amendments as shown in the groupings. Pauline McNeill to move amendment 67 and speak to all amendments in the group. I move amendment 67 in my name. The focus of the bill is to limit custody to those who pose a risk to the public safety of when it is necessary to prevent significant risk of prejudice so that it clearly benefits to reducing the damaging effects of short term detention. Section 1 of the bill requires just the social work to be given the opportunity to provide information to the court when making decisions about bail. Interesting to note the language of the bill is that the opportunity is a mandatory opportunity, but what I do think is a good intention. I have raised this at stage 2. I was concerned about the inconsistencies of the provision of just the social work across different courts across the country because in Glasgow we are well served and other parts of Scotland we are not. That opportunity is not going to be equal across the country. Amendment 67 replaces the requirement that the court must request information from just the social work to make this discretionary and insert may request information from just the social work. In the written submission to the Government, the Senators of the College of Justice stated that there were many occasions in which such input is plainly irrelevant and on the imposition of a statutory requirement to seek your report in certain circumstances would seem inappropriate. For example, if a person is charged with a series of fines of violence and has a significant record of similar offending, there on the face of it is very little prospect that that person would be granted bail. In such cases it is difficult to see that any purpose in requiring the court to seek a report with attendant delay demands upon the resources of the social work department. David Fraser of the Scottish Courts and Tribunals Service also noted that if just the social work reports were required in every case, then they would create the potential for reports not being available when they are required in court. I would like the Parliament to know, in my exchange with the Cabinet Secretary for Justice, as the age 2, that she clearly set out helpfully that there was no intention of the provision to delay any proceedings of the court in this manner, although some people had thought to that. However, it just seemed to me that, given that, it would make more sense to say that there may be an opportunity rather than there must be an opportunity because it does not have to be taken up in every single case. My amendment removes the statutory requirement to seek a report and set out a degree of discretion depending on the context of the case and the history of the alleged offender. I now call Maggie Chapman to speak to amendment 15 and other amendments in the group. Before I speak to my amendments in this group, I would like to thank the victim support organisations and others who have worked tirelessly to ensure that the voices of victims and survivors are heard in this process. I appreciate that we will not all agree on everything today, but I am grateful to them for their insight and expertise, and I refer members to my register of interests. Amendments 15, 16 and 21 focus on the new victim safety element of the proposed bail test. I have listened carefully to the voices of victims' organisations throughout the scrutiny process who rightly wish to ensure that the court has full information, as full information is possible about victim safety concerns at the time of the bail decision, including decisions on special conditions of bail at a time that decision is being made. My amendment 15 aims to help strengthen this area. In particular, amendment 15 adds to the court's general power to seek further information that is relevant to the bail decision from the prosecutor, the accused's legal representative or, as amended by the bill, justice social work, by expressly enabling the court to ask the prosecutor to provide it with information in relation to the risk of harm to the complainer. Amendment 15 makes it clear where victim safety is a relevant consideration in a case before the court, for example in cases of domestic abuse or sexual offending. Then the court can ask the prosecutor for additional information to help it to make a determination on bail. The amendment also serves to emphasise to the court the importance of the victim safety element of the new bail test and being as fully informed as possible when making bail decisions. Amendments 16 and 21 are consequential to amendment 15. Amendment 16 is a technical amendment necessary if amendment 15 is accepted. It makes minor and technical amendments to the amendment in section 1, 3C of the bill to reflect that subsection 7 of 23B will no longer immediately follow subsection 6 of 23B. Amendment 21 amends the definitional power in section 2, 2C of the bill to ensure that the definitions of complainer, harm and psychological harm also apply for the purpose of the new section 23B, bracket 6A, that I am proposing to be inserted into the criminal procedure Scotland Act 1995. Presiding Officer, I ask that members support amendments 15, 16 and 21. I now call on Casey Clark to speak to amendments 68 and other amendments in the group. I move amendment 68 in my name, which focuses on the resources local authorities need to provide justice social work. It requires the Scottish Government to report on the operation of section 1 of the bill and the impact on local authorities. In particular, whether they have adequate resources to meet the requirements of the legislation or whether further resources are required, and if so, what action is needed to be taken to address that? The amendment requires the Scottish Government to consult both local authorities and any professional bodies representing social workers in preparation of the report. The background is that funding for justice social worker has been flat over the last three years, a real terms cut of £86.5 million. Social Work Scotland has said that members report that waiting times for assessments, support and treatment are all increasing, and in some social work teams over 30 per cent of positions are unfilled. Unison Scotland has said that justice social workers are faced with some of the highest caseloads and that many local authorities are scaling back social work services as a result of real terms cuts in local government funding. It is clear that the Scottish Government wishes to enhance the role of justice social work in the provision of information to the courts, and Scottish Labour also wants to see that. However, it is difficult to see how that can happen without additional resource. At stage 2, the cabinet secretary acknowledged the budgetary challenges when I put down the same amendment and said that introduction of the legislation would be phased. However, the financial memorandum does not recognise the very serious cost and resource implications of those proposals. It is not possible to lodge amendments to require the funding needed for adequate resourcing, so this amendment has been put down to ensure focus and scrutiny on the resourcing issues. I now call Jamie Greene to speak to amendment 19 and other amendments in the group. I also put on record my party's thanks to all those organisations who have worked with committee members and others over the passage of this bill. This is a bill of two parts. In my view, part 1 is the substantive part. It is the part of the bill that deals with that pivotal moment when a judge has to make a decision on whether to remand someone into custody or bail them on release back into society, often with conditions attached. That is a very grave and difficult decision. As we go through the next couple of groups, I want to make it clear that I think that there has been little doubt as to what the real intention of the bill more generally is, which is to reduce the remand population in Scottish prisons. However, the question that I sought to answer from day 1 was a simple one. Is that the stated intention of the legislation or the inferred one? It is not an earthing that. We need to look at what the response has been to the proposals from the Government, by the judiciary, by victims' organisations, by justice practitioners or courts or police, but most importantly by victims themselves. This afternoon, I will present a series of amendments that I think deal with some of the deficiencies in the bill, even at this late stage. Indeed, I go as far as saying that when this bill was published, we spent far too long talking about improving the experience of the accused or the offender than of the victims and complainers. I sought to redress that imbalance at stage 2, and I am doing the same today at stage 3. I do not think that we can vote against amendments today which change our bail system and which will put families or victims at any greater risk than they currently are. The onus is on all of us, as members, to look considerably at the amendments before us, not to reflect on the source of the amendments but on the content of them. That is an ask that I make of all of us today. I have worked extremely closely with Victim Support Scotland, which will feature often in my comments today, in the production of my own amendments. I am really grateful for their support and for their backing for most of them. That leads me to my very first set of amendments. Amendment 19 will add a provision to the bill that will allow the complainer, if he wants to, to make representations to the court during that bail hearing regarding how they will be impacted if the accused person is granted or refused bail. Note that I make extra care to ensure that the word may is used in this amendment and not the word must. I absolutely do not want complainers in those scenarios to feel forced or be forced to make representations when they are not comfortable to do so or it is not relevant to them. This amendment will not force them to do that. I also wanted to make sure that the wording of this amendment was broad in the use of its word representation. Those of you who will have been to a busy custody court will know that the judge is weighing up whether or not to remand an individual into custody in the immediacy of that environment, often with the information that is presented to them during that hearing. Much of the bill in this part goes some way to allow criminal justice social work and other relevant parties to make greater representations to the judge on the day on behalf of the accused, presumably with a view to inform them of the decisions so that they make the best decision possible. I do not have a problem with that, but I would ask that that same privilege can surely be afforded to the complainer in that instance or the complainer's representative, because both voices must be heard. Now, some victims organisations said that they have a concern that while they agree that this might be a helpful provision in most cases, they do have concerns that, for example, victims of domestic abuse could be coerced into making representations to the court which do not accurately reflect their circumstances. I do share that concern, which is why my amendment is purposely an enabling one, which simply creates a mechanism by which they can, if they want and only if they want to, ensure that the court is in full possession of all the relevant information about the case before it. I think that this is vital, but I am willing to hear what the cabinet secretary says in response to my well-meaning amendment. If amendment 19 is problematic, I ask the chamber to look at amendment 20. This amends the 1995 act by including a clause that states that, in a submission by the Crown, it must include, I quote, information in relation to the complainer's safety or the safety of other persons. It also states that information could be obtained from a wide range of sources, including a victims' advocacy or support organisation. Essentially, to me, the consideration of the safety of the complainer should be the utmost priority in those deliberations, and I am such delighted that both Victim Support Scotland, Scottish Women's Aid and ASIST have ours members in the chamber to support amendment 20. Just finally, on the other amendments in this group, which members have already spoken to, I am very happy to support amendment 67, in the name of Pauline McNeill. Similarly, we will support amendment 68, in the name of Katie Clark. I am also happy to support Maggie Chapman's amendments 15 and 21, which will allow the court to request information from the Crown on the risk of harm to the victim. I did have, albeit that she described as a technical amendment, a problem with amendment 16, which, in my interpretation of it, would at least allow both the prosecution and the defence to give an opinion to the court on the risk of something occurring, as I mentioned in the bill test. This amendment neither has the backing of VSS and other victims' organisations, much to my surprise, but I will trust their judgment on that. I will close my comments on that group. Thank you, Mr Greene. I now call Cabinet Secretary Angela Constance. I will speak to all amendments in the group. Amendment 67 from Pauline McNeill seeks to remove the mandatory requirement for the court to provide an opportunity for justice social work to provide information relevant to the question of bail and instead make this discretionary. An identical amendment was lodged by Ms McNeill at stage 2 and fully debated by the Criminal Justice Committee. The purpose of section 1 is to ensure that justice social work is always given an opportunity to provide information to the court, so amendment 67 would completely cut across this policy as it would be left to the court to decide. As was discussed at stage 2, there have been suggestions that decisions on whether to admit an accused to bail could be delayed as a result of changes proposed by section 1 of the bill. That will not, however, happen, as acknowledged by Ms McNeill in her remarks. Section 1 does no more than require the court to give justice social work an opportunity to provide it with information relevant to the question of bail. It does not mean that justice social work has to provide information in every case, nor does it mean that the court cannot make the bail decision if information from justice social work is not provided. If a person appears, for example, on a Monday, the bail decision must be made by the end of Tuesday—in other words, the next day. This is the legal timescale and will remain the legal timescale. The court will continue to make bail decisions on the basis of information put before it whether or not justice social work has provided information. There is no risk that bail will be refused because the court is awaiting information from justice social work. The court cannot refuse bail because it is waiting for information from any party. The effect of amendment 67 is that it would leave it to the discretion of the court whether to offer an opportunity to justice social work to provide information. There is a risk that this could mean that valuable information is not provided in individual cases, as the court may not always be aware of whether criminal justice social work holds relevant information because it has not asked justice social work. I ask Pauline McNeill not to press amendment 67, and if she does, I ask members to vote against it. The Scottish Government supports amendments 15, 16 and 21 from Maggie Chapman. Those amendments respond to some of the issues raised at stage 2 by Scottish Liberal Democrats. As Ms Chapman has set out under existing bail law at any time, the question of bail is being considered. The court has general power to seek further information that is relevant to bail decisions from the prosecutor or the accused's legal representative. The bill seeks to extend this power to include justice social work. Sitting alongside this general power, amendment 15 expressly enables the court to ask the prosecutor for additional information in relation to victim safety to help inform the bail decision. That highlights to the court both the importance of the victim safety aspect of the new bail test and that it is primarily the role of the prosecutor who acts in the public interest to provide the court with information about any perceived risk of harms which the accused poses to the complainer that would be relevant to the court's decision on whether to grant the accused bail. I am aware that, throughout scrutiny of the bill, ensuring the court has the best information to help inform its bail decisions has been a key issue. Amendment 15 acknowledges the important position of the prosecutor in this regard and is a sensible and helpful provision that will aid the operation of the new bail test, including consideration of victim safety, which is at its heart. There are also two consequential amendments 16 and 21. Katie Clark's amendment 68 would require the Scottish ministers to report to Parliament on the operation of section 1 during its first year in force. That amendment is identical to the one that Ms Clark lodged at stage 2, which was fully debated by the criminal justice committee. I very much recognise that the enhanced role of justice social work through section 1 carries resource implications, as set out in the financial memorandum. It is important to remember, though, that the bill simply requires the court to give justice social work an opportunity to provide information relevant to the question of bail in each case before the court. It does not place any duty on justice social work to provide such information. Ultimately, it will be for justice social work to identify those cases where they can best help inform the court's decision making by providing additional information. I have made clear throughout the passage of the bill that the Scottish Government will continue to work with justice agencies during implementation planning to review the resourcing requirements and the timescales for commencements. Members, as we all are, are well aware of the real challenges in relation to budgets across Government and across the country, and that those are likely to continue. However, I remain very close to the issue, and I would contend that the ring-fencing of criminal justice social work has certainly given it a stability, notwithstanding pressures. The Parliament, of course, has the power to carry out post-legislative scrutiny of any act of Parliament. It may choose to scrutinise particular provisions of an act. Parliament also requires to pass the Government's annual budget bill, so elements of the justice budget, including justice social work, can be looked at through that process. Accordingly, the Parliament would be able to consider the impact of the bail reforms on justice social work through those scrutiny processes without having to add a further reporting requirement to the bill to allow for that. I ask members to vote against amendment 68. Amendment 19 from Jamie Greene would give the complainer the right to make representations to the court when it is determining whether to grant or refuse bail. The subject of how the court is best informed about the potential risks to complainer safety is a key issue, rightly so, discussed in some detail at stage 2. With the new bail test explicitly embedding public and complainer safety within its operation, it is clearly important that the court has appropriate information to assess that. Amendment 15 being considered in this group emphasises to the court the route by which information on complainer safety should be obtained. That is from the prosecutor. As was discussed at stage 2, I would have concerns about placing any sort of requirement or expectation that a complainer should appear in front of the court, and I know that that is not Mr Greene's intention. It is clearly important in many cases, such as domestic abuse, that information on potential harm is made known to the court, but that should be via the prosecutor, and amendment 15 helps to strengthen the law in this regard. I am grateful to the cabinet secretary for explaining the Government's position, but I want to pose a scenario that I do not understand will be best addressed, and that is that of a busy custody court. The scenario being that the current advocate on the day is likely presenting a large number of cases to the judge on the day. Amendment 15 says that the court may request a prosecutor to provide it with information relevant to the risk of harm. How is that practically achievable in the scenario where neither the complainant nor the representative is in the court on the day? The advocate has no access to information, particularly if the arrest has been made over the course of the weekend, which is often the case with domestic abuse cases. Why is it such a problem to allow the complainant to provide that information to the court in advance, potentially, so that it can be heard by the judge on the day? The scenario outlined in amendment 15 alone would not suffice in every scenario and certainly would not give every complainant the opportunity to make representation to the court. The whole purpose of section 1 of the bill is to ensure that the court has the very best possible information available to that. However, it is also important, notwithstanding that prosecutors are very busy, but as are judges, as are criminal justice social workers, as are victim support organisations and I think that we are well within our rights to be crystal clear on what the role of the prosecutor is in providing vital victim information where that exists. I would like to put another scenario to Mr Dean, because, although I am sure that it is not his intention, my worry is that there may be unintended consequences from his amendment and an increased risk of harm if a complainer personally makes representations at court. It may increase risk to their safety or increase the risk of the complainer being coerced into making representations to help to secure an accused person's release on bail. So, while I accept that amendment 19 is very well intentioned, it is not an amendment that the Government can support. Amendment 20 from Mr Greene would place a mandatory requirement on the prosecutor to always include information on the safety of the complainer or other persons in their bail submission. Where such information is relevant to the question of bail, the prosecutor will, of course, provide such information, but to require it in every case, even when, for example, there is no complainer or where there is no question of complainer safety being an issue, such as the case in short lifting would be a step too far. In addition, amendment 20 would require the prosecutor to include information on complainer safety obtained from a victim advocacy or a victim support group. Again, I understand the intent, but if there is no complainer or if the complainer has no wish to engage with such a group, the prosecutor would still require to include such information, even where clearly it is not relevant or where it is not available from the victim group. It is for the independent prosecutor, Presiding Officer, who acts in the public interest to ensure that relevant information is presented to the court in relation to complainer safety. Amendment 15 strengthens the law appropriately in this regard. There are also some technical issues with amendments 19 and 20. For example, there is no definition of victim support or advocacy group referred to in amendment 20. Given this amendment imposes a new duty on the crown in connection with court decisions on bail, it is important that there is legal certainty. On that basis, I would ask members to oppose amendments 19 and 20.  In summing up my amendments in this group, I agree with the cabinet secretary that the principle of providing the maximum amount of information to the court is, of course, very important. However, I do not think that the Government did address the question of the inequality of resources across the country. In fact, I would argue that it is a meaningless mandatory requirement to provide an opportunity if, in some courts, that is really just not possible. Although the cabinet secretary said that resources can be looked at in answer to Katie Clark in her amendment, it just needs to be leaving that question totally unanswered. If there is no social work available in some courts, then that opportunity will simply not be taken up. I think that inequality there has become a bit meaningless. It has made more sense to me just to change that the must requirement to me would make more sense in legislative terms. With that, I will support amendment 20 in the name of Jamie Greene, not amendment 19, generally because there was not enough technical information. There is quite a lot to be considered about how we were done before the court. We will support amendment 15 in the name of Maggie Chapman, but not 16 or 21, but we will support amendment 20 with that. I move and press my amendment. The question is that amendment 67 be agreed to. Are we all agreed? We are not agreed, and there will be a division. As this is the first division of the stage three, I will suspend for around five minutes to allow members to access the digital voting system.


Putin's party is creating its own private army. The Russian ruling party, United Russia, is recruiting members for its own private army, the mercenary company Hispaniola, Ukraine's military intelligence agency said. This adds the group to the list of several mercenary formations that have fought in Russian ranks against Ukraine, the most notable being the Wagner company. Hispaniola was previously part of the Russian militant group Vostok Battalion as a volunteer unit of Russian football hooligans. Since 2023, Hispaniola has been under the control of United Russia as a private military company according to military intelligence, the ruling party. Formerly chaired by ex-president Dmitry Medvedev, but effectively one of the pillars of Russian leader Vladimir Putin's rule has reportedly been pouring money into the group and began to actively seek new members. The unit is made up of football ultras, radicals and neo-Nazi sympathizers, but also recruits citizens from poorer Russian regions and occupied territories of Ukraine. The latter are reportedly used primarily as canon fodder, military intelligence noted. At Hispaniola's recruiting centers in occupied Ukraine, volunteers are offered 220,000 rubles or $2,400 per month for direct participation in hostilities for at least half a year. Recruits are also promised 1-3 million rubles or 10,920 to 32,760 as insurance for injuries and 500 million rubles or $54,600 in case of death, military intelligence said. In practice, such compensations are often omitted as dead and seriously wounded are regularly left behind on the battlefield and registered as missing so as not to pay out the insurance. Hispaniola was reportedly formed in 2022 by militant Stanislav Olov and Vostok Battalion's leader Alexander Kodakovsky. The unit claims it had participated in the siege of Azovstal in Mariupol.


I wasn't sure if I was uh if it was a cramp or some more significant so uh just let a couple more innings play out and and um go inside and swing a little bit see if I could uh could do it and um I thought I had enough in there to finish the game at least. What told you afterwards that it was something more significant that it was maybe a bigger issue?  I don't like it at all I mean I just uh just work for six weeks to get here plus off season so you know much rather this would have popped in in spring training but um uh that's where we're at so I don't have to start from scratch when I come back but um you know just gotta build everything up make sure everything's ready to go when I'm back. The Yankees have just been decimated by injuries lately and they are major players on this team John Carlos Stanton as we know Aaron Hicks still down in Tampa not doing any baseball activity but according to Aaron Boone he is feeling better. Luis Severino with that right rotator issue. Delin Vitanzas did throw a bullpen yesterday they are hoping to see him sooner rather than later and as we learned at the top of the show Miguel and Duhar also headed to the injured list so now this is an opportunity for some other players that have come up to Scranton from Scranton. Jack you mentioned that Tyler Wade was coming to fill the place of Miguel and Duhar also Clint Frazier is here filling in that outfield role Frazier actually got the call when he had just landed at the airport in Scranton Kevin Reese called him and told him he is not going to Scranton he is heading to New York and he is not in tonight's starting lineup but it goes without saying he is excited for the opportunity especially considering the fact that he lost the majority of his season last year due to that concussion and concussion like symptoms thereafter. It feels about as good as my debut you know I mean I went through a hard time last year and unless you've gone through the experience yourself you don't really know how to I don't really know how to explain it you know so it was a really difficult time and it means a lot to be here and you know my mom's with me here so hopefully we're going to soak up the moment together. You've been a guy that's always been known to play hard have you adjusted the way you play in the outfield at all because of that situation with the concussion? I've only been faced with really one situation you know and I tried to rob a home run in spring and you know had a little collision with the wall but you know I did a lot of stuff in the off season to prepare myself for another situation in case I do run into the wall so you know going hard is ingrained in my my DNA and it's something that you know I'm probably going to have to figure out over time to manage it but I think it would make me less of a player if I tone it down a little bit. What are your expectations for your time up your time up here? I'm going to try to make the most of it you know I mean last year Miggy got a chance to come up here and you know he ran with it and you know I'm going to do the most that I can to be ready every opportunity that I have and you know try to show this club that you know I can do a little bit more than talk I can back it up so hopefully it comes this time.