Good afternoon. The first item of business is topical questions in order to get as many members in as I possible. I would be grateful for shortings as taxed questions and responses. At question number one, I call Miles Briggs. First point, Presiding Officer. To ask the Scottish Government what analysis is carried out regarding the implementation and potential impact of short-term 여�os. Cabinet Secretary Schoner Robison. In December 2021, we published six different impact assessments. under a separate business regulatory impact assessment, where, informed by evidence and information from partners and stakeholders, are set out analysis on the likely costs, risks and benefits of short-reflect sector regulation, and will continue to work with local authorities. local authorities. In the summer of 2023, we will review levels of short-term let-activity in hotspot areas to assess how the actions we are taking are working and ensure that there are no unintended consequences. Miles Briggs. I know that the cabinet secretary is acutely aware of the concerns being expressed, especially by class 7 guest houses in Ben and Breakfast, which have been included in the scheme by some councils that should have been excluded, and indeed many councils not even having in place the teams to do this work. Like many small businesses, short-term lets are still to recover very much so from the Covid pandemic. The Scottish Association of Self-Caterers have warned that the Scottish Government's legislation will negatively impact on the sector and are now calling for the implementation of this legislation to be delayed. Can I ask the cabinet secretary, with this in mind, will she agree to delaying this legislation and take on board these growing concerns on the negative impact that it will have? On the first issue of delay calls, we have introduced, as a member knows, licensing to first and foremost ensure that there are mandatory safety standards for short-term lets across Scotland. It also provides local authorities with the powers to introduce additional licensing conditions to address issues that are concerned to their local area. As a member will also know, many short-term lets already comply with those conditions, and for those who do not, it is important that they are in place as soon as possible to ensure level playing field and safety across Scotland. There is a transition period for existing operators, and they have until 1 April 2023 to apply for a licence and may continue to operate while their licence is being determined. Miles Briggs mentioned the issue of guest houses specifically, which I am happy to deal with, because I think that it is important for clarity here. The Civic Government Scotland Act 1982 or 1982 Order 2022 does not reference planning use classes. Schedule 1 lists excluded accommodation, which includes hotels with planning permission granted for use as a hotel, but it does not list guest houses with planning permission granted for use as a guest house as an exclusion. Therefore, to be clear, unless otherwise excluded by any of the criteria set out and schedule one of the licensing order, short-term let accommodation will require a licence to operate, including guest houses. We have been clear about that for quite some time, and certainly since June 2021. I hope that there will be no misunderstanding there. On the issue of promotion, we will ensure that there is a campaign running from October, which will again make information in the public domain very clear indeed. I have written to local authority housing conveners and chief executives to remind them of their duty to establish short-term licensing schemes by 1 October this year. I thank the cabinet secretary for that answer, but I think that it is a complacent one in the sense of the inconsistencies that we are seeing across local authorities in the implementation of this Government legislation. The Deputy First Minister, for example, has been telling guest houses in his constituency that they are exempt. The Scottish Government clearly is not giving the right information to constituents and businesses. What is clear from what the cabinet secretary said today is that this does not need a bit of time to properly work and to be bedded in. Does she not realise that this legislation is a mess and needs to have a pause for councils to properly implement it, especially given that many have not even employed the staff yet who will be tasked with doing this? First of all, I do not accept the description of the legislation. We have had numerous consultations on the legislation. Parliament has had ample time to scrutinise it. There has been widespread consultation with stakeholders and stakeholder input into the stakeholder implementation group. The member mentioned inconsistencies during this year. We have worked with the Scottish Housing Network and officials from across all local authorities to plan for implementation of the licensing scheme. That has involved discussing different local approaches to understand the rationale and facilitate common processes where possible to do so. There will be some circumstances where, as I gave my answer earlier, there will be local variation because of local need. However, we have tried where possible to ensure that there are common processes and that there are simple online information and application processes that should be straightforward for applicants to follow. During the local government housing and planning committee scrutiny of the short-term let's licensing scheme, most councils express support or enthusiasm for the plans, especially those with tourist hotspots. With those new measures, does the cabinet secretary believe that councils will feel more empowered to balance tourism with the needs of their local communities? Cabinet secretary? Yes, I agree with that. Local communities have told us over a number of years about their safety concerns and the impact that the short-term let's can have on communities and the availability of housing. Regulation of short-term let's is appropriate for the whole of Scotland and offers considerable flexibility to local authorities on how it is implemented. Licensing will allow councils and communities to take action to manage issues more effectively without unduly curtailing some of the benefits of short-term let's to host visitors and the Scottish economy. However, we need to ensure that they are safe and that people providing them are suitable and fit and proper people to do so. I am surprised that anyone could disagree with that. Sarah Boyack Cabinet secretary, while we have waited for the SNP Government to act on short-term let's, thousands of homes were lost in Edinburgh, but Labour-led Edinburgh council has now implemented the new rules as quickly as possible. Over £3 million was lost to the public person in Edinburgh in the last financial year alone because of the loophole that still exists where short-term let's owners can move to business rates and then receive the 100 per cent small business bonus scheme discount. Given that the Scottish Government committed years ago to reviewing the tax treatment of short-term let's, what progress has been made on that review and when will that review be completed? I think that Sarah Boyack, in the interests of fairness, would possibly recognise that a lot of the groundwork that was done under the previous administration in Edinburgh completed under the current administration. I think that anyone giving a fair analysis would recognise that. We were happy to give ministerial approval to the order that had been brought after proper due consultation, which, of course, was welcomed as part of the short-term let's control area that local authorities had to consult with their communities. Of course, that takes time, but it is the right thing to do. If we hadn't put that in, I am sure that people in the chamber would be raising concerns about the lack of consultation locally. I think that that is the right balance and it is important to get it right. On the issue of taxation, we have taken steps to ensure that self-catering properties are correctly classified on the valuation role for non-domestic rates tax purposes. From 1 April 2022, premises are now required to be actually let for a period of at least 70 days and available for let for 140 days in the same financial year in order to be classed as self-catering. That was some way to addressing some of the loopholes that Sarah Boyack was referring to, but I am happy to give her any further information that she would find helpful in that regard. To ask the Scottish Government whether it will make a statement on the policing and arrests at events connected to the death of the Queen and the proclamation of a new monarch. I pay tribute to Police Scotland for its considerable efforts in the planning and delivery of Operation Unicorn, an operation in scale complexity and sensitivity without precedent. It is though the fundamental right of anyone living in a democracy to peacefully protest. As demonstrated during COP26, Police Scotland protect people's right to protest whilst balancing the rights of the wider community and upholding public safety. The member will appreciate that operational decisions are a matter for the chief constable with scrutiny and oversight provided by the Scottish Police Authority, and it is not appropriate for me to comment on specific cases. And any complaint about the actions of officers should be made directly to Police Scotland in the first instance. Thank you. I recognise that it was a huge policing operation, but media reports suggest heavy-handed policing with four arrests for breach of the peace, a number of others detained and then released without charge, and a woman who was demonstrating about free speech followed by police officers. What discussions has the cabinet secretary had with Police Scotland about those incidents? I think I've just said, Presiding Officer, that I am not able to comment on individual cases, but I do confirm that Police Scotland do approach their job firmly on the basis of human rights legislation and operate, of course, under the principle of policing by consent. They have confirmed that there will be a formal debrief process for Operation Unicorn, and I understand that Operation Unicorn will be discussed at the Scottish Police Authority board later this month, the appropriate forum for doing that. I also understand that this will include reviewing at least one of the incidents that took place while the operation was active. I'm meeting with the chief constable tomorrow and we'll discuss these issues with him with a view to looking at, as ever, what lessons can we learn from the operation and how these can be applied to future policing operations. I will also congratulate him and his force on a superb job, notwithstanding the issues that have been raised by the member. Does the cabinet secretary agree that those incidents create a worrying precedent and that freedom of speech is a fundamental right? I'm grateful that he is going to discuss those issues with Police Scotland tomorrow, but would he ensure that MSPs get the opportunity to discuss those issues and our approach on policy on those issues? Cabinet secretary, I've just confirmed that the right to peaceful and democratic process is one that we fully support and Police Scotland do support as well. There are quite a number of ways in which individual members can, of course, make their views known to the chief constable or to the SPA, but if there are particular methods that are being proposed by the member, we're doing that. I'm more than happy to meet with the member and discuss those further, but the police will be very open. They are accountable in many different ways, very open to receiving representations, as the member will know from MSPs. I share the member's concerns about some aspects of policing during the proclamation and later during the funeral procession on the Royal Mile. Can I ask the cabinet secretary to confirm? I understand that there are many different police forces on duty then, and just to confirm that Police Scotland had overall control and operational policy control, and if so, and I know what the cabinet secretary says about the debriefing and the review, will the outcome of that review be made public or certainly could you ask the SPA if that can be done? I should say for the member's information that whenever constables or police officers from other jurisdictions come to serve and help under mutual aid arrangements with Police Scotland, control always rests with the chief constable and the Lord Advocate as well. Similarly, we had 1,000 police officers in London and throughout England and Wales to help with events down in that area this week. At that time, they will be under the control of local police chiefs. That is the way it should be done. Of course, in Scotland, it will always be the chief constable that is in control. Just to say, it will be up to the Scottish Police Authority how the discussions that they have with the chief constable are discussed and the extent to which they are made public. The chief constable will provide an update on the policing activities that supported the operation. I have already mentioned the extent to which that will be subject to review, but it will be for the SPA to make those decisions. Despite the mammoth scale of the events, there are clearly a number of small isolated incidents, which no doubt will be further to due scrutiny. Will the justice secretary agree with me that, on the whole, Police Scotland did a tremendous job and should be thanked for their efforts, officers rank and file from right across Scotland supported events here in Edinburgh and in London, but not just them, the army of volunteers and the armed forces who behaved impeccably over the past week? First of all, that is certainly true. It does not mean that the issues that are raised by other members are not significant and important and should be considered. However, I think that the member is exactly right and just probably wrongly to give one example of that, that the police officer, I think that he was a superintendent who drove the motorbike from Balmoral for six hours at a very low speed and then was confronted with the royal mile and the cobbled stones to come down there under control, showed you the level of concentration and ability and expertise that there is within Police Scotland. I think that he did a tremendous job, although, as I have said, that does not mean that we should not explore other issues which have arisen. In her coronation address, her late Majesty Professor Belief in free speech and tolerance, she called it a precious part of our way of life and she asked the British people to cherish it and to practice it. Free speech and the right to peaceful protest are the cornerstones of this liberal democracy, even when we find them distasteful or inappropriate. I am concerned that the cabinet secretary has stressed that he will not speak to specific examples of policing. Surely policing by consent means that activities of Police Scotland should be accountable to this Parliament, and if he will not talk to specific events, in what forum can those concerns be voiced by members of this Parliament? I think that I have already said two or three times that I fully support the right to democratic and peaceful protest. It is also true that, as Jamie Greene pointed out, the number of arrests that happened here is very small compared to the scale of the event that took place. Nevertheless, there are serious issues, but I will just say to Alex Cole-Hamilton, check the legislation. I am not allowed to involve myself, because a decision of this Parliament in 2012 explicitly rejected the idea that ministers or the Parliament would directly control the police. I am not allowed to do that under that legislation, so perhaps he could familiarise himself with that legislation before he asks his next question. We have heard much about the arrests of people who expressed to anti-imperialist or anti-monarchy views, holding signs, carrying eggs. What we have heard less about are the people, mostly young women, who were followed, and those who were held by police had their details taken simply for booing or being near people with anti-monarchy signs. Does the cabinet secretary believe that this behaviour, which has felt threatening and intimidating, is acceptable, especially given that similar concerns were raised less than a year ago during and after COP26? I think that, first of all, my views on the policing of COP26 are on the record. However, as I have said in my original answer, and I have to repeat that it is not appropriate for me to comment on the detail of specific cases, although I do understand that Police Scotland is aware of the incident that the member has mentioned, shared via social media, and that the content of the footage, that video footage, is currently being reviewed. However, I do want to underline our commitment to having strong systems and processes in place for dealing with complaints against the police, and we outlined in the programme for government our intention to introduce a bill on police complaints and misconduct handling later this parliamentary year. To ask the Scottish Government what its response is regarding the impact in Scotland of the reported plans of the UK Government to grant up to 130 new oil and gas exploration licenses. Oil and gas exploration and production, including licensing, remain reserved to the UK Government. The Scottish Government is clear that unlimited extraction of fossil fuels is not consistent with our climate obligations if we are to meet our target of 1.5 degrees under the Paris agreement, and it is not the right solution to the real cost of living crisis that families are facing. Instead of licensing more fossil fuel extraction, the UK Government should be encouraging investment in renewables and supporting a just transition for our energy sector, Scottish households and businesses. In her first weeks in Downing Street, Liz Truss has taken a ricking ball to climate commitments. The UK Government is once again pretending that they can drill their way out of the energy crisis while the world is facing unimaginable suffering from climate breakdown. From installing a fossil fuel fanatic as our energy secretary to making no reference to climate in her first speech on energy policy, this is climate denial at its worst. So can I ask the cabinet secretary, does he agree that the development of the Rosebank oilfield, alongside Cambo and Jackdaw, undermines both the Paris agreement and the Glasgow pact, and we will do nothing to reduce energy bills that people are currently facing? If we look at the focus at the present moment on trying to tackle the cost of living crisis that many households are facing as a result of increasing energy costs, increasing extraction of oil and gas within the North Sea will not address that issue. That is not my view, that is a view of the UK Government. Quasie Quartine, the former energy secretary at the UK Government and the Chancellor of Exchequer, made that point himself during the course of the debate in the House of Commons earlier this year. That is why if we are to try to tackle the underlying causes that are driving household energy bills and non-domestic energy bills at the present moment, the way in which to do that is to decarbonise our energy system and to reduce our dependency on fossil fuels. In doing that, we reduce our potential risk to the malign forces of people like putting in the future. That is why renewable energy is the most effective way in which to do that, not only in delivering cheaper energy for domestic and non-domestic users, but it also delivers energy security and an approach that we can benefit from here in Scotland specifically with an exhilaration of renewable energy projects. Mark Ruskell. I thank the cabinet secretary for that response as well. Yesterday, the UN Secretary General, Antonio Guterres, called on countries to tax the windfall profits of oil and gas companies to support people struggling with the cost crisis, but also to support communities who are suffering immense loss and damage from climate change around the world. Does the cabinet secretary agree with his proposal? A time when households are facing such high energy bills that are driving quite literally millions of households into fuel poverty and extreme fuel poverty, the focus is not only the need to make sure that we do everything we can to reduce the financial burden it has on them here and now, but also to prevent burdening households with increased fuel costs in the future. That is the real risk of the approach that has been taken by the UK Government in the announcement that they have made to date in tackling this cost of living crisis. The focus, I believe, should be on taxing the windfall profits of those particularly energy companies that are making sizable profits and using that money to offset the costs on households now. It is estimated that those companies will make in the region of £170 billion over the course of the next two years alone. That form of a windfall tax could be used to offset the costs of energy prices in people's homes today. The UK Government should do that, as opposed to burdening the additional costs on to household bills, which is what will happen in the future with the approach that they have taken. Fiona Hyslop Does the cabinet secretary agree that the UK Prime Minister should heed Alex Sharmer, former UK-based secretary of state and COP26 president, who stated that climate and environmental security are now synonymous with energy and national security? Scotland's great asset of a combined energy sector means that sensible use of existing domestic oil and gas licences subject to climate analysis during the energy transition and investment in renewable energy growth, including green hydrogen exports, will provide more energy security to ourselves and our European partners who desperately want green energy supply security from hostile actors than the UK Government, agreeing that 130 new but long-term licences without climate impact analysis. I agree with the president of COP26 Alex Sharmer, because he also stated that countries now understand the benefits of low-cost homegrown renewables, the price of which cannot be manipulated from afar. Recognising renewable energy is the quickest, cheapest, most environmentally friendly approach that we can have to tackling our energy crisis at the present moment while delivering energy security. Scotland is rich with the natural assets to deliver that, not just for our own domestic needs here in Scotland, for the rest of the UK, but it also helps to support the decarbonisation of energy across other parts of Europe. Whether it be in onshore, offshore wind, CCUS battery storage, whether it be hydroelectric, all of which can contribute to our energy transition, and Scotland has the natural benefits to maximise those resources. That is why it is absolutely critical that we see from the UK Government, it is early in this new government's days, but we see an approach that is consistent with the need to drive forward renewable energy to help to reduce energy costs overall. Mark Ruskell strangely forgot to mention Guterres also saying that fossil fuels cannot be shut down overnight. A just transition means leaving no person or country behind. Without new investment in fields like Cambo and Jack Daw and political support from the Scottish Government, production will fall off a cliff, jeopardising the just transition and the 90,000 Scottish jobs that will deliver it and makes us reliant on environmentally worse imports from regimes like putins. Has the Government made an assessment of the financial, economic and environmental impacts of the Scottish Government's plans to abandon our oil and gas sector? If so, will it be published? I will try to deal with some of the facts, because we have been quite consistent in our approach. That is that we should be transitioning away from our dependency on fossil fuels in order to reduce our risk of exposure to the malign forces such as putin. An approach that is agreed by the UK Government is that it is not actually driving forward the policies that will deliver on that as well. That is the point that has been made here. It needs to make sure that we ramp up our production of renewables and other forms of renewable resources both on and offshore in order to reduce our dependency on fossil fuels. Our oil and gas sector, as I have consistently said in this chamber and possibly even to the member, will continue to play an important part in our economy going forward. At the same time, we need to ramp up our renewable developments and that will help to reduce our costs overall. What I think is wrong—what I think is seriously wrong—is the impression that some try to give that by simply extracting some more oil and gas we can in some way reduce our energy costs. The reality is that that will not happen. That is the impression that the UK Government has tried to give with an announcement over the course of the past few days. It simply will not work because all the evidence demonstrates that it will not deliver the type of output that it is needed to do that. The approach by the UK Government and the Scottish Conservatives is, indeed, worrying and wrongheaded. Can I ask the Cabinet Secretary about what the Scottish Government can do to make sure that our planning system in Scotland is robust and fit for purpose? If we are going to see offshore oil and gas and new developments such as Cambo and Jack Donkett in Rosebank coming forward, what can we do to make sure that our planning system is robust because there will be a requirement for onshore assets and infrastructure? What can we do to frustrate the process, if necessary? Most of the licences that are issued nowadays are tied back into existing oil and gas infrastructure that comes on to onshore. New fields have been brought on and tying into existing infrastructure to come onshore. By and large, there are no planning provisions in this for Scottish ministers and the Scottish Government to be involved in the licensing of exploration licences and also for production licences and solo rest with the UK Government. I believe that they should be here in this Parliament. We should be deciding these policies here in this Parliament, given the importance they have to our natural environment and to our fuel security in the future. However, as it largely stands, when it comes to oil and gas production, very often there are no planning requirements for Scottish ministers to be involved in the process.


Everybody forced here ripping in two boxes of 2022 select UFC hobby for Richard V Richard. Good luck, buddy Let's see what you got in Select UFC So guys I'll do my best with the names here. I don't follow UFC as close as some other breakers here I know like the bigger names. So there's a number Eunice a Uriah Hall 13 of 99 on the red octagon action signature is nice hit there Try color rookie Chris Dot Chris docus got octagon side Jose Aldo a bronze Frankie Edgar 1 12 175 turn Got global icons Conor McGregor Silver concourse Michelle Waterston now laying nothing pull something big here rose number Eunice 96 of 199 on the relic auto sick dog rose Richard V. There you go, man. That's awesome 96 of 199 good box so far It's a nice color now fighter worn Let's say if it's match worn Got blue concourse Rashad Evans 76 of 199 got try color premier levels John Whaley Got a numbers Corey Sandhagen Silver Juliana, Pena or concourse Juliana Pena Rainow got a sue rookie concourse silver There's a phenomenon's Kevin Holland. Nice And it is Andre. I'm Eunice rookie line green to a 49 nice low number there That man good box Holloway try color Marlon Vera Concourse try color John Jones octagon side silver premier level Dustin Jacobi was a crazy JT Yeah, I bet man. Where were you at again got numbers silver Amanda Nunez A scope concourse Nikita Krilov Chitch Alaska's that is a Colby Covington rally non-numbered the Colby Covington And a silver premier level dominant cruise All right, it's pretty good first box there. That's a nice autos decent color See something big here one more select UFC. Good luck Richard Asner Whitaker got me a chitch numbers silver premier level Tiago Santos You think select is the best UFC cards. I don't think I can disagree with that honestly next is a Nina Nunez auto action signature 79 of 99 Very nice Nina Nunez try color young block of it rose octagon side a Kai Cara France 132 175 bronze premier level scope concourse Jair Rosen stroke Rosen stroke. How's the show lane? Got Anderson Silva on the auto very nice red Anderson Silva 38 of 99 the autos have been really good So common sense We we've been on tiktok while we haven't streamed on tiktok very much 48 of 199 concourse light blue Tom Espinal has a sweet uh sweet Anderson, huh? Silver concourse Sarah McMahon Yeah, we won't even streaming Maybe like a week and a half or so maybe not even a week Premier level try color bread and merino. Oh, there's a green coming. What do we have here Richard? Good luck, buddy Green it's a concourse. It looks like green concourse Nice Kelvin Gastelum, there you go, man. What a great couple of boxes three of five on the Gastelum Good stuff, man. Great color there. Yeah, it was exactly one week that you're right concourse try color. Yana Kunitschia or Kuniskaya Andrade on the octagon side Raquel Pennington premier level silver global icons Figueredo silver concourse Dominic Reyes It was a Jessica Andrade Relic card non-numbered on the Andrade And last card is a premier level maroon, I think rookie Kennedy And how do you say his last name guys 62 of 125? I don't want to butcher it totally You don't know how to say his last name nice rookie premier level maroon there 62 of 125 Richard, thanks again, buddy. Congrats on the very nice couple of boxes select UFC. We'll get him right out to you


we can use AI as a writing coach to help our students become more articulate to help them become better at expressing their ideas. So this is the scaffold of the kind of thing that I talked about earlier today. Those are the ways that AI could be part of the education that the academic scholar models.


Hi everyone, good morning. So I'm very happy to give the first talk, open the session. This is the second time I think I'm doing it in JSFOO. And it's always a good experience to open the talk because most developers, programmers usually work through the nights. So the first talk, it's a bit of a responsibility because like myself, I sleep at around 4. So I'm a little sleepy myself. I'm assuming it's similar to you as well. So I would try and make the first talk as engaging as possible. OK. So the talk itself is on a very important topic. How many of you here have heard about a recent attack group or hacker group called as magecott or attacks called as magecott attacks? Anybody? Is anybody here from the time? I'm sure most of you are young developers. But is anybody here from the time before when front end was taken seriously? JavaScript was taken seriously as a language. So there is this saying, which is you know you've made it when people start attacking you. So it's kind of similar here as well because till now all the major security attacks, they were on the back end. They were targeting back end applications and black technology stack and so on. So magecott is an attack which primarily focuses on the front end. So if the attack happens on the front end and the impact is on the front end and the data loss is also on the front end. So I think in an ironical sort of way, I should say congratulations to front end folks because now you guys have finally made it because you have attackers targeting your stack. OK. So through this talk, we'll try to understand the attacks of this nature and we'll see how these can be detected and then eventually stopped using a technology called as content security policy. So that's the background. A little bit about myself. I'm the founder of Iron Wars for security. It's a pure play product, security product based startup. We develop several products on continuous application security. We do content security policy automation. Some of the technologies we develop there is what I'm going to present in the talk. And this is the outline for the talk itself, which is we'll talk about data exfiltration attacks. We'll understand what they are, how they work. And we'll discuss how they can be detected using content security policy. And we'll see how this can be implemented. So I'll give you a set of steps or a guideline, if you will, of how you can deploy or how you can put a mechanism to detect this. And what are the limitations for an approach like this and how you can possibly try and overcome those limitations? OK, so let's start with understanding data exfiltration. Now, so there are these three companies. Now, obviously, as you can see, these are big names. New Egg, for example, is one of the top retailers in the US. They handle several millions of transactions in a day. And all these three companies were affected by hackers back in 2018. And this is the kind of impact they had. New Egg had lost more than 45 million credit card information of their customers. And British Airways and Ticketmaster, they were hit equally as well, loss of several thousands of credit card information. Now, anybody would say that this is a serious attack, because there's a lot of credit card data being lost. But what is more interesting here is not just the impact, but this, which is the duration for which the attack actually took place. So if you see in all of these cases, the attacks went on for what we can say is a significant period of time. Like even the shortest case, which is British Airways, where they lost about half a million credit card information, the attack went on for over two weeks. And this is unacceptable for any big organization to be under active attack, losing their customer's data for such a long duration. It simply doesn't happen in normal circumstances. So the reason why it happened with British Airways and all of these companies, now these are big companies, they have a lot of security practices and a lot of security tools and other mechanisms in place. But still the attacks went on undetected for a long time, in fact, a ticket master went on for more than eight months. You can even have a baby in that much time. That's how long the attack actually went on. So we'll try and see why this actually happened. The reason is because you have all of these security monitoring and processes and everything, usually on the server side, right? But there's nothing on the client side. So let's say if this is a very poor and simplified representation of your infrastructure, then you have your monitoring systems covering your server. So if there's going to be a data leakage on the server side, then it gets picked up by any of these monitoring systems. It can be in your data center, it can be in your cloud. You have these monitoring systems in place. But let's say if a person connects to your website through their browser and from the user's browser. So your JavaScript is loaded in the user's browser and due to some reason, this JavaScript is now sending the user's credit card information to somebody else. So this is data leakage on the client side. And this usually goes undetected because you do not have any mechanisms in place to look for egress data from the browser itself, right? Which your site might be sending outside. So this is why the attack could go undetected on all of these companies for such a long time irrespective of them having good security measures in place. Now, how does a data leakage like this happen? So we can talk about this. So this is a brief representation of that which is attackers try and look for sites where they can inject their JavaScript into your website. How they can do it, we'll just talk about it briefly. So they find some way to inject their JavaScript into your site. Once they do that, they just wait for customer data to hit their servers. And then every time a user goes to your website and then they are interacting with it, they're putting a data inside it. The attackers JavaScript which is running inside it will take this information and it'll send it to their server. It's a very simple process. Now, in terms of how the attackers JavaScript can enter into your website, there are four ways in which this can happen. One is cross-aid scripting. How many of you have heard about cross-aid scripting? Most of you. And I'm sure you've taken counter measures to prevent that it does not happen. In fact, most of the modern frameworks, React and Vue.js and so on, they automatically escape whatever data you try to show on the DOM. So there are a lot of things which they try and do to prevent that, to automatically protect you from, or you can say they are secure by default, unless you actually go and do something wrong or you do a lot of direct DOM API calls, you are mostly secure from doing cross-aid scripting. But then again, you might be using a lot of libraries, you might be using external widgets and so on, and they might actually have problems in them. So cross-aid scripting is one easy way in which anybody can inject JavaScript code into your websites. And the other one is compromise of external CDNs. It's a little far-fished, but it does happen where you're loading in code from external servers, and if those servers get compromised through whatever means, then your site will get affected as well. And the other one is compromised ad networks. A lot of websites include advertising code inside them. They use analytics code and similar types of external code. You might have chat widgets and so on. And if they were to have a problem, then also you might get affected. And then finally, you have compromised web servers where your server gets compromised, so an attacker is able to go and modify the JavaScript code. So there is a vulnerability on your server. The attacker is able to compromise it. And instead of doing anything, any damage to your backend or trying to steal data from your backend, what the attacker instead does is he goes and modifies the JavaScript files on your server. In fact, there's a very recent example of this where about 13,000 odd websites were infected by the same mage card attack group. And the way it was affected was they were looking for AWS buckets, which were misconfigured. So when a bucket is misconfigured, what can happen is anybody who has a valid AWS credential, instead of just being able to read your buckets, they can also write to the bucket. So what these guys did was they scanned for these misconfigured buckets and there were quite a lot of them and they looked for JavaScript files inside them and wherever they found JavaScript files, they went and they modified those JavaScript files. And all the websites which were loading JavaScript files from these buckets, all of them were infected and the number was roughly around 13,000. So it's a big number. Okay, so this is an example of an actual attack which took place on British Airways. What the attackers did was British Airways was loading this library called Modernizer, right? Attackers found a way to compromise the server and what they did was they modified the content of the Modernizer.js. What they did was they added about eight or nine lines of JavaScript code to the end of this Modernizer JavaScript, right? So which means that wherever British Airways was loading this JS code into their site, all of those pages were also under the control of the attacker. Okay, now once an attacker is able to get their JavaScript code into your site, how can they send this information out? So there are two steps to this attack.  So how can you actually send it? One is you can try and load resources from an external site. We'll see how that can be used to send out data outside. You can navigate the user to an external site, connects to external sites where DOM APIs, you know, DOM has a lot of communication APIs like, you know, Ajax, I'm sorry, XML HTTP request and fetch and so on. So these can be used to send data outside. In case of British Airways, this is what the attackers were doing. The eight or nine lines of JavaScript code which was injected into modernizer.js, this is the, you know, de-minified or beautified version of the code. And it's actually pretty simple. What they're doing is they're just collecting the contents of the payment form and they make a post request to a website, a domain called baways.com. A baways.com was registered by these attackers and it looks similar to British Airways, but it doesn't actually belong to British Airways, it belongs to these attackers and they're sending a regular post request to send this data outside, right?  Right, so one thing an attacker could do is they can try and load an, you know, resource from an external site, which is they can say script source and they can give a URL or they can say image source. They can give any, they can try to load any resource and they can actually put the data to be stolen as part of the URL, right? So which means this is one way by which you can make a request to an attacker's site and you can send data. The other way is, like I said, using a DOM API, you can actually make a normal Ajax request and you can put the data inside it. So it's important to know how you can send data so that you can actually try and prevent those exact means of sending data outside. So now we'll discuss about how you can actually detect if your site is leaking data to an external, you know, entity. So you can do it in two ways. The first way is at the JavaScript level and since all of you are JavaScript developers, this would probably be the more, you know, natural way to handle this. So the way you will do it in JavaScript level is you will first, you know, write some JavaScript code to do some monkey patching of the DOM APIs, you know, essentially create an abstraction layer and once you do that, every call to the native API, you will actually monitor it and you will see if this call is happening to somebody which is, you know, not trusted. For example, this is how it will look. Normally you have your native, you have your applications JavaScript code which is directly calling the native APIs and what you would instead do is you would write some code which will essentially hook your native APIs. You can think of it like a New Relic, you know, monitoring type of code and what this will do is every time your application tries to call, say, the DOM API, then the call will first come to your code. Your code can, you know, look at the call. It can determine if this has to be sent to the, you know, native DOM API. So you can have a whitelist of domain names, for example, and you can say, hey, these are the domains I normally communicate with and if the JavaScript code is trying to communicate to a domain which is not in the whitelist, then you can send an alert to your server, right? So you have full control over who your site actually talks to. And you can do the same for DOM manipulations as well. So for example, if there's a DOM manipulation and there's a new image SRC tag being added, you can monitor that and you can see if it's for a resource that you trust. Now the JavaScript approach is again, like I said, as JavaScript developers, it looks like the most obvious thing to do, but it has some downsides as well. The first thing is it's a complicated approach. You know, you'll have to do monkey patching for JavaScript and it's not a very straightforward process and it requires a lot of coding as well as maintenance effort, you know, because you'll have to again test all scenarios in your code to make sure that whatever you're doing is not breaking the site's functionality, not just the functionality that you've written as well as, you know, third-party code that you are importing inside. You don't want to make sure that it's not breaking any of that and you also want to make sure it does not have any performance impact because what you're doing is you're adding one extra layer of abstraction between the application's code and the native code. So that can put on a performance overhead and, you know, that is something you want to be careful about. So these are some problems with the JavaScript approach, although it's something which you might think is a more, you know, easier approach to take given your familiarity with the language. So I would propose an alternative approach which is through content security policy. How many of you know content security policy? Okay, that's good. How many of you have, or how many of your websites actually do use content security policy? Right, okay, good. I think almost half of the folks who know are using it and the other half I presume you bravely tried to venture into using content security policy and it was too complicated and you probably, you know, gave up somewhere. But anyway, the content security policy is a, it's a client-side technology. I'll discuss it briefly. But using this approach has several benefits. The first thing is it can be done either by the developers or it can be done by the network or infrastructure team. You know, it doesn't have a lot of coding effort. So you don't have to, if you don't code anything, then you don't have to maintain it as well. It's a much simpler approach and it will not break your site, at least if you put the CSP in the monitoring mode instead of blocking mode, your site will not break and it has no performance impact because it's a built-in functionality in the browser. You're not writing any code of your own. So, you know, performance-wise, it's really good. Right, so let's try and understand what is content security policy. I would like to call content security policy as, you know, like a firewall for the browser. You would never put your website out without any kind of, you know, firewall or a filtering mechanism for your application. But it's very ironical that for the client-side, you know, we put it out without any kind of a filtering system and CSP is like a filtering system for the client-side.  And CSP is essentially a single HTTP header. It's a HTTP response header. You know, that's all it essentially comes down to. You set one header and then you tell the browser how the browser has to behave based on that header. And you can put it again, like I said, in blocking mode as well as non-blocking mode. And when you put it in non-blocking mode, you get alerts about what the browser is doing. So it can act like a form of analytics system as well, if you want to use it that way. Right, so this is how a typical CSP header would look. We have two headers here. One is a normal CSP header. The other one is a CSP header in the report-only mode. So this is the blocking mode header and this is the monitoring mode header. And the header will have something called as a directive.  So it'll have a directive and then that will be followed by something called as a report URI. Right, so if there are any violations, this is where the violations are essentially sent. Now CSP directives are essentially guidelines. So when I said CSP is like a firewall for your browser, the firewall will normally have rules, right? So the directives are the rules of this CSP type of firewall. This will essentially tell how a certain aspect of your browser should behave, okay? So for example, you have CSP directives which control loading of JavaScript code. You have CSP directives which control loading of CSS, CSP directives which control loading of iframes and so on. So each of those directives will, you know, control those individual behaviors. So for the task at hand, which is preventing data exfiltration attack or detecting data exfiltration attack, these are the kind of CSP directives that we would be interested in. So these are part of the slides. You can start with these. I'll explain them briefly, you know, a little down the line. Now each directive has a value. The value defines how the, you know, particular directive must be interpreted by the browser. So for most of the directives, the values would be either none, self, or it would be a single site name or a bunch of site names, you know, like a group of site names. And what these values specify is, let's say I have a directive called script src.  So you can essentially tell your browser if it should load JavaScript code and if it should load JavaScript code, then where it should load the JavaScript code from. And for script src, if I put the directive as directive value as none, then essentially you're telling your browser, do not load any JavaScript code, you know, even though the HTML might try to load JavaScript code, you're telling the browser through the header, do not load and execute any JavaScript code. So even if your HTML is trying to refer a script from somewhere, your browser will not evaluate it. And if you set it to self, then it means that you're telling the browser to load JavaScript code from the same site, which is, if your site is hasgeek.com, then any JavaScript code loaded from hasgeek.com will be allowed by the browser, it will evaluate it. But if you're loading JavaScript code from an external domain, that will be blocked. And the third is you can specify an explicit domain name. You can say, hey, I want to load JavaScript code from this domain name, and you can make it as specific as you would like, which is you can give the exact domain name, you can give the protocol, which is HTTP or HTTPS, you can also give the path and file name, right? So you can be as specific as you would want to be in terms of which places you would like to load resources from, and you can also give multiple values, which is you can give a comma separated list of multiple domain names. So if you're loading JavaScript code from five or six different CDNs, you can give all of them in a comma separated value list. So this is typically how it would look. You can give the directive name, you know, followed by the corresponding value. So here we have a none for Connect S R C, Connect S R C defines your DOM communication API. So this would mean that if your site sets this as the CSP header, CSP policy, then from the browser, there would be no Ajax calls, you know, Ajax calls and some other DOM communication APIs will be turned off. Now when script S R C is self, this controls the JavaScript loading. So this would mean that JavaScript files only from the same domain will be loaded by the browser. And for style SRC, if you set it to this domain, then the browser will only note CSS files from this specific domain name. It will not even load it from the same domain, right? Okay, so now that we have looked at the list of CSPs, we look at them in a little detail, each of them. So script S R C, like I said, it'll control the loading of JavaScript, you know, resources in your browser.  If you load JS file from another domain, it'll be rejected by the browser. Style SRC is for your CSS files, similar behavior. Image SRC is for loading images. Connect S R C is for, like I said, communication APIs. And this would include your, you know, HNF Pings, Fetch, XML HTTP request, WebSocket and even source. Font SRC is for loading fonts through your CSS. Object SRC is for, you know, embedding videos and so on. I'm sorry, object SRC is for, you know, embedding, you know, objects into your application and media SRC is for videos and audio. Frame SRC is for external life frames. Worker SRC is when you want to start a web worker, it'll determine which URLs you can actually use. I'm sorry, the web worker JavaScript URL, where it can be allowed from. Form action is when you have an HTML form and then you submit the form, this will determine where this form can actually be submitted to, right? So you can control where your form contents get sent. Manifest SRC is for your manifest files, right? So this essentially covers all the different CSP directives which can essentially be used by an attacker to leak data to an external entity. And if you're going to use CSP to kind of control data leakage, then these are the only directives you'll have to be concerned about. CSP has several other directives as well. They are meant for different purposes. But for purposes of data leakage, these are the only directives you'll have to look at. Okay, so now that we know what does the CSP directive, what are its possible values and what CSP directives we'll have to use, you know, the directives of interest. Now, when you write a CSP policy, you will have to whitelist the domains which can actually load resources, right? Now in a typical application, there are a lot of external parties from where you're loading different, different kinds of resources. You might be loading images from somewhere, you might be loading font from somewhere, you might be loading CSS from another place. Now for you to write a policy which defines your browser's, your application's behavior, you'll have to do a lot of study about your application, right? So which is a very time intensive task. So what you can actually do is you can actually let the browser itself tell you where it's loading, you know, resources from. So it's a little trick you can use. So what you can do is you can make use of CSP violations. Now CSP violations are essentially in your policy, you can say report URI, and you can give a specific URL. And anytime there's a violation with the policy. So the resource that your browser is trying to load is different from the policy that has been defined from you. That would be considered as a violation. And your browser will send a report for that violation to this report URI. And if you look at this reports, then you will get to know, you know, which, what kind of places your, your application is actually loading resources from. This is what a typical report actually looks like. So you can see the document URI is a URL from where this, URL at which this violation actually took place. Blog URI is the resource which the browser was trying to load, which caused the violation. So in this case, it's trying to load, you know, CSS, style.css from example.com. And violated directive is the exact CSS directive, which was violated because of that particular resource. So CSS directive here says style.css.cdn.example.com. It says CSS files can only be loaded from cdn.example.com. But the pay, but this particular page was trying to load CSS from example.com. So which is a mismatch. So this particular violation was generated and this report was sent. It's a, it's a little JSON, you know, format data, which is sent. This contains all of this information. If you look at these reports, you will get to know from where you are, what all places your site is loading, you know, resources from and what kind of resources. Okay, so what you can do is, you can actually start with a very simple CSS policy. You know, you don't have to know a lot about your website. You start with a simple startup policy and then you look at the violations which are generated as your users are using, browsing your website, right? And using, once you look at the violations, you can then go back and you can update the policy. Like for example, you start with a policy like this, let's say, stylusrccdn.example.com and then you start getting violations for this. So now you know that your site is also loading data from CSS from example.com. So what you then do is you go and update the CSS policy to include cdn.example as well as comma example.com, right? So which means that this violation will now go away. So now if you do this as a cycle, then you know, you will reach, you can say like a sort of equilibrium in a few days or a few weeks depending on how frequently you are looking at your violation reports and you're updating your CSS policy. And once you hit equilibrium, then it means that you have created a baseline for your website's behavior, right? And once you create this baseline, any violations which come after that are usually, activities done by attackers or by external scripts or something which are undesirable. So once you have this equilibrium, then any further violations will essentially let you detect your egress traffic from the browser because now if the attacker, you know, if you go back to the earlier case of British Airways, right? So you have defined return a CSV policies which defines your connected source directive which says which sites you can make DOM communication API calls to and you know, that is well defined. And if an attacker is able to now compromise your site and if he is making an Ajax call to baves.com, then because that's different from the CSV policy, you will get a CSV alert, right? And if it is affecting several users, you will start getting several thousands of CSV violations, right? And then you can look into it and again, the CSV violation tells you in which URL it happens and it can also in some cases tell you at which line of code a violation is taking place, which is if there's an Ajax call being made, then it'll also tell you in which line of code this, you know, Ajax call, which is violating the CSV directive is being made.  So to get started, this is, this can be used as an initial starting point. It's a very simple policy where I have mentioned all of those, you know, directives of interest and for all of them you can start with self, which is essentially you are saying you can load all of these resources from the same domain, which is a very likely scenario. And if you start with this, the number of violations you will get at the beginning will not be massive. You can start with none, which means you're just saying, I don't want to load any resource at all. So which means every resource loaded will throw a violation but then you will be hit with a ton of violations. So you can start with self, which is good enough and you can then look at the reports and you can slowly, you know, work yourself up from there. Now, this is how you can use CSP to, you know, possibly detect data frustration attacks. I hope this was straightforward. Any questions, you know, on this before we get into the limitations? No, or if you would like want me to, yeah. Yeah, that's a very good question. If it's possible to block the attacks in real time, to block the attacks in real time, you'll actually have to have the policy in, you know, blocking mode, not in the reporting mode. But the problem is once you put a policy in the blocking mode, you have to be very careful because if there's a new code change, right? And because of a legitimate code change, you're going to load data from somewhere, then because of the blocking mode, it'll just prevent that functionality from working, right? So that's a common problem with CSP, which is in a very dynamically changing environment, you have to also constantly keep updating your CSP policy, right? So if you can do that, or if your site doesn't change all that much in terms of where you load data from, then once you have hit a equilibrium, once you have, you know, in a monitoring mode, once you've got a good enough policy, you see that there are no violations coming, then you can actually change the policy into the blocking mode state of CSP, right? In that case, if, you know, there's an attack, if there's a new resource being loaded from somewhere else, then it'll get blocked by CSP, and you'll also get a violation report for that. So it'll also block the attack, and it'll also tell you that, hey, I blocked this from happening. And if it's a legitimate thing, then it'll like break functionality, but seeing the alerts, you can go and, you know, you can update your CSP policy. But yes, it is possible to do that, but it has a little caveat and you have to be careful about it. Yeah. There's a mic there. Do we get any callback when it is violated so that we can block the UI or show the error message? Yeah, of course. So this violation report is the callback that you get, right? So the policy, the CSP policy will have a property called report URI. So where you can, you know, define an endpoint. And this endpoint will receive JSON information like this, right? So every time there's a violation, it'll have all of this data for you. Oh yeah, you have, there is an event, window event you can actually listen to. So you can get the same violation report from within JavaScript as well. So that is also possible. Yes, you have both the options, right? So that's a social engineering attack, right? Where it's the user who's being tricked into, you know, doing something. I mean, like the moment you take some JavaScript code and you put it into your console, at that point, you cannot really protect the users from themselves, right? So that is like, there are different ways in which you can convince a user to take a data and put it somewhere else. So we are not really trying to prevent that. We are more looking at cases where there is JavaScript code, attackers JavaScript code running into your site and that is automatically trying to send data away. That's what we're trying to block with this. So if you make a Ajax call from the console and if it violates the CSP directive, oh right, right, yes. You're saying that there'll be a new browser tab open and the URL will have the attackers data, yeah. So that's a good point. In fact, that is currently not covered under CSP. I'll be talking about it in the limitations of CSP, right? So that could still work. So my question is, which browsers support CSP and what if my client forces us to use a legacy browser where the CSP is not supported? Then what measures should we take to make the content secure? Okay, so this question, I'll talk about the limitations and then I can answer this, right? So the question is about which browser supports it and what do you do if a legacy browser is being used by your user, right? Okay, so I think I'll now go to the limitations part and then I'll answer this question. Okay, so CSP, although the approach, like I explained, it can help you with this kind of an attack but then it has its limitations as well. The limitations are CSP was not designed for this purpose. It was designed to prevent cross-site scripting attacks. That was the original intent of CSP. So anytime you take a technology designed for one purpose and then you use it in a different way, it's essentially a hack, which means there would be limitations to the approach. So there are known bypasses. One is something called DNS prefetching, a setting location or register of navigation where I'll probably just explain them one by one. There's an approach called DNS prefetch where the attacker instead of trying to load a resource from an external domain, he can actually try to prefetch a resource and the data to be stolen, he can actually put it as a subdomain name. So which means there will be a DNS lookup which will be made. So the lookup will go to the attacker's DNS server and from the DNS server, he can get the data that he wants to steal. So or he can try to navigate the user to a different domain by setting the location or register of property or he can have a hatch of link. You click on the link, it navigates the user to a different page to the attacker's site and it can have the stolen data. This is the scenario that he was actually talking about. So this will not get picked up by CSP and he can also do a window.open and he can open a new tab with whatever URL he wants to. So these are known limitations with this approach but should you still use CSP? I would say yes, because it makes the attack still relatively harder for an attacker to perform. Like in the case of British Airways, if you see they were just using a regular Ajax call to make that, you know, steal the data. So by using this, you are actually making it harder for the attacker. The other thing is CSP version three is having fixes for some of the bypasses I discussed about. I'll speak about those fixes briefly. So if you invest in CSP now and if you have started the process, once CSP version three is supported by the browsers, then these bypasses will also get fixed automatically. So it's not like these will remain open for eternity. So if you start the process now, then it'll eventually catch up with you. So for prefetch, you have a new directive called prefetch.src. So this will prevent the resource prefetch queries from being made. For navigation, there is navigate too. So this will block the scenario that you are referring to. It'll block all kinds of navigation. Link, window.open, location.href. And there is one other thing you can do with CSP, which is you can actually, from time to time, script src as none. So once you set it as none, you will get a list of all JavaScript code which is loaded by your site. And you can make a list of that and you can reset it back to the normal value. And every once in a while, you can set it back to none again, get the list again, and you can keep comparing this list and you can see if there are any changes there. And if there's any change, any new JavaScript file which is being loaded, then you can review and make sure if it's actually a legitimate JavaScript file or if it's an attacker-controlled JavaScript file. So this is again something you can do through CSP to try and cover some of the limitations there. Okay, so now I think I'll answer this question about the browser support itself. CSP version two is supported on all major browsers. And Chrome is by far the most popular browser and it has the best support for CSP, Mozilla as well. And Edge is now eventually going to get a Chromium, you know, WebKit internally. So that'll have first-class support as well. And in terms of legacy browsers, if some people are using legacy browsers, that's not so much a problem for us because that could be a problem if you're trying to block an attack. What we are trying to do here is we are trying to detect data leakage, right? So let's say you have 1000 users and even 200 of them are on Chrome, latest version of Chrome, right? And if your site is infected by an attacker's code and it is leaking data, then you will get violations from these 200 users. So you as a site owner, you're getting alerts, you get to know that there is something wrong in your site and you can go and investigate and you can go and fix it, right? You don't have to get alerts from all 1000 users, even the ones on the legacy browser. So that's not really necessary, right? So even though it is not supported in IE and older versions of IE, that's still not a problem because you get alert from even a certain section of your users, you get to know there's an attack and you can go fix it.


Welcome back retro fans. This time out, US Gold's best games on the Amstrad CPC. Now it's hard to believe that I grew up a stone throw away from US Gold headquarters in Birmingham. Now they made some terrible God awful games for the Amstrad but thanks to US Gold we also received some absolute classics. Kicking things off, number 10 Desert Fox. Back in the day I played the absolute tape out of this and make sure you only select Grandmaster. There's very little strategy in this game. It's pure arcade action all the way. Now that disappointed some but for me there's a good balance here and I'm personally obsessed with World War 2, World War 1 or any ancient battle. The ones where you're against unsurmountable odds, backs against the wall, no chance, it's written off of winning and here is a perfect example. Rommel Desert Fox. It lacks the speech of the Commodore 64 original but it features all of the same highly addictive gameplay and even now the graphics look really good for an 8-bit and I still play it every now and again and if you get the chance to not only watch but play it later after this video you never know you might thoroughly enjoy it. A very good game. Number 9 UN Squadron. Now US Gold back in the day signed I think a 10 game license with Capcom and UN Squadron was one of those games and it comes really close to the arcade original in every department apart from speed but I can't explain it despite the lack of speed. It works, it's fun to play and it looks terrific. I even played the Commodore Amiga version. I quickly went back to this. It's up there with P47 on the Amstrad as well. If it had the speed of the arcade original this would be the best game ever on the Amstrad CPC. It's just so well put together it's a great package. Number 8 Rygar. Let's fight.  Now this sets the scene nicely. Terrific music. It falls down somewhat with the graphics but the gameplay is absolutely massively spot-on and if you're a fan of the arcade original considering the hardware and the fact that this was US Gold and the 1980s you couldn't ask for more than that. It's missing the radiant beautiful sunset of the arcade original but it still looks good. It's minimal but effective and I prefer to play this over any of the other 8-bit conversions although I've not played the NES version and I hear the Atari Lynx is very good. There's enough depth here for most people and for me a US Gold classic. Number 7 Outrun Europa. Now I've played this on the ZX Spectrum the Commodore 64 which is a good conversion. The Amiga was really good. I think the Master System version from memory was really good as well but I love this Amstrad CPC version. There's literally so much to do. You start off in Blighty you've got to get across the English Channel. You've got to avoid the police, helicopters, speedboats and the graphics are really good. Some of the best I've seen on the Amstrad and it's fast. Don't get me wrong it's no Chase HQ but I'm still Outrunning. The sad thing is though it was released towards the end of the Amstrad's life. Number 6 Solomon's Key. Deep down despite the travesty that is Outrun, US Gold made some decent games and after doing this list I'm now more convinced than ever but one list won't suffice. I say that because as I've played I realize that there's games I really like that haven't made this list so I figure people are going to be angry that I've missed out their favorite games but I really am stricken and torn because it's games like this Solomon's Key that are absolutely terrific and hence edged the others out. In the arcade this is probably one of my favorite games of all time on the Amstrad. I'm blown away. Number 5 Shadow Dancer. Every bit as good as Shinobi and I know it doesn't look the best but it plays like the best and if you're up for a serious challenge the type of challenge only Shinobi can give you then look no further than Shadow Dancer. It's pretty impressive and wonderfully playable. It's fast and it's tough and it's probably the best action game on the Amstrad and the thing I love is that you've got a dog as a companion. I've also played this one on the Sega Mega Drive Shadow Dancer and that is really good so don't be shy give Shadow Dancer a try. For an 8-bit computer this is a fantastic conversion. Number 4 Beachhead. A fantastic game not to be missed. Every bit as good as the Commodore 64 original and just like that version a very enjoyable multi-blast. This was great value back in the day and I feel like I need to pat somebody on the back. Well done Bruce Carver or should I be thanking Access Software. It's carnage all the way and it's great for getting rid of all that pent up aggression. The side scrolling tank stage is a bit of a let down because of the choppy scrolling but if that doesn't bother you there's still a fantastic challenge here. Primitive by today's standards and we all know the Amstrad is capable of more but what we do have is well executed. Number 3 and one of my favourite games of all time world-class leaderboard. It doesn't look like it but this is up there with PGA Golf. That game came out several years later on the PC. Anybody can play this game even your children. The game holds your hand in the beginning but then lets you free to experience golf like a true professional. The first couple of leaderboard games released on the Amstrad weren't up to much graphically so thank goodness for world-class leaderboard because it righted all those graphical wrongs and get this I still play world-class leaderboard today. Number 2 Bruce Lee. Not only a fantastic game from US Gold but also probably one of the best games on the Amstrad. Definitely a top 10. It's a two-player game. There's lots of levels to explore. The difficulty is just right but saying that it must be one of the first games responsible for the phenomenon rage quit. Although he doesn't look it in this game Bruce Lee is hard as nails. It's a shame there's no in-game music and I wish the sound effects were better but everything plays as well if not better than the Commodore 64 original. It's that time again the ones that didn't quite make it but would easily feature in a top 20 and the first is Turbo Outrun on the Amstrad. Now this is a massive improvement over the Outrun original but saying that I know I know it's still not great. There are people that don't like the arcade original but I did and I like this version as well. It's more of a driving game than a racing game and don't get me wrong it doesn't hold a candle to the Commodore 64 version. I bought this back in the day and really enjoyed it. Would I like more speed? Of course and whoever drew the car they've definitely never seen a Ferrari F40. But all said and done this is Turbo Outrun. I thoroughly enjoyed it and it leaves the original stalled on the line. Ah Kung Fu master on the Amstrad. Absolutely brilliant. Such a shame that they didn't include the arcade music but it's the same challenge the same game finished in 8-bit and the great news is it's not a speccy port. Okay so our hero takes the lift in the arcade original he prefers the stairs but if you can complete this game you can complete the arcade and vice versa. It is missing that Genesee par but we have to remember this is an 8-bit and it's an Amstrad CPC. 1942 wasn't up to much on the Amstrad but 1943 is a whole different ball game. The player controls fighter airplanes to destroy the aircraft and warships of the Imperial Japanese Navy. It's far from being historically accurate but as an arcade game it's a thing of beauty. Mashiki Akamoto the producer of the game he come under criticism. People weren't happy that you control American aeroplanes to destroy the aircraft warships of the Imperial Japanese Navy. I get it because men and women on all sides are innocent really just following orders. I bet there's people out there thinking why on earth has he chosen emotion over supercycle winter sports winter games summer games California games. My answer to that is simple this is brilliant but don't panic we're going to need a part 2. Sadly it doesn't look as good as the Amiga or Atari ST versions but it's just as colorful and for me personally like the 16-bits it's an admissible experience. Now it's not as addictive as Tetris but this one got pretty damn close. An astonishing game then don't be without good old Nick Brutey and Dave Perry strike a game on the Amstrad and this one is a sight for sore eyes. The excellent artwork conceals shallow gameplay which ultimately means the programmers kept the game simple. Last fanatics will absolutely lap it up sadly it doesn't really provide any long-term challenge but graphically it's an absolute stunner one of the best on the Amstrad. It's also worth loading up just for the intro you won't be disappointed. Number one it had to be didn't it Gauntlet 2. Yes the original is fantastic and yes Deeper Dungeons is brilliant still but this is the one we all grew up on. This is the one that was the most fun playing with a mate and it was probably the first sequel worth the cash.  You can change the colour of your character and if two player you can both now choose the same character. One thing that I did annoy me is the music in the treasure room of the original is missing in Gauntlet 2 but if you want to see a top-class game squeezed into your Amstrad then look no further than Gauntlet 2. Well I hope you enjoyed this video like I've already mentioned this definitely needs a part two just for my own sanity. There's work still to do here please comment let me know your thoughts please like please subscribe please share but above all stay retro and until next time Tararabit


Thank you for being here. The purpose of this press conference is to announce two significant grant awards to Columbia Police Department. Joining me today is our city manager, Ms. Teresa Wilson, our mayor, Stephen Benjamin, CPD staff, it's throughout the room, ATF Special Agent and Charge Vince Pelosi. He's from Charlotte and it covers the field office here in Columbia. He is Assistant Special Agent and Charge of Primary Means also here, along with First Assistant U.S. Attorney Lance Crick. I'd also like to recognize Chris Seegers with the City of Columbia grant office. She helped very much so in preparing these grants that we're going to talk about today. So as you've heard me say many times now gun-related violence is high in Columbia. It's high compared to other cities of equal size. Recently we've experienced a precipitous increase in gun-related murders. In 2017, for example, 64 percent of our murders were committed by someone with a gun. In 2018 that rose to 75 percent and we're seeing so far this year we're about 80 percent meaning our murders are being perpetrated by people armed with a firearm. To address this issue we developed a comprehensive project safe neighborhood strategy that we announced and discussed this summer at a gathering in Greenview. Our strategy has five focus areas prevention and education, partnerships, evidence-based practices, technology and building trust. To further support our PSN strategy we applied for two federal grants that we believe fit perfectly within this PSN model. Those grants are the Crime Gun Intelligence Center Initiative grant and PSN funded National Integrated Ballistics Information Network which we talk about frequently as NIVAN analysts. The Crime Gun Intelligence Center grant that we have been awarded is a three-year grant $668,414. It's the second largest grant that we've ever received at the police department. The only larger grant was our COPS grant we received a couple years ago that exceeded a million dollars. This Crime Gun Intelligence Center will be comprised of a police inspector, an investigative sergeant, an investigative analyst, a civilian analyst, a ceasefire coordinator, a NIVAN analyst, and a NIVAN coordinator. The NIVAN analyst is funded through a separate PSN grant totaling $77,471. The combined award is $745,885, very significant. The NIVAN analyst uniquely will be embedded in the SLED lab and will be responsible for daily NIVAN entries submitted for analysis and examination. We believe that this will enhance the timeliness of actionable leads developed through NIVAN. This unit will be an interagency collaboration focused on the immediate collection, management, and analysis of gun crime evidence such as shell casings in an effort to identify shooters, disrupt criminal activity, and prevent future violence. We will rely on our already established and strong partnerships with ATF, the Richland County Sheriff's Department, SLED, SLED's lab, probation part and parole, the Midlands Gang Task Force, Fifth Circuit Solicitor, the United States Attorney's Office, and of course, and most importantly, our community. The primary goal of the Crime Gun Intelligence Unit is to identify armed violent offenders for the investigation and prosecution. We'll accomplish this through being data-driven, intelligence-led, while relying on effective police deployment strategies and technology. So let me tell you a little bit about what we refer to as our CG team, Crime Gun Intelligence Center team. The program coordinator is Inspector Jim Moduleski. Jim has 29 years of law enforcement experience. Prior to joining the police department, he had a distinguished career with ATF, last serving as the ATF Deputy Assistant Director of Office of Strategic Intelligence and Information. Jim and I worked together 25 years ago as field agents in Charlotte when we were assigned to the Violent Crime Task Force. He served the last about 18 months with us as our ceasefire coordinator, and I'm going to come back and talk a little bit further about our ceasefire program and the successes that we've had. The unit supervisor will be Sergeant Jeffrey Brink. He's an 11-year veteran of the police department. He's most recently been assigned to the North region as the supervisor. He has outstanding knowledge of our prolific offenders and the violent crime issues that plagued North Columbia. He has a bachelor's degree from Western Michigan, and he's an FBI Trilogy Award recipient. Investigator Cannon Fullmer is a nine-year veteran of the police department. He's been an investigator in CIB for the last five years, the last two specifically focusing on gun crime analysis. Prior to that, he also worked in the North region. Investigator Cannon holds both undergraduate and graduate degrees from University of South Carolina. Our analyst, Ms. Alicia Smith, is a civilian crime analyst who provides statistical intelligence-based information along with social networking analysis to assist staff with crime reduction strategies. She holds an undergraduate degree in psychology and a master's degree in criminal justice. Our nabbing analyst is Stanley Brown. He's had a distinguished 40-year career with the South Carolina State Highway Patrol. He's a former trooper of the year. He was a long-serving firearms instructor. Stanley has worked with the police department since last October, and he test fires every gun that we see, and he collects and puts together all the spent shell casings that we've collected for nabbing submission and analysis. I think you would agree this is a formidable thing. Again, their main goal will be the immediate collection of ballistic evidence, shell casings, and crime guns. All ballistic evidence is considered evidence of equal importance regardless of the circumstances of the recovery of the severity of the crime investigated. Simply put, whether there's a victim, not a victim, property damage, it's fatal, not fatal, or just a gun seizure. It all gets collected. Immediate, timely, and relevant nabbing processing of all crime guns and casings for the purposes of developing actionable investigative leads that lead to impactful prosecutions. Recovered guns will also be entered into ATF's eTrace system to identify the sources of the guns and how violent offenders have obtained guns. These processes should be initiated within 24 to 48 hours of collection of evidence. Third, the use of forensic technology to drive investigations and prosecutions on the most violent offenders who merit the full scrutiny of the criminal justice system. That would be that 5% we talk about that we feel like commits 90% of our crimes. All this coupled with the effective evidence-based interventions such as our focused deterrence and hotspot policing we believe will decrease the number of shootings in our neighborhoods, improve the quality of gun crime investigations, increase our clearance rates, have impactful prosecution outcomes, increase public trust and confidence in law enforcement through meaningful community engagement. So to recap my comments, two grants, Crime Gun Intelligence Center, the Knob and Analyst, and again tying that into our Project Safe Neighborhood Strategy, which has those five areas. Prevention and Education, we talked about this summer, our public service announcements, our youthful offender home visits we do, our gun lock program, our handle with care, our technology, NIBIN. We've talked at length about NIBIN and how much value that is to our investigative process, our shot spotter. Shot spotter detection fits so perfectly with what we're trying to do. Since we launched in April of this year, we've had 657 alerts. We average about 28 alerts a week. We've detected over 2,000 rounds of gunfire. We've seized 43 guns, made 35 arrests. It is impacting what we do. Evidence-based practices. I mentioned ceasefire and operation real-time. Operation real-time is our accelerated arrest program, a federal adoption program. It has immediate community impact. Our ceasefire program, ironically in this same location this coming Monday, we will have our fourth offender call-in. Our last call-in, we invited 31 people. We've only had four people re-offend. That's a 15% recidivism rate compared to about 70% national rate, so that's a success. We have our fourth call-in. We have 37 scheduled offenders coming here next Monday to hear our message and hear about our programs to prevent them from re-offending. Our partnerships. Our partnerships is really the foundation that all this is built on. A strong partnership with the U.S. Attorney's Office, the Fifth Circuit Solicitor. Our federal partners that we participate on all the federal task forces. Incredible strong partnership with ATF, and you'll hear more about that. Our Midlands Gang Task Force and our Gun Task Force and everyday working relationship we have with the Richland County Sheriff's Department. And last, building trust between Front Porch Roll Calls, our risk program, our community meetings, our Citizens Police Academy, our Citizen Advisory Council, our relationship with the Urban League and our summer programs and their internships. We have to build on those relationships and invest in partnerships and relationships every day. I'm obviously very excited about these two grants. I think it's going to change the narrative forever, that narrative of violent crime that has followed this city for way too long. Thank you Chief. On behalf of United States Attorney Sherry Leiden, I'd like to thank you all for being here today. I'd like to thank the Chief and the folks behind me for the vision, the dedication, the work that they've put in to bring us to this point today. I'm Lance Crick. I'm our first assistant with U.S. Attorney's Office for the District of South Carolina. And this is a very big day for Columbia, South Carolina. This is a day that has been coming for a while. And it literally is a game changer with the resources that the men and women in law enforcement, members of the community, city leadership, federal partners, federal prosecutors, state prosecutors can really put into effect immediately in order to secure the communities around Columbia. I think the Chief would agree, as would the men and women in the audience wearing badges, that collectively we would rather prevent and solve crimes. And these grants are an opportunity to take a big step in that direction. Every day, our goal, collectively as a group, is to secure these communities here in Columbia and certainly across the state. And our partnership with the Columbia Police Department has been a model to lift up for the entire state under Chief Holbrook's leadership, his dedication with his staff, his officers, not just to simply enforce the law, which is we stand out there ready to do that. Let me assure you, as he mentioned, we have a small percentage of folks committing the majority of our violent crimes, putting our folks in harm's way.  But the vision is bigger than that. The vision is to educate, to provide prevention. And also on the back end of the spectrum, to create opportunities for rehabilitation and reentry. And Chief Holbrook has done that since day one. I would encourage everyone if you can to come here next Monday for the fourth call in. It's a powerful moment and it's showing some real success right out of the gate. We work closely with CPD. And it's a daily communication between our offices. We are able to respond quickly, but we can only do so because we have great communication and relationships with CPD and our federal partners. And again, I am excited to be here today. This is a big day for Columbia and for our communities across Columbia. And I look forward to our continued partnerships. And thank you very much. First, I too would like to thank everybody for coming this morning. And I'd also like to thank Chief Holbrook for allowing me the opportunity to provide some brief remarks and also to commend him for his continued commitment in the fight against violent crime to protect the citizens of this community. For many years, the ATF Charlotte Field Division and the Columbia Police Department have enjoyed a great working relationship. And because of ongoing collaborative efforts, some of which you heard Chief Holbrook mention, we've experienced numerous successes in addressing violent crime, firearms trafficking and other public safety issues. Through our partnership, we are always seeking ways to make our community safer. This crime gun initiative and the grant you heard administered through the Bureau of Justice Assistance will certainly aid us in that endeavor. ATF is supportive of this program as it puts partnerships first. The key element in this grant is that our agencies work together to address violent gun crime. This initiative will utilize data, technology, and community engagement to identify crime trends, violent groups and individuals, and firearms traffickers, and will allow us to utilize resources more effectively. Investigative partners will share intelligence to swiftly investigate, apprehend, and prosecute those individuals engaged in and committing violent crime. The Columbia Police Department, as you heard, will continue with its utilization of NIVEN, which is the National Integrated Ballistic Information Network and E-Trace ATF's Electronic Firearms Tracing System. NIVEN is an automated ballistic imaging network managed by ATF that captures and compares ballistic evidence obtained from spent bullets, cartridge cases found at crime scenes, or test fired from confiscated weapons to aid in solving and preventing violent crimes involving firearms. This grant establishes a long-term commitment with Chief Holbrook and his department and will allow ATF and the Columbia Police Department to strengthen our resources and maximize investigative efforts. The ATF and the Columbia Police Department partnership is strong and we believe in this initiative.  We will make our community safer. I think we've also been joined by Councilman Ed McDowell and just very briefly want to say congratulations to the men and women of the Columbia Police Department to tell our leadership from the U.S. Attorney's Office, from ATF, all of our partners who may not be in the room from the solicitor's office and sheriff's office on sled probation program pardon services. Indeed, we had occasion several months ago Chief and I meet with the governor and he also sent a letter of support on behalf of this grant application. I believe strongly since my days years ago working in law enforcement that you hire good people. You give them the resources to do the job and at the end of the day you hold everyone accountable. A rigorous process led by our city manager several years ago brought Skip Holbrook here. He has assembled first-class command staff that I put up against anyone anywhere in the country and they're working aggressively using data but being driven by their heads and their hearts to work to make this city a safer place to be the leveraging incredible partnerships with all the entities represented here to make sure we do just that. America has a gun problem all across this country. There are as many guns on the streets as there are human beings on the street and communities like ours feel the pinch of it every single day so continue to make the investment yes in preventing gun crime and solving them by taking the the worst actors off the street is exactly where our focus ought to be and we're thankful to every member of the team. I do want to also as Chief Holbrook mentioned also thank Chris Seegers again. These applications are rigorous as you pull them together and over the last several years Chris has gotten better and better at helping us pursue these opportunities small ones and large ones like this alike but ones like this are the ones that make the big difference and help improve the quality of life for every single citizen. So thank y'all for being here. It warms my heart when I see our Chief get geeked up excited about an opportunity like this. They do a lot of very hard challenging things on a daily basis but when they are successful along with help from our other folks in the city like Chris and with grants to achieve something so substantial it it means a lot to for me to see that success. It rewards them but it keeps them motivated to keep doing even more. It motivates me. Our Mayor Councilman Dowell and all of council challenged me specifically because that's my job as the manager to be aggressive and creative in funding our most important public safety functions in times such as this all municipalities have tight budgets and so obviously when we can complement funding from grants it's very important for us to be able to move the needle forward with the combined efforts of what we do with general funds but those grant dollars mean everything and so I would challenge Chris and the Chief and everyone in the city to continue with such great efforts to complement what we're trying to do with grant funding. It means everything I mean I'm very proud of the hard work that they've done with this so thank you. Thank you all for being here. Thank you to our partners who are here and support the City of Columbia every day with the efforts. There's four and a half million dollars I believe of grant funds that they're already managing Chris so we're just adding to that and you know that shows we're being successful and being efficient with how we're budgeting and funding public safety. I want to thank our Chief. Our Chief has been very very proactive and every now and then I can get a smile out of him and this is one of the smiling days. I want to thank CPD and all of our partners who contribute and will give of time, talents, gifts and service. Thank you so much for being here. Thank you so much for being a part of our city's fabric. Thank you so much for allowing us to do what we do and to do it in a very effective and quantitative way. Thank you all so much. Hey there. Mayor Steve Benjamin here. Thanks for watching this video. Make sure you give it a like right below the video and don't forget to subscribe. Also while you're here be sure to check out one of our other videos or follow on our social media platforms. Thanks again and remember we are Columbia.