My name is Cooper Quinton and thank you for coming to my talk detecting 4G base stations in real time First a little about me. I am a senior security researcher at the EFF threat lab I have a toddler, so you'll have to forgive the dad jokes and possible baby noises in the background I'm also a former teenage phone freak I may have built some boxes to do some nefarious things back in the day Which might explain why I got into the work that I do now If you're not familiar with EFF, we are a member supported nonprofit over half of our annual funding comes from small donations from our members Individual donations and we defend civil liberties online So we think that when you get online your rights come with you And that when you're using technology you still have rights such as freedom of speech and the right to privacy And we've been doing this work for 30 years this year. We started in 1990 So we've been we have all we have a lot of experience under about we've been defending the internet and defending hackers for a long time I work in the EFF threat lab and I'll talk a little bit more about that in a second But I want to first introduce my colleague Yamda She can't be here with me on the DEF CON stage today But none of this research would have been possible without her hard work This is as much her project as it is mine and she is an incredibly smart incredibly talented person So if you see her in the virtual halls of DEF CON safe mode, please buy her a virtual beer Or follow her on Twitter.  This is an actual photo of her A bit about threat lab we look at technology that targets at risk people So by at risk I mean people who are at risk of harm just for being who they are having the beliefs that they do And this includes activists, human rights defenders, journalists, domestic abuse victims, immigrants, sex workers, minority groups, political dissidents and so on Basically anybody who is at risk So this is the sort of technology that we research and try to try to get a handle on And we do this work because even though cybersecurity teams and antivirus companies are doing a good job of what they do They mostly care about the type of malware that affect their customers which are usually enterprise customers And this is things like ransomware, banking trojans, things that steal sensitive corporate data, things that affect bigger businesses And we get to care about the types of technology that infringe on civil liberties and human rights of at risk people Because these people don't necessarily have the budget to pay a security team But we also by virtue of working for a non-profit don't have to worry about meeting a bottom line at the end of the day So we like to think of ourselves as the security team for people who need it most and yet can afford it the least Our goals in this work are of course first and foremost to protect people We want to make sure that the people in our communities that we work with are safe And able to express themselves and able to exercise their human rights We want to broaden the community's understanding of the sorts of threats they faces Who the threat actors are, what their capabilities are and what sorts of technologies they might be facing And we want them to better understand their defenses as well, how they can protect themselves in what ways and what sort of measures they might need to take We want to expose bad actors such as nation states or companies or cyber mercenaries that are going after people That are building technology to spy on civilians and violate human rights And we want to make better laws because we're a legal non-profit at the end of the day We want to make better norms and better laws and better norms in civil society So that these sorts of things don't keep happening again and again What I want to talk to you about today is cell sight simulators also known as stingrays or MC catchers I want to talk about how they work, some previous efforts to detect them And why I think that those efforts aren't so great and a new method that we've come up with to detect them here at EFF And also how to fix the problem of cell sight simulators once and for all First a little bit of terminology, the UE is the phone, it's just the phone stands for user equipment But it's just the phone, the thing you're making the calls on The MC is the international mobile subscriber ID This is the ID that is burned into the SIM card and unique for each SIM card The IMEI is the international mobile equipment ID and this is the unique ID for the hardware that's burned into the hardware and can't be changed The E node B or the base station, this is what the UE user equipment, again the phone This is what the UE is actually communicating with This is the thing that's at the end of the antennas that you're talking to The ERSIN or EARFCN, this is the frequency that the UE and E node B are communicating on The sector is a specific antenna that is attached to the base station or E node B And E node B can have multiple sectors and each sector basically is an antenna pointing in a specific direction The MIM or master information block is broadcast by the E node B and tells phones where to find the SIV or system information block Which contains more details about the E node B such as the cell ID, the MCC, MNC and TAC Which are the mobile country code, the mobile network code and the tracking area code respectively Finally, I'm going to use the terms MCCATCHER, Stingray, Hailstorm, fake base station and cell site simulator all kind of interchangeably These don't mean exactly the same thing, a cell site simulator and a fake base station are fake cell towers A Stingray and Hailstorm are two brands of cell site simulator And MCCATCHER is sort of a common term for one of the things that cell site simulators do Although not all MCCATCHERS are cell sites that fully emulate a cell site Some MCCATCHERS can run passively and not actually transmit anything that's not emulating a cell site But for our purposes we can use them interchangeably and that's okay for the purposes of this talk So here we have a diagram of the 4G network, this is a pretty high level diagram You can see here that the user equipment, the phone, connects to the E-Node B using the LCU protocol Through the uplink, the E-Node Bs can talk to each other through another vertical And the E-Node Bs exist in a network called the EUTRAN And then you have a network called the Enhanced Packet Core Which is behind the E-Node Bs and this contains the MME or Mobility Management Engine Serving Gateway and PDN Gateway which connect to the public data network Which connect to the back to the phone network And the EPC is also responsible for authenticating user billing, etc We're not going to focus on the EPC today, there are issues there that we could talk about But it's out of scope for this talk, we're going to focus specifically on the communication between the user equipment and the E-Node B And the area inside of this red circle So we started this project because we already knew a lot about the Stingray Some law enforcement agencies had had the Stingray, the Stingray had been around for a while And it was pretty well understood how it worked Kristen Padgett did a really great talk at DEF CON several years ago Where she demonstrated building her own homemade Stingray And it's pretty well understood the vulnerabilities But what we were noticing was that law enforcement was starting to upgrade their cell-site simulator devices to newer devices such as the HailStorm Which purported to be able to operate natively in 4G And we started wondering, well we have a pretty good idea of how the Stingray works But we have no idea of how the HailStorm and these newer devices operating in 4G How they might work So let's dig into this and let's start by figuring out how they could possibly work And the first thing we want to look at is what changed between 2G and 4G And there are three significant changes that affect the way that a cell-site simulator might work The first and most important is that the E-Node B and the UE in 4G mutually authenticate each other In 2G the user equipment or the phone had to authenticate itself to the E-Node Beer, the base station But the base station never had to prove that it was a real base station And this was the source of a lot of fake base station attacks such as the ones that the Stingray used in 2G With 4G this is no longer a problem Also in 2G you had terrible encryption The base station would dictate to the user equipment what cipher to use And it could even dictate that the user equipment used a null cipher What's more, the ciphers that were used by 2G were actually quite weak And could be broken in real time or near real time by anybody recording the packets between the base station and the phone Without even having to transmit anything This is no longer the case in 4G, now that E-Node B and UE mutually agree on what encryption to use And the ciphers are much, much better Also in 2G the phone would always just connect to the strongest tower that it could see In 2G you could even dictate how strong your signal was Telling the phone to ignore the actual signal strength and just trust what you were saying the signal strength was Neither of these are the case anymore in 4G The phone no longer negatively connects to the strongest tower, instead there are a set of cell selection criteria that it follows So great, we've solved all the problems right? Well clearly not because there are still cell sites and letters that are operating natively in 4G So me and Yamna set to work reading all of the academic literature that we could about vulnerabilities in 4G That could possibly be making cell sites and next generation cell sites and letters work And after several months of reading, over a year of reading really, Yamna wrote a really amazing paper called Gotta Catch a Mall Which summarizes all of our findings, everything that we learned about what vulnerabilities next-gen CSS might be taking advantage of And we really figured out that there's one specific area where 4G is extremely vulnerable So 4G has a bit of a glass jaw, even though the UE authenticates the tower now There are still several messages that get sent, received and trusted before that authentication ever happens Or without authentication ever happening in the first place And this is the weak spot in which the vast majority of 4G attacks happen I'm not going to get into those attacks here today because Yamna has already done a really excellent job of summarizing those in that paper And I highly suggest that you go read it, it's an excellent paper But to give a high level summary, this is the handshake protocol between the user equipment, the phone again, and the base station And it starts with the user equipment looking on each ER send or frequency for a frame synchronization signal from a base station Once it finds synchronization signals, it is able to find the MIB, master information block and decode that Which lets it find the SID and decode that, which gives it enough information about the mobile country code, the mobile network code To decide whether it wants to connect and then send an RRC radio resource control, RRC connection request It does that handshake and then it begins the attach request And here in step 7 is where the authentication finally starts All of the messages before that are never authenticated And some of the messages that get sent in that area can contain things like the IMSI of the phone allowing you to uniquely identify it It can contain even the GPS coordinates of the phone allowing you to locate it And a bunch of other things, attacks that allow you to downgrade it to 2G or allow you to kick it off the mobile network entirely So this is where the heart of all of the vulnerabilities lie at 4G And this is the part that we find really interesting So now that we had a pretty good handle on how 4G cell synchronizers are probably being used We wanted to get an idea of how often they're being used And if we want to learn how often they're being used by US law enforcement The best way to do this is to file FOIA requests ACLU filed a really excellent FOIA request which came back, which just got published this year in 2020 About an ICE and DHS's use of cell site synchronizers And in it they discovered that ICE or US Immigration and Customs Enforcement used cell site synchronizers between 2017 and 2019 a total of 466 times Hundreds of times per year DHS on the other hand used their cell site synchronizers 1,885 times between 2013 and 2017 We also found out that Customs and Border Patrol or CVP owns 33 cell site synchronizers Which is a ton and we don't know how often they're being used But we can assume that it's probably on par with ICE and DHS Oakland on the other hand, Oakland PD, Oakland's local police department in California They used their cell site synchronizer, which is a hail storm, 3 times in 2017 In 2018 it was used 4 times and in 2019 it was used only once But on the other hand, Santa Barbara PD, the local police department for Santa Barbara, California Used their cell site synchronizer 231 times in 2017 Roughly matching up with the numbers from ICE and DHS So what makes Oakland so much different in this case? Well we think that it's because Oakland has stronger privacy laws Oakland has pretty strong regulations about when and where the cell site synchronizer can be used How it can be used and what sort of public reporting needs to happen afterwards And we think that that has really kept Oakland PD on a leash as far as their use of cell site simulators is concerned So we encourage other communities to come up with similar rules and regulations about how these can be used But of course, not everybody using a cell site simulator is going to follow rules and regulations Nor can they be foiled We have pretty good evidence that foreign spies are using cell site simulators The Department of Homeland Security put out a report last year where they demonstrated that they found several cell site simulators around the White House and around Washington DC Which almost certainly belong to foreign spies trying to spy on the political class in Washington DC We also have reason to believe that cyber mercenaries such as NSO Group have access to cell site simulators A report from Amnesty International that was put out this year in 2020 Detailed a campaign against a Moroccan journalist to spy on Moroccan journalists by NSO Group where they also use cell site simulators to intercept his calls And finally, we think that just straight up criminals have access to these There's rumors that drug cartels have access to a cell site simulator and it makes sense Cell site simulators are pretty easy and pretty cheap to build at this point And if you don't want to build one, you can acquire them from companies in Israel, companies in Saudi Arabia They're really pretty ubiquitous and pretty easy to acquire And of course, these people can't be foy it. We can't ask them how often they're being used So we have no idea how often these groups are using these So that being the case, our next step is we start to think about, okay, how can we detect cell site simulators? And there are two schools of thought for how to detect cell site simulators One is app-based, and this is applications like AIM-60 or Android MCCapture Detector, Snoop Snitch or Darshark The strengths of these are that they're cheap. It's an app. You install it on your Android phone And they're easy to use. You start the app, you let it run, it lets you know what, if it finds something that's suspicious All you need is an Android phone, and it might need to be rooted, it might need to be a specific type of phone But you don't really, as long as you have that phone already, you don't have to spend any further money The weaknesses of these are that you're going to get very limited data AIM-60 only gives you, on an unrooted phone at least, only gives you the MCC, MNC and the location area good And some information about the signal strength. Snoop Snitch and Darshark get more info because they're able to read baseband messages on the phones that they support But it's still you're only getting the info about cells that your phone is connected to And you're getting a lot of information about weird things happening, but a lot of those end up being false positives Because many of the things that could be indicators of cell-side simulators are also just weird, these sorts of weird things that happen in the cell network quite often And because of that, you get a lot of false positives and it's hard to tell what is actually a cell-side simulator and what is maybe just the cell network being the cell network The other school of thought is radio-based and this is basically things where you have a software-defined radio or a cellular modem And you're getting information about all of the towers around you and you're putting that in a database and running some heuristics to determine what's suspicious Projects that are examples of this are Sea Glass from the University of Washington, Sitch from Ash Wilson and Overwatch which is a commercial product The strengths of these are that you can get better data, you can get data from all of the towers in an area, not just the ones that you're connecting to You can also get lower level information, you can get as low level of information as you want based on what you can program with your radio The weaknesses of these are that they're harder to set up, they can be harder to use and interpret because you maybe have to run Linux and set up a server And you have to put together some hardware and maybe even have to know a little bit of programming Also the weaknesses that you have to buy that hardware and hardware can be expensive You might have to spend a couple hundred dollars to get running whereas the app is free So there are strengths and weaknesses to both of these But armed with this knowledge we started hearing rumors about cell-side simulators being used at the Standing Rock protest At the Dakota Access Pipeline protest in Standing Rock, North Dakota And given that we had some ideas about how maybe one could detect cell-side simulators and we wanted to know if they were being used at protests We decided to go down to Standing Rock and see what we could find So I armed my phone with Snoop Snitch and AIM-60 and I brought along a couple of RTL-SDRs which I figured I could do some spectrum analysis with And made my way down to Standing Rock And what I figured out was that I had no idea what I was doing And by the way this dog, I don't know, our patronus is cancelled now If not, this dog is my patronus, I very much identified with this dog But we had no idea what we were doing When we got there, what we realized was there were no 2G towers anywhere to be found And whether they be legitimate or illegitimate, and all of our detection methods were focused on detecting 2G towers If a 2G cell had shimmed up all of a sudden, that would have been a pretty strong indicator But we weren't able to find any evidence of 2G cells while we were at Standing Rock And the conclusion that we came to is that if cell site simulators were being used at Standing Rock They must be next generation cell site simulators that were operating natively on 4G Which leaves us with the question, how can we detect 4G-based cell site simulators? And how can we improve on previous attempts to detect cell site simulators? Well, first off, I think that the radio-based method is solid C-Glass had already put up some pretty interesting results And the idea of getting information about all of the cells in an area, everything that's broadcasting Not just the ones that your phone is connecting to And comparing that data over time, I think are really interesting So let's add on top of that, looking specifically at 4G transmissions Having heuristics based on what we've learned from mine and Yamda's research And let's verify the results When we find a suspicious tower, let's go track it down and see what it actually is Is it on top of the cell tower? Yeah, great, it's probably fine Is it on top of a building? Yeah, that's fine, it's probably a small cell Is that building an embassy? Well, that's a lot more suspicious And finally, is it in an unmarked van or in a van surrounded by police officers? Well, that's very suspicious So without further ado, I introduce to you Crocodile Hunter Crocodile Hunter is an open source project that we've been working on at EFF for the last couple of years And are releasing here at Virtual Black Hat and Defcon this week Crocodile Hunter is a hardware and software-based It uses an SDR and the software The back end is based on SRS-LTE, which is an open source LTE software stack That's able to emulate both the enhanced packet core, the E-node B, and also the user equipment Which we use to measure the cell network in the area It's written in C++ And we wrote a program in the SRS-LTE API to scan the cell network for us The front end, which it communicates with a real local socket, is written in Python 3 The front end is responsible for getting data from the socket from SRS-LTE Adding it to the database, running heuristics, and displaying tower locations And we also have an API so that if you want to gather data from multiple sensors Or if you want to share data between multiple researchers, you can Here's an example of what the user interface looks like This is from a scan that me and my colleague Dave Moss did in Downtown San Francisco during the Dreamforce conference last year Each of these points on this map is, we think, the probable location of a cell in Downtown San Francisco on that day The orange points are cells that we didn't find to be suspicious, and the black skulls are cells that we did think were suspicious And I should note here that certainly there's no way that each of these black skulls is a cell-sized simulator In fact, probably none of them are cell-sized simulators But we think they're suspicious and require further checking And I'll go into more depth about that later On the hardware side, the hardware stack is a laptop or a Raspberry Pi running Ubuntu And you need a battery for the Pi if you want it to be mobile A USB GPS dongle, and an SDR with some LTE antennas For the SDRs, we've tested it with a Blade RF and an NSB200 It shouldn't support all models of NS and Blade RF It also, theoretically, could support a LIME SDR, which is significantly cheaper I think the Blade RF will run you about $500, whereas a LIME SDR will run you about $250 But we have not tested it with that But that is on the roadmap because we would like for this hardware stack to be cheaper Here's what the hardware looks like sitting on my kitchen counter As you can see, it's actually pretty compact And you can easily put it into a backpack or load it into your car And go for a drive around your city And it's pretty, and you can do it pretty discreetly So the general workflow is we start by scanning all of the frequencies that we know about And decoding them, each may have been saved that we find We record those into a database We map the probable location of those cells We look for any anomalies in the readings And then we locate suspicious cells and confirm the results And I'll go into each one of those in more depth So we start by scanning the list of ERSINs, again, frequencies We start by scanning the list of ERSINs that we get from an open source database called Wiggle Wiggle is an open source database of war-driving readings of Wi-Fi networks and also of cell networks So we get all of the ERSINs for the given geographical region that you're in And then we scan each of those And our theory behind this is that we think that a cell site simulator is going to have to operate on the same frequencies that real cells are so that phones will be more inclined to connect to them So we scan each of these frequencies And if we find a MIB, we decode the MIB and the SIV And we send it to the front end over our soccer The front end stores the information in a database And it stores in that database the mobile country code The network code, the tracking area code, the cell ID, physical ID and the ERSIN The latitude and longitude of where the reading was made The timestamp, the signal strength, the E-Node BID, the Sector ID and a few other IDs And finally the raw data from the SIV one And then the next step is that we try to map out the antennas in real time And we map them out using a process called trilateration Which is a process where we have the distance estimates that we're able to get From a combination of the frequency of the transmission and the signal strength We can estimate the distance and then with multiple readings figure out where the towers are And then we can compare this to a ground truth such as WIGL or open cell ID or the FCC database To see if other people have seen a cell with those identifiers in that area historically A quick explanation of trilateration versus triding relation So trilateration is where you have a measurement of the distance away from a transmitter that you are But not what direction the transmitter is in So you draw a circle around the point where you're at And somewhere on the edge of that circle is where the transmitter is going to be Once you've made three measurements you can draw three circles And the place where those three circles intersect is the place where the transmitter is going to be located Triangulation on the other hand is where you have a bearing that is to say a direction of the signal But you don't know how far away the signal is With triangulation you get two readings with a bearing with a direction And then you can make a triangle with one line between the two readings And the other two sides being the direction of the readings And where those two directions intersect is where the location of the tower will be So triangulation is good if you have direction but not distance And trilateration is good if you have distance but not direction For trilateration you only need one omnidirectional antenna But for triangulation you either need three omnidirectional antennas with all of their clocks synced So that you can actually measure the angle that the signal is coming from Or you need a directional antenna that's constantly spinning So that you can figure out which direction it points has the strongest signal And that's figure out the bearing Given that we figured most people running this would only have one omnidirectional antenna And not a spinning antenna with three clocks synced antennas and thus three clocks synced radios We figured that trilateration was our best bet So finally we look for anomalies and what are we looking for in terms of anomalies? We're well looking for things like cells that move over time Cells where the signal strength changes Cells that aren't where they should be In other words cells that are here and also across the city Cells that change parameters Suddenly this E-node BID is broadcasting a different country code or a different network code Or suddenly it's broadcasting a different bandwidth or something like that We're also looking for cells that are missing some of the more obscure parameters in the SID Or higher SIDs and we're looking for new cells that are showing up And again it's important to mention here that just because we find an anomaly It doesn't mean we've found a cell site similar. We actually need to go verify it If you know anything about 4G attacks and know how they work You might be thinking at this point But there's a lot of heuristics that you could have If you could actually connect to the tower And that is true There are a lot of really cool heuristics that we could get If we could connect to a cell We could see if we got a reject message or we could see if it accepted us Either one of those might be interesting We could see if it was missing some of the higher level or more esoteric parts of the LTE stack Or there's all sorts of things we could measure We could see how many paging messages sending out Or how many other UEs are connected to the cell But all of those would require connecting to the cell And connecting to the cell requires transmitting We thought it'd be a great idea until the EFF lawyers pointed out that that's illegal Because we're using a software-defined radio It's not actually licensed to communicate to transmit on these cellular bandwidths Whereas your cellular modem in your phone is licensed to transmit on those bandwidths So we can't transmit on those bandwidths without violating the law And we don't want to go to jail So we decided not to transmit But despite that, we still got some results So what we've found so far Our first test was at the Dreamforce conference, which I mentioned previously With my colleague Dave Moss Me and Dave spent all day running around downtown San Francisco And for those of you who aren't familiar with Dreamforce, lucky you Dreamforce takes over all of downtown San Francisco And there's sales people running around everywhere We wandered around the main park where Dreamforce was happening And we noticed this little cluster of suspicious cells here on the park Near where the event was taking place So we started walking down Third Street And getting to the point where we thought the suspicious cells were And we were thinking, hey, yeah, I think it's probably right about here When we looked up and saw this giant black truck with a satellite dish on top of it The satellite dish was pointing at a building about a block away That had a couple of cell antennas on top of it That we had noted previously After looking at the truck, looking up the company that was listed on the side of the truck And talking to the guys in the truck We determined that this is in fact a cell on wheels And not a cell side simulator A cell on wheels is a portable cell tower That people bring out, companies bring out To expand the cellular capacity in a given area Usually for large events In fact, there was even one at Staten Rock We don't think that this was a cell side simulator And in fact, cells on wheels are pretty common But they have some interesting similarities to cell side simulators Namely, in that they are a portable cell That shows up that isn't usually there It's suddenly there and then leaves And that they are acting like legitimate cells The main differences are that they're not actually trying to exploit Any of the characteristics of the 4D network And the people operating them are probably not using them to spy on But we still think that this is a successful test We were able to use our heuristics to find a new cell that had just showed up And we were able to use our map to actually track that down And see what it was If we had just been using an app Maybe that app would have called this out Maybe it wouldn't have And even if it had called it out We wouldn't have known what to go look for Or what it might have been So we considered this a success Earlier this year we did a second test At Shmucon in Washington D.C. So I loaded up Crocodile Hunter On a Raspberry Pi running around Shmucon With it in my backpack for the entire time And what we discovered at Shmucon Was two really interesting sets of two different EnoBs That would occasionally broadcast Instead of the country code and network code of 310410 Which maps to USA and AT&T Would broadcast a completely different country code And a completely different network code Looking into it further The first one was broadcasting on the same ERC As what we think is the legitimate tower But would broadcast a different MCC and ANC Of 350 and 490 350 is the country code for Bermuda And the MNC 490 is not used by any network in Bermuda In the US it's used by Sprint and T-Mobile But again this is an AT&T network It was also broadcasting the same physical ID But a different sector ID And a different tracking area code So we find this really interesting In another instance There was another EnoB Broadcasting on the same ERC As what we think is a legitimate EnoB This time broadcasting a country code of 308 For Saint Pierre and Michel-Van Which if you need a point of reference These are a couple of small islands Off the coast of Nova Scotia I was also not aware of them Until I looked them up for this talk And the network code 451 Is not used by any network For anything ever anywhere in the world This network was also broadcasting The same physical ID And in this case would broadcasting The same sector ID as the legitimate tower And the same tracking area code as the legitimate tower So these were really interesting Unfortunately, as I said Was running around with the crocodile hunter In my backpack and didn't notice These results until after the fact So I didn't get a chance to go track them down So hopefully in the future We'll find something like this And actually get to go physically work for it We do have an ongoing test though Our partners in Latin America With the fake antenna detection project I have previously run around Mexico City And other places with sea glass And have gotten some really interesting results there And are planning next to run around there With crocodile hunter and see what they can find And I'm really excited for what they will find We also have partners running Crocodile Hunter in Washington DC And in New York City And we hope now that the project is open source That you'll want to run this in your hometown as well In the future We hope to get better heuristics For crocodile hunter Some of the heuristics I have right now aren't great And I think that there are other ones That we could do, we have a lot of ideas We also can improve these Once we get a better sense of How it captures and sells sites And others are operating in the wild Speaking of heuristics We actually get a lot of readings We think that we can start to do some machine learning To build a classifier for what Towers are behaving normally And giving normal characteristics And what towers are suspicious Maybe in ways that a human wouldn't notice I also want to get better location finding Right now my location finding Can sometimes be about 50 meters off And that's not great It's still pretty close and I'm okay with it I think it's good enough But I would like to get it much better But we need better We need better distance estimates Which is beyond my math and physics knowledge Unfortunately And the other thing we need is We want to port it to cheaper hardware Like I said the Blade RF Will run you about 500 bucks We think that it can work on the Lime SDR Which is cheaper at 250 I would love, I mean my dream Is that it would work on the RTL SDR Which costs like $20 But I'm not convinced that the RTL SDR And a Raspberry Pi Are actually powerful enough Or have the bandwidth to do what we need them to do So that's still up in the air And finally what's with the name Well, you may remember That one of the brand names For a cell-side simulator Is the Stingran You may also remember That the Stingran is the animal That finally killed Steve Irwin The Crocodile Hunter We named it Crocodile Hunter to press F For Steve Finally, what can we do to stop Cell-side simulators Well, we can start by Having a toggle On iOS and Android To turn off 2G support One of the main attacks for Native 4G cell-side simulators Is to use that pre-authentication Area to downgrade your connection To 2G and once your phone Is downgraded to a 2G connection You can do things like Inspect content Or do passive attacks to decrypt The messages between you and the cell tower Or they can emulate a 2G Base station So your phone still supports 2G And the reason for that There's a good reason for that It's because many people in the world Still use 2G cells As their primary form of communication And lots of 2G networks are still up So You can't just decycle 2G by default But what they could do Is build in a toggle for users Who are concerned about this To be able to turn off their 2G radios If they wish And we've written a blog post that encourages Them to do so The main thing we need to fix though Is these pre-authentication messages All of the messages that happen After your phone connects to the tower But before the authentication starts And that's a problem Not just in 4G But in 5G as well There's a pretty interesting proposal For Covering All of the messages Or authenticating all of the messages Between the tower and the user equipment With TLS There's a pretty good paper about this And it will be linked here In the notes for this presentation That proposes a way And it's still in its infancy But we really think that long-term That's the solution But that's going to have to be Implemented by a standards body Such as the 3GPP And the 3GPP is the standards body That makes all of the standards for cell members It's also going to have to be implemented By carriers, manufacturers, and OEMs And we need more incentives For the standards or the carriers And the OEMs To care about user privacy Right now It often feels as though user privacy is an afterthought And connectivity is really The most important primary goal Of these organizations And We need to change that The 3GPP costs Several tens of thousands of dollars To get a seat on And as such, there are no representations From civil society, from privacy organizations And non-profits, and that needs to change None of these solutions Are going to be foolproof, of course But we're not even doing the bare minimum yet And I think that we should be doing at least that So, what do I want you to take away from this? Well, we have a pretty good understanding Of the vulnerabilities in 4G Which commercial cell-side simulators might exploit And if you want to read more about that As I really highly suggest you read Yama's paper You've got to catch them all None of the previous MC catcher detector apps Really do the job anymore Steglas Could certainly still do the job But we're not doing the bare minimum yet Could certainly still detect Older MC catchers But none of them are able to detect newer MC catchers But we've come up with a method Similar to established methods But targeting 4G natively And we think that The worst problems of CSS abuse Can be solved with a little bit of elbow grease And a lot of politics Finally Thanks to the following people Yama, of course, I couldn't have done this project Without her and she did so much amazing work Thanks so much to Yama And please buy her a virtual beer Or just challenge her to a game of dance dance Revolution if you see her Of course, thanks to the Holy FF crew And especially Threat Lab Who have been a huge support through all of this Huge thanks to Andy and Bob at Wiggle For a lot of programming help And a lot for giving me unfettered access To their API Thanks to Roger Piquero-Sovere Who is one of the smartest people In the world about cell networks And a lot of advice and a lot of encouragement Thanks to my test crew Nima Fatemi with Candid And Surya Mathew and Simon from the Markup Simon Faundry-Tiedler Thank you Carlos with the Fade Project And everybody else involved in the Fade Project Thanks for running Procter Hunter In South America Carl Kosher and Peter Ney and others At the University of Washington Who authored Sea Gloss As well as giving me tons of advice Tons of support coming out to Stanley Rock With me, really fantastic people And of course, thanks to Ash Wilson The author of Sidge and Eric Escobar Defconn Justice Beaver Who also gave me a lot of inspiration and advice And last but not least, thanks to Crispin Padgett For doing all the original research on cell-side simulators And really paving the way for hackers To start looking at these And also, thanks for the Nokia phones, Kristen And finally, thank you for coming to the top


Hi, this is your host of Limhartia and welcome to a brand new episode of our series TfHire topic of the month a.k.a. T3M and this month's topic is platform engineering is DevOps there and our guest today is Joe Duffy, CUN founder of Bloomy. Joe is great to have you on the show to discuss this topic today It's great being here. Thank you Before we jump into this topic I would ask you what kind of culture shifts that you're seeing are only happening used to talk a lot about DevOps I think one key common trait is especially in the innovative Organizations, they're applying a lot more of an engineering approach to the way they approach their platforms and the way they approach their infrastructure they think with a software engineering mindset versus, you know, maybe a Couple decades ago, we would think more about, you know, scripting or point-and-click, you know, click ops sort of solutions We definitely see people building systems using software engineering And related to that empowering developers like putting them in the in the driver seat But with the right guardrails the platform team puts in the guardrails because you know, hey a developer may Not know all the ins and outs of how to configure, you know database So it's not accessible over the internet or they might not know how to run their workload most cost effectively That's where the platform teams experience and their expertise still empowering developers but With the right sort of guardrails in place I think is a key challenge and and trend that we see as well. How would you define that for me new thing? I think platform engineering is Really a new new trend that we're seeing Especially in large organizations where you need to have a center of excellence for how you do cloud infrastructure Cloud engineering best practices and the platform engineering team typically sits between maybe this the operations more IT centric folks and Developers and their goal is to really be like I said center of excellence establish best practices put in place the systems That allows the organization to scale and ultimately just empower the rest of the organization to ship faster With confidence compliance cost controls all the things necessary in sort of a modern enterprise Looking to go to the cloud. How different is platform engineering from DevOps or let's also say as sorry if you make a win diagram Are they overlapping or they are totally different, you know, it's fair on their own I do think they're slightly different, but they're they're very much related. I think platform engineering sort of grew out of the DevOps movement and you know DevOps was all about applying engineering discipline to the way you're doing operations And sometimes putting developers more in the driver seat and platform engineering just takes that sort of to the next level We see a lot of different configurations for how teams do platform engineering and not everybody does You know some folks and that's where SRE is very common You know if you're just a back end service team, you know an amazon style two pizza team Let's say you may not have a platform team You may you may not need one it may be more distributed than centralized And in that case, you may have an SRE a site reliability reliability engineer Whose whose job is to be embedded within that service team and make sure there's operational excellence and And that's sort of model. So we see a fair bit, you know Of difference between the ways people approach it and frankly the way they approach it over time You know what works for you as a small organization a small company Maybe totally different than once you get to the scale of thousands of of employees A lot of these labels are used we talk about super cloud that we talk about, you know But in the ground reality since you also deal with customers They try to solve their specific problem And that's why either they need the teams or they need products, you know That from unique can be seen as a product or said DevOps can be seen as a practice We look at SREs. So what is happening in reality? How much of these labels actually matter? What kind of you know, cultural transform is actually going on The reality is platform engineering is a real thing, you know And we've seen an acceleration in teams moving to that model And I think it's for a few reasons one, you know, the complexity of the cloud is just growing day by day Especially for organizations that have to do multi cloud or maybe they're thinking about kubernetes or CICD for their not only applications, but also their infrastructure There does need to be a center of excellence for how that gets done in a large organization But another trend we see that that is Putting pressure on teams to adopt platform engineering is is empowering developers to be more in control of their own destiny To have a way to self serve the infrastructure So if a development team needs a new database or a new microservice environment They don't have to file a ticket and wait for days or months They can just go self-serve it on demand as they need it and that's really important in a modern organization especially if the cloud is part of The product, you know If it's a large-scale product like you look at something like snowflake You bet they practice, you know Something that looks like platform engineering and they do empower developers and that's definitely Increasingly common not just in these innovative new companies, but also in the fortune 500 and global 2000 as well How would you define developer experience in today's clouds and the cloud world? Yeah, I think there's a lot of different kinds of developers in the world And so there's not just one developer experience that I think about But I think about, you know, put yourself in the developer's shoes. What what are they trying to build? You know, they're the ones that are creating end user application value They're they're shipping value to your customers. So if you put yourself in their shoes You want to just make them as productive as possible doing that thing You know adding business value and sometimes that's, you know Back-end systems engineers that are building distributed applications that are comprised of containers and serverless In that case, hey, make it easy for them to spin up new microservices Don't put unnecessary bottlenecks in the way a good developer experience is really just getting out of the way And letting the developer accomplish what it is they're trying to accomplish That but that's so in that case you might give the developer A way to consume infrastructure using infrastructure as code However, maybe your developers are front-end developers or full stack. They're building, you know Angular apps. Well, in that case, maybe they don't care as much about touching the infrastructure There's a lot of different kinds of developers in the world You might you might have actually both in your organization. So there's not one size fits all I think developer experience to me is all about just Making developers life as easy as possible making them productive and help helping them get their job done faster What should be the right approach? What would your advice then people hear these terms? How they should approach it that hey, we need to embrace it not embrace it. We don't even need any of that Yeah, it's a good question It's very difficult too because you know, there's it seems like especially in the cloud space There's a new AWS service shipping almost every week and you know a new term like platform engineering coming up You know every every year or so and I think the the key advice I would give is These things were created to solve problems and it's important to identify Do you actually have the problem that these were invented to solve? Before just going and blindly applying it, you know platform engineering Like do you need a center of excellence because your organization's at the scale where it makes sense to centralize that expertise You know kubernetes, are you trying to ship containers? You know and scale them at high velocity with reasonable levels of complexity Likely across many environments and potentially multiple clouds. Okay kubernetes It's probably a good solution for you But I think it's important to just distill it to to first principles and then assess Do I actually have the problem that this solution was created to solve? And if not, it's okay to kick the can down the road and and revisit it, you know over time Like I said, what works at certain scales stops working down the road and that's okay And I think it's important to kind of assume that change is constant Because you will have to evolve and adapt the topic is you know platform engineering is DevOps that Last year at coupon. Also, there are some boots, you know, which DevOps is that What is your opinion is DevOps really dead? Can it really die? I think absolutely not. DevOps is alive and well I think platform engineering was really born out of DevOps and in fact, if you were to draw a lineage I would say platform engineering is heavily derived from the DevOps practices Um, and I think it really inspired the way we approach platforms in some sense It's sort of DevOps taken to the next level Um, and you know, maybe we'll use the term differently going forward You know, I think you'll see people emphasizing platform engineering, but in terms of DevOps being dead like I don't foresee DevOps days going away anytime soon I think people are still going to use the phrase for many many decades to come And I think we all should be thankful for DevOps Instead of sort of throwing it under the bus prematurely Is my take Joe, thank you so much for taking time out today and talk about this Interesting topic and thanks for sharing your insights. And as usual, I would love to have you back on the show. Thank you It was great. Thanks for having me


Welcome back. Thank you for staying with us. If you are just joining your own time for the first conversation of the day after the great banter that we had with my co-host. So today we are going to talk about something that is close to the heart of youths and this is on matters employment. So how can we create sustainable employment, not just in type of employment, sustainable employment and wealth for the youth. And for this we are joined by Anthony Kierori, head of the NJG team. He is the CEO of Green Pencils Ltd, Green Pencils Ltd is the company and he is here to tell us the 1 to 3's on how to do this. We need to know how we can get a sustainable employment as youth and get to wealth because that is the goal for most people, at least if not everyone. Yeah, Karim Wussana, glad to have you with us. Thank you very much Stephanie. I'm here to be here. Okay, and speaking of what you do before we get into the topic, Green Pencils Ltd, today is World Environment Day. Indeed it is, the World Day. Yeah, you'd be the right person to comment something in it. What about saving the environment? Basically what we say is, let me say, at Green Pencils what we do, we convert paper to wood to make pencils. Why? Two reasons. One, in Kenya you're not allowed to cut trees to make pencils. So all wood and pencils are imported. So when we are buying imported things, basically we're exporting our money and our jobs. Yet paper comes from wood. Yes, so why not convert paper to wood? So that's what you do. Second thing, this has to do with climate change and the environment, which is as today is the World Environment Day. When paper decomposes at the landfill site, it forms methane gas. Methane gas is 25 times more poisonous than carbon dioxide. So when you're fighting climate change, it makes sense, logical sense, to try to prevent paper from reaching the dam site. Especially when you consider that about 26% of waste in landfills all over the world comprises of paper and paper waste, paper and paper wood. So 26%, that's a quarter. And then it will form methane gas, which is 25 times more poisonous than carbon dioxide. So it makes sense to prevent paper from reaching the landfill sites. That's why we come in. Oh, amazing. Eco-friendly pencils, amazing. So now, getting into the topic of the day, I want you to take us back. The foundation of this is that last week, you went to present as a departmental committee. Financial national planning. Yes. And you are giving reasons why changes needs to be done to the finance bills to suit cannons. So maybe you can share with us this. Yes, very good. As we start, let me ask you something. People say the sky is there. The sky is the limit. Well, I, Antoni Kerori, say the sky is my playground. Welcome on board. Okay. Very good. Now, first let's mention, it's good to note that the someone who's going to cut, suppose the cut rules in favor of the petitioner, whoever's going to cut. What happens to the finance bill?  And then, I like working with facts and figures. To me, I think the way the finance bill is structured right now is not correct. And it needs to be changed. First, it's good to point that, apart from King Solomon, nobody else had as much wisdom. So even the president needs advisors. He needs to listen to other people. Now, whoever he's working with, if given that opinion, it's good to come up with a plan B. So that's what I presented, a plan B. Now, let's look at a few figures. In Kenya, first of all, Kenya is, our country is very blessed with resources. A few weeks ago, about a month ago, we were told that Kenya has got over 900 minerals. And we have a lot of natural resources. Kenya is really blessed with natural resources. However, if you Google or you check on the countries that have minimum resources or non-natural resources, you'll find Vatican City and Costa Rica as one and two. But in the least, you'll also find Japan, Singapore, Belgium, Switzerland, among others. If you go to any road in Kenya or any parking, most cars that are parked, they're from which country? They're from Japan. And most cars are from Japan. They don't have any natural resources. Now, what does Japan do? Because they know they don't have any natural resources, they come to a country like ours, Kenya, and then they buy our iron ore at $75 per ton. That's about 10,000 shillings per ton. So two tons, they spend 20,000. They'll get about 60% to 65% of steel from that. So two tons, they'll get between 1.2 to 1.3 tons of steel at 20,000 shillings. 20. They'll go and make at Yotara 4, which will come back here and we'll buy it at 5.5 million. Wow. Let me ask you, who's the brighter one there? Who's the smarter one there? Japan, of course. Who's the smarter one? Japan. What's the opposite of smart? Full. So who's... Well, you don't say it's large. But we know, right? Yeah, it makes a little sense. Yes. So what I told the Finance and National Planning Committee, since they are part of parliament, and parliament is what makes laws, they should make a law whereby as a country we should no longer export our natural resources, our raw materials, I mean our natural resources in the raw form. For example, like the iron ore, we shouldn't export it that way. Instead, build steel industries here. Let's start with simple things like spoons, but at the same time as you are doing that, let's keep an eye into the future. Do you know that in Britain, in the UK rather, come 2030, no matter how rich you are, you will not be able to buy a petrol or diesel car in the next seven years? Because they are going electric. Exactly. So now that we have the raw materials, this gives us a few options. One, we can either work directly with the engineers there. Two, we can work with Tesla. Three, Kenyans are very innovative. The government can come up with a challenge, with a program whereby if any engineer, anybody can design a car, can develop something that is either electric or uses other form, maybe water, hydrogen, whatever it is. As long as I know whatever I think about can be implemented, trust me, I mean we are not only bright enough that it's only a person that could have come from Kenya. We have great minds. Yes, we have great minds. That's one thing that we need to do and that will create a lot of wealth. And it's also sustainable. Let me ask you. These one million houses, we have been told they will create about 1.6 million jobs, right? So let's say this room we are in is the one millionth unit to be built. The last one. And the people who are building it finish it today. What happens to the 1.6 million people tomorrow? They become jobless again. Back to zero. Someone can say, we'll build another million houses. Okay fine, we'll build. But eventually we reach a place where we don't need to build anymore. No more houses can be built. They finished the very last unit that day. What happens the next day? Is that sustainable? No. It's not. I like working with facts and figures as I mentioned. And I've just talked about Japan and Kenya. Let's look at the figures. And it's important that we make wise decisions. Our GDP per capita in 2019, I'm choosing to work with 2019 the year before corona, was 1,970.11. GDP per capita for maybe a viewer who may not understand is all the money in the country, all the money made within the country, divided by the total population. So all the money made in Kenya, if it was to be divided by all Kenyans, every Kenyan would have received $1,970 for the year 2019. Divide that. Now we need to change that into Kenya shillings. So we multiply that by 130. And then we are paid on a monthly basis. So divide that by 12 months. That comes to about 21,000. Per month. Per month. Every Kenyan. Yes. Now let's say I'm a Kenyan. And I am a Kenyan. And where I am, God has blessed us with a lot of resources. So my lifestyle is 21,000 shillings. Now you are, I'm not a Japanese, but let's assume you are Japanese. Where you are standing, you are sowing your ground, zero resources. It's only helping just to keep you up. That's the only what the ground can do. Yes. It's just holding you. Nothing else. Yes. There is a common resource that we share. Brings. So yes, everyone has them. But you've used your brings in such a way. The GDP per capita for Japan in the year 2019 was 40,458. If you multiply that by 130 to combat Kenya shillings, divide that by 12. I think it comes to about 400,000. That's over 400,000. 400,000 per month for someone. So Stephanie, let me ask you. I have all the resources that I have. I'm leading a lifestyle of 21,000. You have zero resources, only brains. Only brains. You've structured the cells such that you're leading a lifestyle of about 400,000. How will you look at me?  Like this is a fool, you know? You're not using your brains. You can laugh at me. In my face. Exactly. Because you can use your brains. So that's the situation. And maybe forgiven for this. I felt very embarrassed the other day when the Japanese Premier came here. So what do you think him and his delegations were feeling or thinking when they met the Kenyans and they saw us? I know. It doesn't make sense. So as I said, it's important we make sure we use facts and figures to make the wise decisions. Let me give you another practical example. I've talked about natural resources. Now let's go to the agricultural part of it. In 2021, Kenya, we were the sixth largest producer of avocado. I think we produced about 471,000 tons and the country earned 14.48 billion. That translates to 35 shillings per kilo. Okay. Yes. And unfortunately, the other day last week in the news, I saw farmers complaining that they're only getting 54 shillings for their coffee. And so they're uprooting the coffee. They've touched shillings per kilo. Per kilo. So they were complaining it's not enough to pay them. So they're uprooting the better plant avocados. But as we were growing up, we were told our coffee is the black gold. That was our black gold. And our coffee is unique. Is our avocado unique? No. It's not. But our coffee is unique. And now, in the 80s, we were doing over 130, 140,000 tons. In the year 2021, Kenya produced 43,308 tons and we made 33.08 billion. Note, avocado is 471,000 tons. Coffee 43,000. 43,000. Yes. So avocado, we produce more than 10 times the coffee. But coffee, out of the 43,300 and 8 tons, we made 33.08 billion. That translates to 764 shillings per kilo. So Stephanie, let me ask you. You're the Japanese, eh? You see me uprooting my black gold coffee, which is giving me 764 shillings per kilo. To buy 35 shillings per kilo. Doesn't make sense. Doesn't make sense at all, at all, at all. Wow. We've just been emotional and we're just, let's put it, as you said, we've just not been bright. So it's time we need to be, to change. Now, the effort the president is putting, the executive is putting on this housing issue. If they were to put that in coffee, things would change. As it is right now, our farmers, they normally get between 2 to 3 kilos per bush, per tree. As opposed to 30 kilos per tree. Now imagine if the president, if the government was to try to help the farmers, let's raise this 2 to 3 kilos, first let's, our first target, let it be 10 kilos. Then go to 15, 20.  Small farmers, eh? They're over 800,000 of them. Imagine if government was to try to help them to raise the production from 2 to 3 kilos to 10 kilos. What will happen? This is about 3 to 5 times what is being produced. Let's just assume each farmer employs an extract to people. Not more, just 2. Yes, and then there are 800,000 of them. How much will that be? 2 times 800,000. 1.6 million jobs. Wow, we've gotten to the 1.6 million jobs that the houses are trying to create. Exactly. This is more sustainable. And then, apart from helping the farmers raise the production from 2 to 3 kilos to 10 kilos, and then 15 kilos to 20 kilos, that will mean more people are still being employed. Another thing the government needs to do, they need to set up a structure whereby the farmers are allowed to sell their coffee to anybody and everybody. This current system we have is what the British left us with. Whatever system we have is not working. Clearly. It's not working at all. And that's why our production has dropped from 130,000. Now we are doing 40. I'm sure this year it will even be less than that. Yet this is our black gold. At least our coffee, we are the kings. We can pride ourselves. Just like the way if we keep going the other day, we won the 1500, and we are happy, our coffee, we are second to none.  Let's be blunt. Bad decisions. Bad decisions. So we need to change. Stop making these bad decisions. And then, apart from that, let's say you're a government and I'm the farmer. Now, the government needs to collect taxes because they need to pay the debts and they need to run government. Instead of just quizzing every last coin from us, I believe the approach they should take is to first enrich us. True. See how to make us rich. Once we are rich, it's easier for us to pay taxes. Since I talked about the coffee example, let's continue with it. Right now, coffee harvester, they normally, when they go to pick the cherries, they normally use 20 kilo containers, the debest, and they normally pay the 100 shillings per 20 kilos. So that's about five shillings per kilo. Good harvester can harvest about five of them and we'll get 500 shillings. Now, our farmers, as I mentioned, they have been paid 54 shillings per kilo. Good quality coffee. If you go to the supermarket to buy good quality coffee, the premium coffee, it goes for about, the last time I checked it was 1,620 shillings for 100 grams. 400 grams. 100 grams. So a kilo, that's 16,200 shillings. Stephanie, you are planting coffee, you are paid 54 shillings per kilo, either broker or the person who's adding value to it. If I'm done who's adding value, I send some brokers to buy from you, you get 54 shillings, I go, I process it, I sell it at 16,200 per kilo and pay 54 shillings. Very unfair. Exactly. So, yes, and it's said that one of the greatest reasons why evil succeeds is when good people choose to do nothing. They keep quiet. Exactly. Now here, the good people should be our parliament because they don't want to make any laws. So they should make laws such that you as a farmer, at a minimum, at least earn 25% of the retail price of the coffee. True. So out of the 16,200, at least get 4,000 shillings. Exactly. That makes sense. Makes sense.  You would definitely be overwhelmed by it, you wouldn't accept. Yes. But now you as a farmer, I as government, I structure the law such that now you are earning 4,000 shillings. It'll be easy for me to be happy.  That would be fine. Won't you be happy? Exactly. And you'll grow more. Exactly. And then if you grow more, you employ more people. You harvest more. I get more. Governments get more. So everyone's happy at the end of the day. Yes. And then, apart from, you know, as a farmer getting the 3,000 shillings, governments should structure the law such that even the pickers, the growers, the laborers, they should earn something from it. So instead of earning 5 shillings per kilo, let's say for the harvesters, at least let them earn 100 shillings per kilo. So a 20 kilo container, instead of earning 100 shillings, the person will earn 2,000 shillings. So if they get 5 debes, 5 containers, 2,000 times 5, 10,000. That's 10,000. That's good money. So now imagine you're earning first 500 shillings. Then government structures it such that now you're earning 10,000 shillings. Then they tell you, give us 25%, give us 2,500 as tax. Why not? It will be 7,500. Yeah. That would make sense. It makes a lot of sense. Yeah. So we are poor out of choice. Yes. It's by choice. It's by choice. Because we have all that we need. We have all that we need. All we need is just to make the right decisions the right way. I know government is pushing for this house in Levy and the finance bill the way it is. And maybe they sat down with the advisors and they thought that is what is best. But I'm sure if they listen to the people's heart, people are crying. People are not happy. And people have solutions like you do have solutions. Yes. So now that's what you say. Now go to plan B with Anthony Kierori. Okay. You have the plan B. Yeah. Let's look for the plan A, the finance bill as it is. So why don't you look for the plan B? Plan B. And then you look at what makes sense. Imagine if for instance, and this is just coffee. I'm only talking about it. We reached a place whereby we are, every bush is producing just 20 kilos or 15 to 20 kilos. From 2 to 3 kilos, if you reach 15 to 20 kilos, how many people will be employed? And then now you as a farmer, you allow to sell to anybody and everybody. Do you know why that is important? Yeah. Our coffee is the very best in the world. What will happen, the Americans, the Europeans, the Asians, the Australians and all the people who have taken coffee, they will come to Kenya to buy it from the farmer. Directly. Yeah, directly. So what happens first to what you are doing in the industry? We boost it. We already boosted it. Then when they come to buy, what happens to the price when the demand is high? It goes up. It goes up. No, more for us. More for us. Yeah, makes a lot of sense. It's a win-win. Yeah. However, when I was presenting to the committee, there's someone who said that the finance and national planning committee, these things might take about a year or two. What happens in a year and now? What can we do tomorrow? To the air. Yes. There's something called the preferential procurement master role. This is a list of 334 products that the government identified, the Kenyan government, it made a list of 334 products made in Kenya. Yes, this was on, I believe it was 8th of July 2020 during the time of Corona. And then the head of public service at the time directed all state and public agencies. That's basically government. They should exclusively procure, exclusively buy the 334 products. That is none of those products should be imported because their capacity has been exhausted. It's a beautiful idea, but we did not implement it. Or let me rephrase it, since I'm not in government, the government did not implement it. This is something they can implement, they're resuming when tomorrow. So by next week or this month of June, they can implement it. Why is it important? I have looked at that list. There are some companies that are, there are some products in that list that you find only being made by one SME manufacturer. What does that mean? If that company stops making whatever product it is, there's 100% importation of the same. Okay. Yes. Now if government was to support such an SME manufacturer, this small manufacturer will grow either into a medium-sized or a large corporate employing very many Kenyans. Many people. Yes. And every time, and then this tilts our balance of trade a bit more to our favor because we'll be now producing, the government will be using what is locally available and therefore, you see right now, our balance of trade is negative. We import more than we export. Export, okay. So even if we don't export, if we can manufacture locally, we're reducing on the importation. So that's good for us and it's also creating jobs for us. The government can implement the preferential procurement master role immediately. That's an immediate win. From July. That would be an immediate win. It's an immediate win. Another immediate win. I remember a few years ago, not so many, maybe two or three, I saw in the news, people complaining, these were senior people, senior politicians, that that time they were, should I say in the opposition or the end government, that the government was getting very expensive loans. Instead of going to citations that will give them one, two, three percent, they're going to citations that will give nine percent interest. And they alluded to something like a kickback. Now that whoever in government are in government, why don't they identify the very expensive loans? And then let's say it's two, three, four, five trillion, out of the eight, nine trillion debt that we have. And then get the same from institutions that can lend the same amount at lower interest rates. You know one percent from a trillion is a lot of money. I think that's ten billion saved. Yes. So if you get come from nine percent to maybe three percent, that's six percent, that's sixty billion. Sixty billion is a lot of money. How much was the expressway? I think around the same amount. Yeah. So you can help me expressways. Or at least many roads can be built in many other places. Just from getting just at a smaller rate. Just a smaller rate. There are very many things that can be done. Yes. So wow, this is very interesting. You know just looking at what we have internally and making the most out of it to increase, you know, a production, create employment. And eventually that will lead to wealth creation. Yes. I believe. We talk about wealth creation. What actually is wealth creation? What does someone get to a place where they're wealthy now? For you to be wealthy, you first need to be rich. And then the surplus becomes your wealth. Okay. Yes. Now government here wants, I'm going back to government because they are core. They are central in creating their wealth. The resources at the end of the day, who makes the decisions on how they'll be used? The government. It's government. So that's what I'm going back to government. So all I'm simply saying is we have all we need here. All that is required is the proper utilization. And then right now we are complaining. I mean look at the figures that I said. We are living a lifestyle of 21,000. With all the resources that we have. Last week, farmers were complaining. I saw in the news that they grew their coffee and now they've been paid 54 shillings. What is that? So they said we better approve to this. Coffee. Then in another clip I saw someone says another plunder of avocado is like another neighbor of mine did. Get profit. Of 35 shillings. So when you look at the bigger picture, it doesn't make sense. But central to this is government. So for us to be wealthy, first we need to be rich. For us to be rich, we need to make the right decisions. These right decisions need to be based on facts and figures. We need to make deliberate decisions based on facts and figures. And also we need to note nobody has a monopoly on wisdom. Nobody has a monopoly on intelligence. So we should not belate the government or hit them that they are making bad decisions. Of course the government, the president, he must have his own advisors. And they've done the best that they can. And the best that they can, we've seen it as the finance bill. And maybe when they are crafting it, it made a lot of sense to them. But... Common money. Common money. That's not for you. We too need different backgrounds. Things are different. We haven't been here but guys are the ground. A suffering. Now it's a shame that we are suffering. And we have so many resources. So many opportunities. But the way I've seen the government, it's thinking in terms of how much more do you have? How much more can I remove from your pocket? How much is in this pocket? How much is in your handbag? What have you left at home? How much? I'm coming, you know. And the KMS have really made memes out of it, especially the youth.  People are really crying. So the government just needs to tilt, change a bit, make us rich. And then it's okay to tax us. Because we'll have... We'll have more than enough for you to take. We need also to be a bit careful for people. For instance, how much do we have so that I know whether I should continue? Well, my producer is yet to tell me that I think we have some minutes, a couple of minutes, maybe 20. Oh, good. The former governor of Makueni, he built the Makueni hospital. It costed I think $235 million. And it was a big, big, big hospital. There are 290 constituencies in the country. Do you have a calculator there? Let me get quick. So that Makueni hospital, it costed about $13 million. And it's a very, very big hospital with 200 bed capacity. There are 290 constituencies. $135 million, let's change it into billions is $0.135 over billion to make it easy. Okay. So $0.135 over billion $0.135 $0.135 times 290 constituencies. $290. That's $391.5. Billion. Okay, good. I want us to see how much a trillion is. So if you look at the things that government needs to provide, hospital is one of them, education, roads, and should we say water? Those are four core things, right? So that came, you said it came to how much? $391.5. $391.5. Let me save that figure for you. $391.5, then so every constituency can have such a hospital. Not county, every constituency can have such a hospital. Right? Okay. Then imagine if you were to build schools of the same amount. So just multiply that by 2. Times 2. Yes. $783 billion. That's $783 billion, yes. And then there are 290 constituencies. Let's say every constituency we invest a billion for water. Okay. So I multiply that. No, no, no, you add $290. Sorry. $290. So that's basically a trillion, yes? Yes, yes. And then let's say we put every constituency a billion for roads. $290. That'll be 1.36 1.36 trillion. So just slightly above a trillion. And we have all that. Covered. Every constituency will have a hospital like that one. 200 bed capacity. Every constituency will have schools. And you know building a hospital is more expensive than a school. Yeah. So it will basically be bigger schools. We'll have dams and piped water in every constituency. Mm-hmm. And then we'll have roads worth a billion in every constituency. That is just one, basically a billion. A trillion. How much is our debt? $9 trillion. What happened to that $8 trillion? How was it used? Because in our constituency, where it comes from, we don't even have a level 4 hospital. Mm-hmm. We have got very few kilometers of roads. Mm-hmm. Many places don't have piped water. So... Where did it go? And this is just $1 trillion. So what happened to that $8 trillion? Wow. That's a question. So one thing the government also needs to do is we are talking about creating wealth. Mm-hmm. The reason why I brought this up is because the Auditor General for the last few years it's like he or she has been playing musical chairs, you know. Dancing a lot. Dancing a lot. What has he or she been saying? Mm-hmm. That the government, or as a country, we lose at least 30% of our budget. A third of the budget is lost. Basically, it is stolen. So that means out of $3 trillion budget, about $1 trillion... is gone. So government also needs, as they're thinking of creating wealth, you see, there is enough in this country, I believe there is enough for everybody's need, but not enough for everybody's greed. Wow. I love that. Thank you. There is enough for everybody's need, but not enough for everybody's greed. Yes.


Two weeks after President Balatino will promise to unify the nation's multiple exchange rates, the CBN has reportedly directed deposit money banks to remove the rate cap on the Naira at the investor's and expert's window of the foreign exchange market, to allow for a free float of the Naira against the dollar and other global currencies. We'll be taking an in-depth look at this on the breakfast this morning. Nearly 3,800 people died on migration routes within and from the Middle East and North Africa region last year. The highest number since 2017, when 4,255 deaths were recorded, according to newly released data from the International Organization for Migration's Missing Migrants Project. This morning, we're going to be looking at how the International Organization for Migration is fighting issues and endangering migrants. And we'll be taking a look at the front pages of some national dailies and up the press where we have an analyst join us to look at them critically. You're welcome. To the breakfast, good morning to you. I am Maureen Menomezidi. And I am Yamgoul Aguay. So glad to have you join us this Thursday morning. We're hoping that you're going to have a wonderful day. On the island, there were showers of blessings. I don't know what happened where you are, but here it was rain. When I was living in the mainland, it hadn't started raining. But in the course of my journey, it started to drizzle and then it began to rain when I got to the island. And you know how it is on the island. Yeah, we started seeing the rain when we got to as far as the Third Mainland Bridge. And you know what it means when it rains in Lagos. The traffic situation is always something else. It's crazy. So wherever you are, you have to leave now. If you were hoping to leave at eight o'clock or nine o'clock, you have to leave now so that you get to where you are. You need to get to the island. Most places are usually flooded or at least the water level. When you're going into the island, it's always really high. So wherever you are, you have to start making that journey right now. Yeah, but of course, if you're new in Lagos, that's when this information may really be very important to you. But if you're not new in Lagos and you don't know what to do already, you're your own. You're on the very long thing. All right, our very first tap trending today. Former Speaker Bajabi Amila has resigned from House of Representatives. Nyambu, yesterday you were asking the question. Has he supposed to be able to combine the two? Yeah, yeah, no. And he has done the needful. He has resigned. I just don't know why he had to resign and become the chief of staff. Is it because of loyalty to the president, Tinobu? Because he has been a very loyal person to Tinobu since 1999. Is it because of that loyalty or is it because we have now rated the office of the chief of staff, which to me is not as great as being a lawmaker, to that status where you can resign a one-time speaker, the immediate past speaker, resigns as a lawmaker that has been elected into office to come and be a chief of staff? I mean, what really is the importance of that position that someone will leave lawmaking to come and occupy? Perhaps the question is why is it important to him that he should occupy that office? That is the question. So maybe Nigerians have made. Why is it important to him? This is a very urgent question you're asking. And you've already preferred some of the answer to it. Is it because of his closeness, loyalty to President Tinobu? Of course, he and Delia Lakke have been with Mr. Tinobu for a very long time. And so you would expect that him being the president now, they would really want to rally around him closely, closer than being in the legislature while he's an executive. I think that's what's playing out. He wants to be in the executive with him, close enough to be as helpful as he possibly can. You know, I thought if you're placing your people in various places, strategic positions, you should put those that you trust also in the legislature and then other people in the future. Why did you think he made sure that Fabio was there? Okay, that's another thing. Why did you think it was all that played out with regards to the leadership of the National Assembly? He had vested interest in it. By the way, Fabio said something that is very, in small words, that the same things that Lawan said before he came, or when he came into office, that whatever law needs to be passed, whatever, they are not going to oppose the president. They are going to make sure that they pass the laws, that they need to pass. And the way he said it was just like Lawan was saying that there will be no opposition in any form. It is only the House of Rep Speaker that said whenever it clashes with the interest of the people, they are going to go against the executive. That's what the Speaker of the House of Representatives said, but Fabio seemed to give an open check to the executive that whatever comes, they are going to do it. And another thing that I wanted to ask, if we had a lawyer in the House who would have been, he said that if the fuel subsidy removal needs legislation to back it, they are going to give it. So my question to myself was, so it didn't have legislative backing, and he just went ahead and removed it. Is that supposed to be done? Is that legal even?  You didn't remove it the way you should remove it, because if it needs legislative backing, they shouldn't have removed it before it. But I don't know, maybe Fabio didn't know that it had legislative backing and all that. Let's see how it plays out. Well, the Independent National Electoral Commission, I think I'm moving from that to say that they will not have to conduct a fresh election to fill the seat of Femi Bajabiamila, who has just resigned from his own set. Okay. They need to do that. They will do that. Let's see how it goes. Will they use beaver? Beaver doesn't, it works for all the levels of offices. It's the presidency that people see. So it should work here. So Sir Larry Constancy 1 should be getting set for that election. So two seats were freed up because of the presidency of Asiwaju Bola Tinobu. One of them was where the wife, Remy Tinobu, used to be the senator. And now, Bajabiamila House of Rebs, that position has been freed up. So two Legos boys or two Legos girls. Oh, Legos boy and girl. I imagine that Mrs Tinobu would want a woman to fill in her space. Yeah, a woman filled in actually. One time deputy governor, what's the name again? But the one time deputy governor, I think under Amboudi was the one who took the position. So she's now the senator. Oh yes, I do remember. All right. So our second top trending, FG, to introduce tuition fees in universities. That federal government is set to introduce fees in federal universities, polytechnics and other tertiary institutions following the signing of the student loan bill. Well, a lot of people applauded the federal government for this loan thing until I read what the Asu president or Sodeke was saying about this whole thing. That the universities, as we have them now, do not have tuition fees as it is. Yeah, they have other fees and all that, but they don't have tuition fees. So if you're introducing loans, student loans and then introducing tuition fees, it might come to the point where students may not even have that kind of opportunity with the loans is supposed to give them to go to school. And if they do go to school, how is the repayment going to be? Are they jobs ready jobs that they can leave school and come and work and have the jobs to pay back? Is their data enough to follow these people and find out that they are working whether in the private sector or they are self employed and all that and all that. So it's a problem, which means it's like they say about the devil. He gives you the right hand and he collects with the left, or gives you the left and collects with the right. I'm trying to bring out a list that I saw in the course of the week. You know, this is not the first time student loan has been brought to forward in our space. As far back as, all right, I want to bring out. There's this list of defaulters way back when they executed the same thing student loans. So this time around, they have to remember, I did say we need to see the modalities of how this is going to play out. And so once we are able to get a look at, we've seen a bit of clarity. And I did say also, they need to create jobs, just as you have rightly stated. There is a need to create jobs so that when the students take these loans, they can pay back the loans. So but it would have been very, very nice if the loans are given to pay for the things that are required in the university now without having to introduce tuition fee, which is not in the university system right now. Because if you're introducing tuition fees and then you're giving loans, it doesn't really make any difference. We're finding it difficult to send our children to school or for people to go to school right now. And then you're saying you're going to help us, but you're going to give us a bill which we did not incur before now. So I don't know. Okay, let me read this. The Nigerian Student Loan Board is regrettably publishing the list of the, particularly of the following Nigerians who gave false address and names of non-existing guarantors to the board when they were students in their respective institutions of higher learning in the country for the purpose of obtaining loans. All right. And so the board hereby appeals to members of the public in general in the appropriate cases where the Nigerians have already been employed, you know, particularly in the list which have been updated, consist of whatever, up to March 31st, 1980. And so they gave a list of students who defaulted in paying back the loans they collected around that time. And so you have names of students in different tertiary institutions. You have those as far back as 1973, 1972. Yeah. This is not the first time we're having Nigerians being given loans to go to school. But obviously we need to work out the modalities, beef it up, make it more reliable and efficient in order to be able to get this, recoup the loans. Yeah. But it starts with making sure that they get jobs afterwards. So I imagine that the president who has reignited this would have also put in plan put in place or be planning to put in place measures to make sure that they get jobs, create jobs. Although we know that it's not the primary responsibility of the government to create jobs, but to create an enabling environment for businesses to thrive and create jobs. How are we going to get the data that it will, because loans in Nigeria have always suffered in terms of repayment. We've talked about the agricultural loans, the uncle borrower's program, how many billions were lost to that because people didn't return. We've talked about the trade and money that they were supposed to pay back and all that. Virtually nobody paid back and all that. So what's the reason? Have those things been addressed? I know that on the on democracy day, the president also signed another bill into law of data protection. All right. Excuse me. Data protection. And he said he hopes that that bill that has been signed into law will create up to 500,000 jobs. Within the course of whatever, I don't know, there was no time frame for creation of 500,000 jobs, whether they're going to be in eight years or they are going to be in four years or in two years. I don't know that. But at least he has done something that he hopes will create 500,000 jobs. Well, the fear is we just drop figures all the time. We don't even know how those figures came about. We just drop the figures. If our population, even in this country, they say it's not an accurate figure. It's an imagined figure or an estimated figure. Then what are we talking about? So if they can address all these things and the loans come fine, but let the loans not add the burden to the people. Some are being calling for outright free education. Never mind the loan, all right? Or strengthening of the scholarship. Yeah, some are saying calling for outright. Just as it was back then in the times of Chief Awolowo, that they should give free education instead of this loan. But of course, we know that these loans are not entirely bad. If they're well implemented, if they're well implemented and if students will be able to get jobs when they come up. But as I said, I imagine that the president who is reenacting this would have factored in the need for students to be able to get employed when they finish school so that they can pay. I just read out, albeit not very smoothly, that message from way back when loans were given to people back in the day 72, 1972, 1973. And they were defaulters. And so we don't want to see a situation where this would just be one of those things, like the uncoverer was money and school feeding scheme that didn't fly very well. By the way, did you hear that the central, the governor of the central, former governor of the central bank, or suspended governor of the central bank, said that he was giving out, is it 500 billion? Monthly. Monthly to the humanitarian ministry. We are for the feeding program and for life to be better for Nigerians. I'm sure the president may have done that thinking that he's doing well for Nigeria and trusting the person who is in charge to do the needful. Unfortunately, Nigerians didn't see that 500 billion monthly. The psyche of Nigerians really suffering so much. With all these being revealed all the time, Nigerians surely... And a lot will come. A lot more will come. Exactly. You're watching The Breakfast on Plus TV Africa. We'll give you the weather report and then come back without the press. Stay with us.