So this talk is called security is a process, but also just plugging in a computer is apparently a process as well So I'm sorry for you the delayed start here. I'll try and maybe go fast. So we'll have enough time So I've been working with WordPress for About 13 years now. It's just a really long time. It's about a it's more than a third of my life And one of my focuses over the years has been security But I'd like to start with a little game kind of break the ice So we're gonna play two truths and a lie I'm gonna tell you three things two of them will be true one of them will be false So first I discovered a major WordPress security issue while auditing code in my head in a church That's one two is I disclosed a major security issue to a web host and Which caused them to accidentally take down their entire network with a fix and Three is my first commit to WordPress contained a security flaw So let's let's have a show of hands who thinks it's the church one Okay, how about the taking down a blog host More for that one and who thinks my first commit to WordPress contained a security flaw is the lie Okay, and and who didn't raise their hand because you think like you know I'm just not the sort of person who raises a hand But now that I'm now I'm calling you out and recognizing that you exist as a person You suddenly feel the swelling urge to like raise your hand for the first time ever. Okay. Yeah, you're out there Okay, you you people who didn't answer you're actually right because all those all three of those things are true and Yeah, the lie was that there were just two of them So So if that minor deception makes you feel vaguely annoyed and distrustful Welcome to the security mindset so this is what I'm talking about today the mindset that you should have as you are coding and deploying sites and working with web applications and it's It's a mindset that allows you to treat security as a process that is integrated into all aspects of your development First thing you need to do is stop thinking about security as a destination as a place as like something you arrive at like We are now finally secure. It's not like, you know, step seven make our code secure. We're done Sure like in my consulting I have a lot of people hand me code and I have to review it and say okay It looks good or here are some issues that you could fix But really no real world code can ever be said To be completely secure even if a given piece of code is secure in a moment in time Tech is not static. This is all changing the compiler that the code runs on could change in a way that Changes how that code works a new web server could come along that changes everything web browsers could add new features and suddenly Markup that was was okay is now Insecure and has implications So as an example take something like click-jacking who's ever heard of click-jacking Yeah, it's a catchy name. I like it. So it used to be fine To allow your web page to be embedded in another one in an iframe Once browsers got the ability to use CSS to make anything transparent including an iframe You could have a situation like this This is a completely legit site Because it's you know verisign trusted and Oprah-approved so this is a fine site and then we have an iframe embedded which is Justin Bieber's Facebook page with a like button So you would know like if you click that what you were doing you'd be liking his page But since you can use CSS to style iframes you can do something like this So now when you click that button you're not getting an iPad you're liking Justin Bieber's page Which is fine as long as you know what you're doing So don't think of security as the destination think of it as a Process by which you apply security mindset to every step of the process I want you to think as you're coding and as your designing features How could this go wrong? How could data be harmful? How could it be transformed to be harmful? How could it be harmful when combined with other data? How could someone use their access maliciously to cause harm? What would happen if someone sent a request on behalf of a user who's allowed to do something and sort of tricks them into doing it? There's a Japanese term called a pokey. Okay, which roughly translates to mistake-proofing and I believe is popularized by Toyota many many decades ago in their manufacturing process and has all the implications for design especially UI and UX so like you know you've a Form field for your age like you can't enter a negative number there stop them before they do that but this This idea also has implications for the design of your coding interfaces So if a certain type of data is going to cause a problem throwing through your flowing through your application Don't let it get there in the first place stop that mistake before it happens You should trust no one This is Terrible life advice, but is really good security advice So when you're putting on your coder hat just be thinking that you know Don't trust the people that wrote the code you depend on who wrote the web server that you run on You know wordpress core the the plugins you may be using and Don't trust the people who use their code that they're gonna always use it in the You know angelic way that you imagine them using it Is it kind of like an anti John Lennon stance? Just imagine all the people being really terrible And just assume if someone can do something that causes harm assume that they will and it's your job to write code That remains secure even when everyone is being their worst self When I said no one I mean no one you can't even trust yourself So who thinks that they're a better coder now than they were two years ago, right? Hopefully you're not getting worse Actually, does anyone think they've gotten worse? Okay Usually I thought we'd have one troll so The code that you wrote two years ago was written by a worse coder Even though it was you it was a worse version of you and you should not trust that person And even the current version of you is going to make mistakes So you should design your code so that it is harder for you to make security mistakes and You should integrate that security mindset into your coding to enable that So it's not something that you do later like when you're done writing the application you say, okay Let's go through and security proof this. This is something that should start with your first line of code and continue through the process So what does that look like practically? So for example Intent is a thing that a lot not a lot of people consider Certainly you'd have to check to make sure someone is allowed to do something which is permissions So you do something like current user can to validate that make sure they have a certain capability But less obvious is that you need to validate a user's intent So if if anyone has ever used Siri or the Amazon one whose name I will not mention because there are people on the live stream at home I don't want to purchase a dollhouse for them or something by mistake You're probably familiar with accidentally ordering something or Calling the wrong person or something like that So I mean this is something that you were allowed to do but you didn't really intend to do and the same is true When you're working with a web application I may be allowed to delete a post which may be like a form submission that says like action equals delete post post ID equals 123 But if someone can submit that make me submit that Request and delete that post without me intending to that. That's a security issue So we have functions like WP nonce field and WP verify nonce That allows you to make sure that the request from a logged in user is is actually Intended and so you would use the first one in the form field To generate a token that is unique to them and to the action that they want to do so like for deleting post one two three for user ID for this is a unique string and on the other end you verify it with WP verify nonce and if that that feel that that token does not Validate then potentially someone is trying to trick me into doing that action Next you should make sure that the code or the data that flows through your code is aggressively sanitized So if something should be an integer Make sure it's an integer. Don't just assume that it is going to be just because all the code that you wrote You know Like whenever you use it you supply an integer But there are pathways that data can flow in that you may not anticipate so you should make sure that your code ensures that So many issues are just due to weird data showing up where it shouldn't show up I'm the big proponent of sanitizing both on the way in to storage like a database and on the way out So for example, let's take this code right we have set ID and get ID and With both of them, I'm casting to an integer So on the first one as I update the option I make I cast it to an integer and on the way out I cast it before I return it and also the second argument. There is a default Argument, so it's zero if it's not set So my certainty when I use these methods 100% that I'm going to get an integer when I use them And if you're using PHP 7 which I recommend you look into for code that does not need to be widely distributed So this for private code for a client or something like that PHP 7 is great just for speed reasons, but you can also do things like Enforce this at a lower level so I have type declarations right there in your function Definition and in the return. So the first one says int ID It will expect an integer and it'll also do friendly things like If you pass in one two three as a string It will cast it to an integer just like the the previous example did And then for the second one get ID the colon int says that it should return in and We'll do the same thing WordPress also has helpful functions that you can use to sanitize common things here's a bunch of them and There's also a filter that you can use to apply to all gets and sets of an option So that example that I showed before You can do something like this So it's just sanitize option and then underscore the name of your option So this ensures that even if someone like a third party is extending your code and they are Calling a get option directly This filter will still be on it. So they will get the data that they expect Best way to enforce all the sanitization throughout your code base is the dry principle. Don't repeat yourself So write code once so Instead of having like 27 different calls to get option littered throughout, you know 17 different code files put it in one place and Make a method for it. This is just so much nicer to read throughout your code And so this that long get option with a get cast to int that you have to remember to do every single time if you just have get I this get ID arrow get ID It's a lot nicer to read It also lets you do things like if you want to change how that option is stored So maybe it starts out as a standalone option like this But then it moves into a sub key of like an array of options as as your plug-in gets more functionality That's easy to do. There's one place to change it instead of 17 or 27, whatever and Then it gives you one place where the sanitization is happening when you can control what that value is as it goes in Or out of the database. I think you should create methods for everything Not only is this good for your sanity. Well coding it just limits the number of places where you could compromise your security I do a lot of code review and I can't tell you how many times I'm auditing someone's code and nine times It's perfect. They apply all the functions of the sanitization properly Escaping is correct and the 10th time they miss it and there's your hole It just you just need a tiny crack to get in For example, if your code looks like this, it's really easy to make a mistake like I did on the third line Forgot to run escape attribute Instead I could write something like this. So here's a method for text input and I supply the name of the setting and It runs escape attribute That's the option escape attribute on that prints it out So no matter how many of these I add to my code. I'm not going to introduce a security hole I've already taken care of it in one place And it's just It lowers the risk of introducing new code So escaping Escaping data is something that you should do according to the context that it's being used in So the WordPress security functions are named in a very helpful way according to their context So for example, you're probably familiar with these ones escape HTML when you're between HTML tags attributes for within HTML attributes and URL for within URL based attributes like source or href and for sequel queries you should You should use prepare to sanitize your or to escape your queries Well, first of all, you should probably be using WordPress API functions But you need to do something with a database that's not supported use for pair And this allows you to pass in your data as separately from the query So you don't run into problems So now the whatever is in that name variable gets stuck where that Percent s character is Of course, what should we do with this should make a method out of it? One people one mistake people make when escaping their data is doing it far too early. So Online 100 they're printing out an input or something and then they escape the the values that are getting Output there at line 5 and This is problematic because you might not know the context that you're going to use the data in until you're about to use it You might want to use it in multiple contexts. So you may have escaped it in the wrong format and it's also It's also hard to audit Your code when the escaping hap escaping happens far removed from the usage So when you see that Output you're going to say, okay, is this escaped I escaped this earlier now lots of scrolling okay here I did it a hundred lines earlier So it's much better to do it right as or right before you output that data Next you should update everything WordPress your plugins web server php your local operating system It doesn't matter how secure your WordPress code is if the the platform that it's running on or the platform They're using to access it isn't secure. You have all you have a security hold a lower level You also shouldn't trust your ISP or the people on your local network SSL can keep your browser server communication secure and In 2016 and I would argue or 2017 as well as last year There's no excuse for not having this Thanks the good work of the people that lets encrypt everyone can get a an SSL certificate free of charge often, you know auto updated and So you don't have to budget that separately And if you're using one of the web hosts like one of the fine sponsors of this event A lot of them are just going to give this to you free of charge as part of your hosting service Sometimes you have to opt into that I definitely recommend that at least for securing the WordPress admin And this one's interesting So I'm a little bit conflicted on this because it's definitely a good idea that WordPress is self updating Because you know if an exploit comes out we can update and push that out to to millions of WordPress installs But it also is a bit of a security issue if WordPress can write update its own files you might have an issue where a plugin exploit Allows code to be written and someone can write out a PHP shell To your server and then access it and get ongoing access So if you know that you're gonna be quickly updating your site If you're managing sites for clients and you're on top of this with something like managed WP where you know like Okay, these sites are out of date It can make sense to have the WordPress files not server writeable by the server user and It might make sense for you to use a deploy system To update those files Of course, there's one directory on your server that that pretty much has to be server writeable And that's the uploads folder so that WordPress can write out JPEGs when you upload them so if If I were writing a code vulnerability, that's the first place I would try and write like a PHP Shell is to that uploads directory because I'm pretty much assured that it's gonna be writeable So one in-depth defense trick you can use is to disable execution in this directory So you could have something like this in an HT access file in the uploads directory Of course, you'd want to make sure that that file is not server writeable. Otherwise, they can just delete it And here's how to do it on engine X saying anything in the uploads directory That ends in dot PHP just deny it So this this won't prevent them from Like if someone gets access to upload files PHP files somehow through an exploit They could still do it, but then they can't access that file through the browser and use it as a PHP shell So it essentially becomes inert Using git can be a good way to verify that all your files are as expected and have not been modified So like if you did a git diff any file modifications would show up Also lets you know if they say some other developer is cowboy coding and directly editing files on the server Which they shouldn't be doing And that's it a deploy script for this is could be a simple two-line affair We just get fetch to get the newest code and get reset hard to your origin master And of course if you're using git checkout, you don't want people to be able to access this git dot git data directory Over the web. So you're gonna use a saint a similar trick to like say block all dot files Or here block dot git and dot SVN directories So, but let's let's apply our security mindset to An even deeper level having production credentials in your repository is a bad idea I see a lot of people a lot clients do this where I go to check out their site and There's there the database password. So I go to run this locally and it's trying to connect to the production database and It's bad because first of all anyone who has access to your repository has those credentials and you might not want them to have it You also want to limit like the ways that someone could get those credentials and there will be come though There will come a day if you have production credentials distributed like this that someone sets up a local development environment and then Delete your production database I don't know did anyone see that the thread on reddit where someone's first day they set up a production environment and deleted everything Yeah sad day So you can check in a WP config file, but I would just keep those database credentials out of it and have like a separate file that is ignored by git like DB config dot PHP And then just have that sit on the on the server not checked in So this is something I debated including in this talk because it seems so basic We're all professional developers here. Certainly. We all use strong unique passwords, right? Yeah We don't not not every time not as much as we should So I came up with this acronym for choosing a good password and it stands for complex long unique and enigmatic Actually, the first version was I used for the e I used esoteric which proved to be too esoteric a word confused people So Complex so you should use, you know alpha characters symbols numeric should be long and when I say long I mean like longer than 16 characters all my passwords are in the 30 to 50 character range You should unique you should never be reusing passwords across sites because as soon as one gets compromised Then they can use that to gain access to other Accounts and enigmatic so like no personal information nothing that can be tied to you that people could really guess I was thinking about showing you some examples of secure passwords, but has anyone ever seen this xkcd comic Pretty popular one about advice about you know how there's there's more Entropy in a password like this then like an eight character random garbled characters password So the problem of this is that I actually had a sysadmin set up an account for me and use this exact password Not very unique So I'm not going to show you examples and but really you shouldn't be creating your own passwords in your brain You should be using a password manager.  You can say I don't know and then when they break up with you. You can blame me So let's review and as we do I'd like you to start thinking about the questions You'd like to ask so that we don't have that awkward minute of silence where I ask you if there are any questions And there are crickets so start thinking So security mindset, I want you to remember that Security is a process not a destination integrate it into every step of the development process Ask yourself, how could this go wrong? How could data be misused? How could be transformed? Trust no one ever assume everyone's gonna abuse their power except that the data you get is gonna be wrong or malicious You sanitization and escaping to prevent bad bad data from causing security issues Validate the intent so no one can trick your users into doing something they don't mean to do and Keep everything updated every piece of software on the server and on your local machine and When you're coding distrust yourself set things up so that you have to work really hard to introduce a security issue and Create methods for everything so that your code is clean and you minimize those danger zones where you need to escape or sanitize data and One last thing before I open it up When you're done working for the day forget everything I said because all this is great for security But you don't want to be this person right So that's it. Thank you Thank you mark now we have time for maybe two or three questions at the very most What we'd like to do this time is have people queuing up at the mic stands that are dotted around here here here in here Does anyone have any questions they'd like to ask mark? If you make your way to a stand Please even with warning we have the awkward silence And maybe you're all good. Yeah, we have a question coming down below. Thank you. I Guessed you hear this a lot, but why is WordPress still supporting PHP 5.2 Yeah, why is WordPress still run PHP 5.2 because there are still people using it Does anyone have the latest stat the stats are public? I'm sure there's like a nascent here knows it off the top of his head Seven Seven okay, so that's that's getting I think about to the point where we dropped PHP 4 support I think it was somewhere in that range So I think we'll be doing that soon, of course We're gonna be updating them in a requirement to 5.3, which of course is also woefully outdated But the reason is because people are still are still using it and we don't want to break their sites And there's always a trade-off, you know, do we want to make the hard decision and eventually we do But we don't want to be you know, I think Matt said it wants, you know 15% of our user base is like the population population of a major city That's a lot of people to be just kind of turning out the lights for We have questions down. We also work with web posts to encourage them to have the latest version So we are proactive in that sense. Absolutely question down here, please. Hello. I've got a question about security in distributed code like Are are all the releases signed by someone with GBG or are all the updates signed like why should I plan we trust someone if that's not signed Yeah SSL Definitely helps with that, but it's it's not a complete solution and there is an ongoing debate because of our You know our minimum version of PHP. There are certain things that we I am talking about Like like signing git tags or suppression tags So I know that that's what you release not what my ISP is actually giving me Right. Um, so you're talking like for updating WordPress itself or just like when you're working with your own repo Yeah, with your own repo, especially because it is open source. So Yeah, so like git itself has way to sign commits and sign tags and are you guys doing that?  Okay, Jolly Hi There are a lot of WordPress security plugins out there most of them are pretty terrible my opinion What what plugins would you recommend to use and which ones would you recommend to avoid for? plugins in general or for security the security WordPress plugins. Yeah. Yeah, the What's it called the I themes one Aaron? Where are you? I? Think security is a good one. I've I've I helped Aaron in years past look over that look over their feature set Securey I recommend there was a web application firewall Which is like sort of like cloud flare on steroids where it can you know cache data I've also protect against exploits at their level before things even hit your server Those are good There's the the jetpack one Brute protect Jetpack. Yeah, well jetpack has has a has one as well Those are good. I recommend those Yeah, I'd also recommend having two-factor authentication as well as I think you lean in a little bit more again, sorry When you're managing a big network of sites having two-factor Authentication is really important as well. Yes, that's a lot of brute-forcing on the ad WP admin. Absolutely Great. Well folks. Thank you most group. Please don't thank Mark.


We'll call the meeting in order for Thursday, September 13th of the Capitol City Council. May I have a roll call, please? Council Member Peterson. Here. Council Member Botcher. Here. Mayor Termini. I will rise and join me in the Pledge of Allegiance. I pledge allegiance to the light of the United States of America and to the Republic for which it stands, one nation, under God, indivisible, with liberty and justice for all. We have some presentations tonight, and the first is the Children's Cancer Awareness Month Proclamation to the folks at Jacobs Heart, and who do we have here?  I'm Sue Quijano from Jacobs Heart. Oh, you don't get to do it from there. You get to come up here. I have to go up and say it? Yes. All the way. All three of you need to come up here. I know, I know Jacobs Heart's people, and you really like being in the background, and I love you for it, but not tonight. Honoring Jacobs Heart's Children's Cancer Support Services for 20 years of service to our community's families and declaring September 2018 as Childhood Cancer Awareness Month. Whereas in 2018, Jacobs Heart Children's Cancer Support Services marked its 20th year of providing local, family-centered care for those impacted by childhood cancer, and whereas each year, one in 285 children in our community are diagnosed with cancer, and whereas despite improved survival rates, cancer remains the leading cause of death by disease among children, and whereas families of children with cancer in the city of Capitola receive essential services from Jacobs Heart Children's Cancer Support Services, a local organization that has gained national awards and recognition for improving the quality of life for hundreds of local children with cancer and their family members, and whereas Jacobs Heart holds the memories and honors legacies of hundreds of children from our local community who have been lost to cancer, and whereas the oncology department at Lucille Packard Children's Hospital at Stanford has worked closely with Jacobs Heart for 20 years and has trusted as a trusted community partner in providing care that addresses the emotional, practical, and financial struggles of families of children with cancer in Capitola and beyond, and whereas Capitola urges its residents to recognize the impact of pediatric cancer on families within our community and to honor local children whose lives have been cut short by cancer, now therefore I, Michael Termini, mayor of the city of Capitola, hereby declare September as Childhood Cancer Awareness Month in the city of Capitola, and honor Jacobs Heart Cancer Support Services for two decades about standing support in our community applause is appropriate. Thank you. Thank you, Mayor Termini. I want to thank you, Mayor, as well as the City Council for honoring children with cancer by proclaiming September to be Childhood Cancer Awareness Month. Your dedication makes a tremendous difference in the lives of the children and the families here in our local community. I would also like to invite everyone here. We have some wonderful events happening that are awareness, cancer awareness events, but they're fun events for families and children of all ages and parents. The first one is in Watsonville, Sunday, September 23rd from 12 to 5 at the Watsonville City Plaza, and the second one is in Monterey for those people who would like to travel down there. It's at Custom House, and it's October 21st from 11 to 4. I also have with me today two wonderful parents from Jacobs Heart. Let's see Steve and Leah have a daughter, Grace, who is a current Jacobs Heart child, and I think Leah's going to say something as well. I want to thank everyone, and especially to this community and all of our Santa Cruz communities for supporting Jacobs Heart. Our children just light up and they could just be children and have fun and not worry about appointments at all of the events and they enjoy all the food and gifts that they get from all of our local businesses. Our journey began on February 23rd when our daughter was diagnosed and admitted to Lucille Packard, Children's Hospital. Lucille Packard connected us with Jacobs Heart and they just worked a miracle. We are now part of a community of families and parents that understand our new life and you know without words being said they support and the staff at Jacobs Heart from our community support is able to give families what they need so that we could take care of our children and each other. So I thank you very, very much. Thank you and I might add that you know you go beyond being servants, you're warriors, and we love you. Thank you. The next item on our agenda is introducing our new building official. Good evening, Mr. Mayor and Council. This is a great moment to introduce Robin Woodman as our new building official of the city of Capitola. Robin comes to us with over 20 years of experience working for different building departments including nine years at Foster City. She's worked for the city of Santa Cruz, for the county of Santa Cruz and also for the city of Watsonville and she's now fulfilling her I think dream of always working for everyone in this county and working as the building official for the city of Capitola under a joint position sharing with Scots Valley and so far we're I think Robin's stepped into the position. She's learning to wear two hats at each place and is doing a great job. So here's Robin Woodman. Thank you. Say hi. We've we've allotted you 20 minutes. Go right ahead. We've been waiting a long time for you so we're happy to have you. Yes, absolutely. I'm actually happy. Thank you for joining us. Welcome. We have another new employee, a new recreation supervisor, which we're very excited about. Yeah, Mr. Mayor, members of the council, it's my pleasure to introduce Nikki Bryant as our new recreation supervisor. Nikki emerged out of the most one of the most competitive recruitment fields that we've seen in a number of years at the city of Capitola. There's a lot of people that want to do public recreation and Nikki, through the course of the interview and the selection process really rose to the top. She's been working in recreation and public sector. She can talk more about it for her whole life. She grew up in Texas, I believe, and went to the University of Texas and got a graduate degree in Texas as well. And then she came here and has been working in the R region for since 2004, I believe. For the past decade, she's been working at Hidden Villa, which is a camp over the hill, actually in Los Altos Hills, that I attended when I was a young lad. And it's a really sort of unique place, enjoys unique place in my own personal heart, just because I had some wonderful experiences there. And it's with that, and one of the other things that she brings a whole host of other skills outside of management and recreation, including lifeguard experience, ropes course, rock climbing, circus arts. And in addition, I just found out today, she knows something about archery as well. So, well versed with that, welcome to our city. Mr. Mayor, Council Members, thank you very much for the opportunity to introduce myself. I'm really excited to be joining the City of Capitola and the Recreation Department. Yeah, I've been involved in this business for my whole life. And I've had one week so far to be able to get to know the staff at the Rec Center. And I'm just absolutely delighted that we are so resource rich with the current staff that we have there, the experience that they bring, and the ideas that they have in order to be able to really enliven our recreation program. And the opportunity is that the Recreation Center has to, again, be able to offer a really dynamic program to the community. So I'm excited to get to work and see what we can offer for this community. You'll find that Capitola is very much one big summer camp. So I think you'll have a good time here. Thank you very much. Thank you. Welcome. Thank you. Do we have a report on closed session, please? No reportable action. Thank you. Before I go further, I would like to let you know that we're being broadcast live on Channel 8, AT&T, and U-verse Channel 99. Our technician tonight is Lynn Dutton. Please keep your cell phones off and sign your name when you come up to speak to us. And we'll go on to any additional materials. We had one communication that was received today. There's copies on the dais, as well as the back communication for item 9B. Very good. Thank you. Are there any additions to the agenda? Staff has no changes. Now we'll go on to public comments. This is the time where anyone from the public can address the Council on items that are not on this evening's agenda. Is there anyone who would like to speak to us on items not on tonight's agenda? Then we'll move on to City Council and Treasurer comments. Mr. Treasurer, what do you have to say to us? I'd like to talk a little bit about the Committee on the Environment, because we've got a big event coming up that one of you, at least, has been involved in. And that is the Peary Park Soquel Creek Restoration Project, which has been dragging on, it seems for a while, started out with several volunteer events. We did Ivy Poles. We did replanting. And then we kind of got bogged down because we needed some extra money, which the Council provided in the way of surplus dedicated tree fund money, but also because we needed permission from the Fish and Game Department. So we cleared that last hurdle because Kalish did his Wood Rat Survey and passed. And now, as of starting September 24th, George McMahon and his crew will be out there for at least three days, finally getting down to the creek bed and finishing the job we started. What was it, three years ago now? And you might want to go down there and sometime that week and take a look at his progress because if you like what he's done, there are certainly opportunities to go across the creek to look at Noble Gulch and try to restore the creek along larger periods of its length. So I appreciate any efforts to take a look at that. What were those dates again? September 24th is the Monday and he's tentatively finishing the 27th. Great. Thank you very much. Staff, any comments? I think Steve has an update for us on some public works projects that are underway. Good evening, Mayor and Council. Quick update. The Slurry Seal Project will be hitting its stride next week. We'll be doing work on various streets throughout the city and people can expect detours, road closures. We'll try and keep local residents and businesses access as best we can, but there will be some certain amount of inconvenience every day next week on various streets. They're going to kind of bounce around different streets, do part of the street and then come back the next day and finish it. They'll be in and around. If anybody needs an exact schedule, they can call Public Works Office. 38th Avenue, the sidewalk project there. That'll be, I understand, kicking off next Tuesday with the demolition of some existing sidewalk there and should take about a couple of weeks to complete. Great. And we've been seeing you preparing for the Slurry Seal around town and we appreciate that. Park and lot? In addition, the Community Center Park and lot is going to be included as part of this project. You'll recall the Council gave authorization to add that as a change order. And so that's actually going to be tomorrow. And that's the Jade Street Park Community Center Park and lot along with the tennis courts. So the basketball court is going to be slurry sealed as part of the Slurry Seal project. Wonderful. That's great. Good to hear. Council, Ed. You know, we sometimes pay attention to the city's departments and give them acknowledgement our police department and Public Works do an excellent job. But one group that sometimes we don't acknowledge is the Central Fire Protection District, which provides fire protection. And last night there was a fire in the village 206 Capitol Avenue behind where Beach House rentals is at. And I went by and looked at the building today and I just want to put a shout out to the fire department for a very quick response. I think it's fortunate that they happen to be a thousand feet away from the fire station where they are, which helped. But the location of the building where the fire was in the back of the building was adjacent to three other properties. And the fact that, you know, where it was in the wooden exposure, it could have spread very rapidly. And I think we're all very fortunate for a great response and a good stop.  I believe it was the cooks from the kitchen at Bellaroma. Just a good community effort to get out there and I just want to acknowledge that effort. Also in the City Council, time to time we receive letters from people and sometimes we're able to respond to those letters and there's a service that's around town right now which I'm a big fan of. It's called Next Door. And a lot of good comes out of Next Door when it comes to advice that helps protect people, things about coyotes in the neighborhood. But sometimes there's threads that start on there that just get into the weeds quite a bit. So just a little clarification. I just want to shed a little light on one story. There's a building across from City Hall that's been under construction for quite a while across the street over here. And we've had some metal plates in the street for quite a long time. And lots of letters indicate that it's some kind of miscoordination project between the property owner and the city. And in this case, unfortunately, it's seemed to be a mistake and an error in the fault of PG&E. And that's been verified and the city has been trying to do everything they could to expedite the project along with the property owner. So just for clarification, it was not the city or the property owner. It's a PG&E problem. And in addition to that, there's concern about the building being illegal in height. And we have an ordinance in the city that allows in this zone for buildings to be 27 feet tall. I did a rough estimate today with some eyeball calculations and awkward measurements and came up with 26 feet, 6 inches. I went to the building department today planning and had them confirm. And it wasn't too bad. It's actually 26 feet, 8 inches, which puts it 4 inches less than the maximum. So I just want to acknowledge that the facts are always here. We're always available if somebody wants to write us and ask a question, whether it's the police department, public works or any other department, we'd be happy to do it. But just maybe the innuendo can just calm down a little bit. And last of all, I would like to place something in the agenda, Mr. Mayor, for a future meeting. I'd like to bring up an item about maybe possibly establishing an ordinance to remove council members from receiving pensions. Good. I'm there for you. That's it. Kristen? Yeah. I just have two quick things. One is I just want to remind everyone there's still time to sign up for the Capitola Foundation Golf Tournament. It is a charity golf tournament. And the money that we raise there goes back to good causes in the community. And you can sign up for that at capitolafoundation.org. The other one, I would like to ask for a future agenda item.  And I would like to see that come back on a future agenda with a resolution of support. And perhaps we can get a presentation by them so that we know what we're supporting and the ramifications of such support. We can do that. Wonderful. Thank you. Well, unless you were under a rock all weekend, you realized that we invited 10 or 20,000 of our closest friends from everywhere to join us at the Capitola Art & Wine Festival. It was a great event. And it was brought home to me because I usually pass out on Saturday night and then wake up and do it on Sunday again. But I actually tried to go out to dinner on Saturday night. And everywhere, every place was standing remotely. I never realized the impact that that event had on the community at large. There were no tables anywhere. And it was just great. Everyone was having a good time. And it was flawless. And I also want to shout out, not only to all the people who put it on, but our police department from Park and Patrol, community service, officers, sergeants, our captain, our police chief, they worked double time on this. And I believe that there were no significant increases in calls for service in spite of the fact that we invited our 10,000 closest friends and then got them drunk. But they were very respectful, and they were drinking wine in a very appropriate way. And it was nicely done, and only in Capitola. Just amazing. I would also like to announce that I'm your representative on the Monterey Bay Community Power Board. This is the power acquisition group that now supplies three counties with power, unless you opt out. They supply power at the exact same price PG&E, supplies power to you. And we're just about ready to give out our 3%, perhaps 5% rebate at the end of this year, which will save everyone that much. But more importantly, after less than five months providing power to everyone, we are retiring two significant debts, a revolving line of credit and a standing line of credit. And if you recall at one of our council meetings, we guaranteed that debt as a city. So all the cities and the counties no longer are on the hook for that debt. It has paid off and we're free and clear. And we're looking for, in the first year, three to seven million dollars' worth of projects going back into these three counties for renewable resources. We also became carbon-free a decade ahead of time. All the power that is supplying us in these three counties has zero carbon footprint. It is all from solar, wind and hydro. In the next five years, we hope to shed hydro because it's not sustainable, but it is carbon-free and we will get all 100% of our power from wind and solar. So anyone who told you five years ago that it would be impossible to get off of fossil fuel, sorry, we went and did it and we did it ahead of time. Sure. Feel free to applaud us. And then if there are no other comments, we will move on to our consent calendar item that we usually take on a single vote. Is there anyone from the public who would like to pull anything on consent? Any of the council? I have one item I'd like to comment on and that's item E, the contract for local hazard mitigation plan update.  We always have to be ready. We live on the coast. Things can hit us just as likely and we are prepared and we work to be prepared on a daily basis. They're having 13-foot seas coming ashore. I think what 13 feet on the Esplanade would look like and count your blessings. So I'll consider a motion to approve a consent calendar. Second. All in favor? I opposed. Consent passes. We'll go on to general government. We'll receive a report on the status of the construction of the Capitola Branch Library. Good evening, Mayor and Council. I have a very short update here for you tonight. I'll quickly give you the status on various items that are affecting the construction. First was the amendment to the Library Facilities Financing Authority amendment, which will bring $2 million, an additional $2 million to our project. With the adoption of the consent agenda a moment ago, you approved that amendment for the City of Capitola. The City of Santa Cruz approved it last Tuesday and it is on schedule to be approved by the City of Scotts Valley on September 19th and then the County of Santa Cruz on September 25th. So those will be the necessary approvals to complete that amendment and bring that additional funding to our project. As you're aware we have awarded a construction contract to auto construction. That contract we've gone through, it's quite a bit to put the size contract together and at this point they have signed the contract and it is transferred to us. We expect it to come in tomorrow in which case we will then sign it and have an official contract in place with auto construction. A big part of the award that we made was completing two cost-saving change orders for about $787,000. We've actually broken it into two change orders. First one is rather easy to put together. It involved items that didn't need a lot of redesign. That's about $300,000. We have given that detail to auto construction and we should have the pricing from it either tomorrow or early next week. Early first indications I got late this afternoon that we're coming in very close to that price if not slightly under. The second change order which will have a value of about $487,000 that actually involves some redesign of the primarily of the foundation and mechanical systems in the building. Those design improvements are being made right now. We plan on issuing that sometime next week to auto construction and then get a price from them a few weeks later. Everything is on schedule or is moving forward and looking at the budget and schedule. The anticipated construction cost since this includes the $787,000 bioengineering is $11,556,000. The budget at this point which includes the $2 million from the library financing facilities financing authority is $11,706,000. We currently have a balance of $150,000 to the good just in the construction budget. We also have on top of that an $838,000 contingency which is 7.3% of the construction budget. Right now everything is looking good for that. We also have about $700,000 in the furniture budget which I didn't include in the slide which is more than enough to put the necessary equipment and furniture in the library. If things continue at the pace they're going right now we anticipate the contractor mobilizing in mid-October and we tentatively have a groundbreaking ceremony scheduled in early November. That is the extent of my report. Thank you. Anyone from the public like to speak on this item? Seeing none. Council? I've been opposed to this project from the start and always concerned about the finances and it seems like through some work in public works and some residual money it's not as big a dent into the city as we originally started so I'm liking the way it's going. Thank you. Kristen? I'm excited and I can't wait for the groundbreaking. Don't let it slip any further. Okay. This is just to be part so we don't have to moan no motion. This is just to receive the status report. Next item is consider a request for sponsorship the capitol water festival consider and it's for our grant and I think we have one of the officers of the capitol of beach festival formerly of the capitol begonia festival and I may have misspoke when I first said that this is a grant for the beach festival not the begonia festival. Sorry about that. Please step up and color? We have a short staff report and then we'll turn it over to the glossy all those things. Okay. I have a short staff report. We'll move on first with the staff report and then we'll have the beach festival give their presentation. Mr. City Manager, oh Mr. Assistant City Manager. Good evening Mr. Mayor Council members. So just a little little background the city received a request from the treasure of the capitol beach festival for a $5,000 grant sponsorship. Prior to 2017 the city had actually sponsored the begonia festival in the amount of $5,000 a year. Last year the begonia festival did not make that request. The line item was not budgeted in 2018. Sponsorship if approved could come from the city manager unanticipated events fund. What staff is looking for is direction from the council on the sponsorship of the festival. I'm here for any questions? Questions of staff? Seeing none. Step up. Festival people. Hi my name is Teresa Green. I'm the treasurer for the capitol beach festival and this is Laurie Hill also a member of the beach festival team. I did notice in the agenda that it says water festival that ought to be corrected. The official name is capitol beach festival. We went back and forth and back and forth. Yes we did. It seems like the community was not too happy with the end of the begonia festival and there were lots of requests for a follow-on event and so over the year we have put together the capitol beach festival which incorporates a lot of the elements of the begonia festival without the begonias. I want to announce that that festival will be held the 29th and 30th of September the last weekend September and it will have several of the most popular events that we've had in the past that being the sand sculpture contest the fishing derby the rowboat races horse shoes and chalk heart on the seawall. New this year we're going to have a little wharf three mile race sponsored by the wharf to wharf committee and we're also changing the begonia laden floats to lighted floats that will be Saturday night so that'll be a little bit different than than usual. The city has always been a generous supporter of the begonia festival and we are asking that you continue that support for this family friendly and fun event for this year so that we can continue these types of activities for our community. So we are asking and we have submitted a letter to the city manager for a request for sponsorship of $5,000 for the festival. Thank you anything to add Laurie you're good what anyone else oh go step right up please. Dear mayor and council this is not just another festival barging in on the village this is the celebration of as much of the capitol begonia festival as as the team could muster up without begonias and it's put on by the same volunteers. There was a time dear city that the city not only sponsored the event with cash but also waived all of the special event permit fees. Permit fees can run $5,000 the liability insurance runs $1,500 the porta potties run $1,000. What I'm asking the council to consider is this is the opportunity to have yet another event that celebrates the community of capitol and everything that it represents all it's asking is for the community to come out and play to a bunch of wonderful family events and we are asking for the $5,000 that traditionally helped fund the begonia festival the beach transitioned over to this new beach festival thank you so much thank you Laurie is there anyone oh would anyone else in the public like to address the council then we'll bring it back Ed I think it's great to try to continue the condition I think that people were saddened by the end of the begonia festival and I don't have a problem I'll make a motion to authorize $5,000 for the beach festival is there a second second anything to add you know I just I do want to say that I feel like we are writing the next generation of capitol history right now because the begonia festival was such a part of capitolist history it's on our street signs it's in our museum you can go see it all over the place and now that the begonias are gone I feel like we're this is the next generation of celebrations family friendly spirit of community kind of celebrations in capitol and so I'm really excited about it and I do second that motion and I won't make a lot of comments because as you know I'm the president of the capitol beach festival committee so I was kind of staying in the background until I felt the tone and the hardest thing about it is containing the efforts and excitement of the committee members I have never seen a committee more self-motivated and out to do things it's it's a it's a total joy all in favor I opposed so moved thank you very much festival people we'll move on to fiscal year 2018-19 sales tax revenue update yes good evening mayor and council I would like to pride you with an update on sales tax revenues and a little bit of overview on just general fund revenues in general so just as a way of background the fiscal year 18-19 budget has 12.4 million of tax revenues budgeted in there representing 78 percent of all general fund revenues 49 percent of that is from sales tax revenues in the amount of 7.8 million and just also that budget we had during the budget process reduced our sales tax growth estimates down to zero percent after we got the 16-17 numbers showing that after multiple years of increases that had dropped down to a little less than three quarters of one percent the city works with a consultant that provides sales tax reports and sales tax audits and generally what happens is the data from the state comes in several months after the actual payments come in and then that consultant goes out and analyzes all the data and it tells us where that sales tax revenue is coming from which businesses with which industries what's going up what's going down the first two quarters of last fiscal year our numbers and they have for years matched exactly with what the consultant was talking about so the first quarter we saw 3.1 increase then the second quarter we saw 2.9 decrease which caused us a little bit of concern as we were going through the budgeting process but again those amounts were consistent with what our consultant was reporting to us in january the california department of tax and fee administration formally the board of equalization implemented a new software program they went to an electronic format and as with any huge software implementation there's been quite a few bugs with that causing a lot of merchants across the state to have to file paper returns and those paper returns are coming in at the last minute and being processed really slow so as a result of that when we get the reports from the consultant we're seeing different numbers than what we're actually receiving in payments so in the third quarter you can see our cash payments show reflected a 4.8 percent decrease but the reports from the consultant were showing a 1.8 percent increase and the last payment which just came in a couple of weeks ago indicates a 6.3 percent decrease and we're still waiting for the reports from the consultant which we should be getting shortly but what we're hearing is that it's probably not a 6.3 percent decrease but all of this as you can see is causing a lot of erratic kind of behavior within sales tax revenues which again is our largest general fund revenue source and then the CDTFA because it wouldn't be complete without an acronym for the state is reporting that they had 80,000 unprocessed sales tax returns from the first two quarters or I'm sorry from the third and fourth quarter from fiscal year 18-19 in addition to that as we're all well aware orchard supply announced that they'll be closing the Capitola location on October 20th and Sears will be closing their Sears location in Capitola by the end of November these are two of our top 10 sales tax generators representing about 4 percent of total sales tax revenue and Lowe's companies which is the owner of orchard supply hardware is currently doing an evaluation of all 99 locations that they're closing and trying to determine from a business standpoint do they want to get out of each lease or do they want a sublease so city staff has been in contact with the Al family who's the property owner of the Osh location and we'll stay in contact with them as we learn more information and keep council advised of that Saratage growth properties which is the owner of the Sears property hasn't let us know what their intentions are but they probably aren't a similar situation where they're figuring out if they're going to lease to other merchants or if they're going to just outright sell the property and staff has reached out to them as well just still waiting to hear back on what their intentions will be we will continue to receive sales tax revenues until closure at both locations I've been into the Osh store recently there's a lot of activity but they're they're discounting prices so I think we may see more activity but with reduced sales prices I don't want to hedge that we might see an increase a slight temporary increase on the sales tax revenue and then also the Olive Garden will be opening in late October or anticipated open late October early November and while generally restaurants don't provide the same level of activity that will be a provide some offset to the loss of revenues in the current fiscal year as a reminder some other we have a couple of revenue based ballot measures coming up in November first is the transit occupancy tax voters will be voting on if they want to increase from 10 percent to 12 percent that 2 percent increase on the ballot measure they'll be deciding well part of the ballot measure is that 0.4 percent would go to local businesses 0.35 percent would go to youth program so that makes that requirement for passage two-thirds vote leaving 1.25 percent of that revenue if approved going to the general fund if it is approved it becomes effective January first and provides really some relief on the sales tax front or on the on the revenue front in the current fiscal year the other measure is the cannabis business tax establishing a 7 percent business tax on retail cannabis sales that 100 percent of that would go directly to the general fund but that would take a little bit of time to get going so if it is approved we don't anticipate seeing anything in the current fiscal year that would probably come sometime after July of 2019 as a reminder 18 19 budget we did not include any of those anticipated revenues related to the ballot measures so if they are approved it would be additional revenue that's not currently budgeted as far as next steps we're going to continue to closely monitor all the sales tax data again I think we'll see the April to June data should be available within the next couple of weeks and then our consultant that helps us go through all of that is working on a reconciliation of all the economic activity versus our actual cash receipts the what we want to use that reconciliation for is to request payments from the state to make us whole makeup payments if you will and accrue some of those back to fiscal year 17 18 and then keep be able to provide council with regular accurate data for the current fiscal year if those ballot measures fail or if the tax data shows declines then then staff will be coming back to the council with budget options for consideration and that would happen prior to mid-year so we would be back earlier than normal with our mid-year with at least that piece of it and that completes my presentation I'd be happy to answer any questions Christian questions no questions anyone from the public like to address the council on this item seeing none this is just receiving a report so we'll move on to the bike share program overview okay there's a short recess while council member bottof fixes technical difficulties his microphone became unplugged I'm going to try and figure out how he did that and no I would never do that intentionally I'm going to be chairing on that okay I understand it's your new new territories okay there we go welcome Katie good to see you good evening Mr. Mayor Termini and council members this evening I'm going to give you a presentation and overview on bike share and whether or not you'd like to start initiate the process for bike share in the city of Capitola over the past 10 years there's been great strides and long-range planning here at the city of capitol including a capitol of bike transportation plan in 2011 the update of the capitol a general plan and also the climate action plan all of these documents talk about multimodal transportation in the future in lowering our carbon footprint for the city and specifically within the bike plan there's it calls out a future bike share program and I'm sorry and the climate action plan talks about a bike share program and the bicycle transportation plan sets goals for more bicycle ridership by the year 2020 bike share growth is on a uphill swing for throughout the United States and globally you can see in this graph since 2010 it's really taken off the ridership numbers are incredible in the like 30 million towards total number of trips taken in the 2016 20 sorry 2017 numbers the trend continues why is this trend occurring it's because of these the new bikes and the smart technology that's that they provide as well as the decreased cost to municipalities for implementing bike share programs in their cities prior to the new systems cities were actually putting money into the bike share programs and managing them themselves with the new smart technology and the e-bikes the electric assist bikes that they're easier to read they're also they've got built in gps systems in which you can track where the bicycles are at so managing a system remotely is a common task for these new companies the payment is also done remotely through your phone and the bikes have the ability to be dockless and can lock self lock themselves so that can be a a good thing and a bad thing where we're learning that setting requirements for locking is a good thing in terms of pedestrian flow but just an overview this is a picture of the jump bikes app and related to Santa Cruz so with the gps you're able to look on your phone see where a bike is available in red and once you've located the bike you can go up to it pay for the you download the app pay for the bicycle on your phone and take off on a ride and then you can return it anywhere within their system or pay a fee to park it outside the system so why am I here tonight I'm here to see if the city council is interested in staff initiating efforts towards bringing a bike share program to the city to do that there's four steps we'd have to take to get this off and running the first is to reach out to the public and find out if there's interest in a bike share program and to do our research next would be to select a vendor there's several steps in updating the municipal code that would have to be addressed and then also before setting up any locations in which parking stations would be provided this you know they'd have to we'd have to establish encroachment permits so within the first step of public outreach options we can do a community survey also we're thinking bringing presentations to both the commission on the environment and the traffic and parking committee and then in house we'd be doing research gathering we'd be looking at best practices we've already begun that in the initial research and then contacting bike share companies and see what are the different programs they offer and also looking at regional coordination to make sure that these systems can operate interchangeably with other areas in the region as we're seeing many bike jumps jump bikes in our in capitol of these days from the program at Santa Cruz and once we've done our research and found out what the public is interested we would identify the appropriate program parameters and then bring that back to the council with our recommendation of what a system should look like for the city and following that would be the step of going out and selecting a vendor that would fit within our program parameters there's quite a few different new it's a ever-growing trend right now for the bike share so there's a lot of different companies out there that are available and the third step would be to update the municipal code specifically street vending right now is not is prohibited within the code so any jump bikes that would come into our city right now they actually are prohibited especially within the village but you can come to the city of capitol and put your bike on pause while you go enjoy lunch and then you get back on your bike and you've got to bring it back into the area in which it's allowed we would also need to update our encroachment permit program to look at exactly is do is there anything standing in the way of allowing encroachment permits for parking areas and within we'd also want to update our bicycle parking standards so something that's been really either way whether or not we adopt a bike share program here or do not that's something that we'd like to come back to council with to really start setting rules for where it's appropriate to park bicycles so that we don't have any of the issues in the future that we're seeing with bicycles being parked anywhere with the new dockless technology and a little more on bicycle parking when we would look into this we'd like to establish locking requirements if we were to have a bike share program establishing a bike share boundary is important in san francisco they've been going through a phased approach of where they're allowing the bike share programs and looking at bike share boundaries so in an area such as the village if we had concerns of too many bikes along a already tight area we could establish the boundary outside of that area so the bikes should be parked you know very close by maybe at city hall but not getting in the pedestrian flow so that that's been successful in some areas and then also creating docking station specifications of where docking stations could be for these bikes so with that looking for direction on whether or not you would like staff to initiate the research and establish men of a local bike share program and return to the city council in the future with program parameters katie what would stop someone on private property like knob hill or the mall just reaching out to jump and putting a rack of jump bikes on private property at this point right now if knob hill asked jump to put a rack of their bikes out front they would first be required to come into the city of capitol for a conditional use permit and they would have their business license would have to be attached to the you know it would have to be more of a knob hill bicycle because that you're not allowed to just have a separate vendor outside it when you're doing conditional use permit it has to be for goods that are typically provided within the structure so when I see things like the the water vending out in front of the grocery store on 41st avenue that's outside that's part of what happens inside the store so it's sort of consistent yeah and the new code we tried to address that more as well to fix that that you can't just have a like a place to buy videos on the outside of a building to rent videos it actually has to happen inside the building and not on the exterior anymore and if we were to go through this whole process and take on a bicycle you know share bicycle vendor then someone like the mall or knob hill could easily allow them to have a rack on their property yes yep we would um you'd work with the vendor and establish where the appropriate locations are for ridership and that's something that the city would within a contract we would also have purview of making sure that we agree with the locations of where they're placing you know Santa Cruz has quite a few of these around right now do we have any idea of what sort of a deal Santa Cruz has with jump I mean wow what they worked out detail wise does the city get any revenue from this do they they're number one priority when they were establishing the bike share program was that it would not be of any cost to the city so rather than I had asked them if they're doing any type of like to get any revenue from this they're I'm not sure in terms of a sales tax when when you rent a bicycle but they their number one concern was that there would be no cost to the city but a couple points to add it number one is I believe they have a five-year exclusive franchise agreement within the city of Santa Cruz I'm not sure if that's correct but I believe they have an exclusive relationship with jump bikes that they've negotiated and they've issued encroachment permits to facilitate that so there's a specific relationship and there's a commitment about bringing in other competitors and sort of to make sure the jump could recoup their initial investment and another point that I want to make is based on our initial research one of the key things that we uncovered is is that this needed to be a deliberative process deliberate process just letting this happen some jurisdictions have tried that and it hasn't worked out well and really making sure that you have your code up to snuff and that you end up with a kind of process that you really think your way through rather than just letting it happen and even if we decided not to do this at this time I think we would want to go back to our Munich code and make some tweaks because I heard that this morning how many scooters were dropped off in the city of Santa Cruz there were a whole bunch of dockless scooter rentals that were just dropped off within the city which end up as Rich Bruno our former community development director has been dealing with in Coronado they can be a real problem to deal with it just left literally in the sidewalks all over the place so I think regardless of whether we move forward with this now or not we do need to look at our Munich code to make sure we have some protection so that we don't end up in a situation when we're on a back foot trying to respond maybe we get some last minute news from the city attorney oh I thought you made some great discovery okay no sorry any other questions of staff I have some comments I have one question before the public speaks that just when we're talking about if a bike comes out of Santa Cruz in the Capitola does the technology because I don't I'm not at the speed on these bicycles yet would the technology shut down the electric power so that it doesn't work outside of a zone it's not like the magnets on shopping carts they can just keep going right it's the restriction to something that doesn't exist right now to go inter jurisdiction no and you can go inter jurisdiction and then you just have to return the bike into the boundary at the end of your ride or else you get hit with a twenty five dollar fine but the technology works regardless of once you go out of this their boundary it'll continue to work and you'll see on that app I've downloaded the app and just yesterday afternoon there were four bikes in Capitola and usually in you get one hour that you can put a bike on hold so you can go in have lunch put your bicycle on hold and nobody can rent it during that time come back out jump on your jump bike and then go back to the city of Santa Cruz and back into the boundary and not get hit with the twenty five dollar but one thing to keep in mind is if you do happen to see a jump bike in our village and you get the urge to grab the app and take it out for a test spin understand that you need to be the one to return it back into the jurisdiction otherwise you're going to be the one on the hook for the twenty five dollars so I was just about to get one yesterday that was down in the village and then I realized wait a second I would I'd have to get it back into Santa Cruz otherwise I'd end up with a fee yes mr city treasurer yes I did want to make sure you mentioned it briefly that Santa Cruz made sure that there would be no cost to the city so there would be no public works budget item to build racks or locations it's just staff time at this point is that that was my understanding I I do not think that jump I would I would have to call the city and ask about their bicycle infrastructure and make sure that jump paid for the bicycle infrastructure on the racks that went in but seems to the cost in which their their staff member associate was more around staff hours and the time put into establishing such a program it's certainly successful in Santa Cruz it's remarkable yeah they're at a second question yes and that is you mentioned the climate action plan my understanding last time rich presented something on the climate action plan is that we already meet our goals for the next 15 years or whatever so that you this is not required in order to help us meet a goal that we're having difficulty meet meeting is that correct you know there there are goals within the bicycle plan of increased ridership I want to say up to 5% by the year we have a state goal of reducing carbons to MTB whatever the heck the acronym is of so many you know equivalent carbon units and and I think we're on track but we've already met that is that we are yes so we don't need this in order to meet a state goal but it would definitely help with the carbon footprint understand is there anyone from the public who would like to address the council tonight welcome hello my name is yonica strauss I'm the executive director of bike Santa Cruz county I just wanted to share some stats that maybe some of you guys already know from the Santa Cruz program within the first 30 days of the program there were 11,368 total trips the average there was an average of 5.84 trips per day and the national average is one to two trips per day the average trip distance was just under three miles and that is believed to have replaced vehicle trips that's about the average that people drive but they can easily bike that distance instead and the total miles were 33,454 miles so just imagine all those miles being in a car and that you know this is replacing all of those miles bike share is great if you don't own a bike if you don't want to maintain a bike if you're worried about theft which we all know is an issue and if you simply want the convenience of having a bike nearby like going to a meeting and then seeing a bike and wanting to take it off to lunch or something like that I so I urge you to explore a bike share program I urge you to consider jump as a vendor a seamless program across the county is widely beneficial it encourages more people to bike it reduces the confusion of trying to switch between programs jump is has rolled out in LA and in Sacramento in San Francisco in Davis Davis and Sacramento have a regional pro jump program and it just makes more sense there's already demand here people are riding their bikes I live in live oak and we see them outside of Santa Cruz City limits all the time lastly regarding customer service jump has really great customer service their average response time is four hours and essentially if you see a bike that has been irresponsibly or illegally parked you can report it they will lock it down they will contact the last rider and give them a notification a warning if they if that rider does it again they give them a fee and if they do it a third time their account is is cut off so there are actual ways to control how these things get parked it just takes a learning curve in order to do it and lastly I I'm sure your staff knows but Claire Fleece learned the transportation planner at the City of Santa Cruz is more than happy to share her lessons learned and and how they made it all work so I really encourage you to engage with a bike share vendor and consider jump thanks thank you anyone else yes welcome good evening city council members my name is pietcannon from ecology action I'd like to commend staff for being proactive on spike shear initiative you know as people have said before it's wildly successful in Santa Cruz so you know one of the stats that yonica just listed was um almost six trips per day per bicycle so you know it's it's amazing when you um ride around Santa Cruz or walk around Santa Cruz I mean the bikes are ubiquitous and they obviously they stand out but more people are riding bikes and you know I don't know how far that the jump can dig down to the data in terms of placing car trips but I think it's making it easier for people to get around in a sustainable fashion and also that um I think the great thing about jump bikes is being electric people can go further faster on on the electric bikes and in capitol I think that would be beneficial with with some of the steep hills right here so I think that's one of the reasons why it's taken off so well in Santa Cruz and I think you know the connectivity is Santa Cruz is so popular I mean there's been a couple of trips where I want to go to live but I didn't want to you know chance having a $25 fee you know having it taken out too long and and not getting it back in time into the Santa Cruz city zone so hopefully I you know would recommend that the city move forward I know the county's looking at moving forward and and being part of the of the program and then also one of the one of the you know the issue is there's a lot of talk about jump bikes and some of it's not all positive right so people are concerned about safety people are concerned about people that helmets aren't worn they're electric bikes they're even a little bit faster and then also just the way people ride so ecology action and other organizations provide adult safety education so maybe that's something that city staff could look at with jump is like how could you provide some kind of bicycle safety education training that would maybe make some of the riders you know conform to you know more safety best practices and also just making sure that you know they're not a danger to other road users thank you very much thank you very much what anyone else have to address the council our friend Sam story always good to see you thank you mayor termini council members staff I think it's very exciting that we're looking into getting jump bikes and our community but as I was sitting there it just kind of occurred to me and this is maybe very established now and this issue is maybe dealt with but I was just wondering about the ADA issues it is the city sponsored program in the city subject to ADA and I would just maybe like to see if the staff could look into on that question and come and bring that back in the report and see how that's being dealt with thank you very much good point thank you Sam anyone else seeing none we'll bring it back to council what is your pleasure council I'd like to make a motion to let's see what would the actual wording be initiate public outreach and research for establishment of a local bike share program I'll second that have a few comments and carry on yeah I you know I think it's exciting to have a bike share program my only concern about the bike share program is it's something that's been evolving over time my my son's in Seattle they had a program up there and it wasn't so successful and and I know yonica you're an expert on all these but it's and I know that you know there's sometimes when we'd see a bicycle lane in a front yard for three days at a time so obviously they've refined it here with jump I like the idea you mentioned about you know being a seamless program reintegrated I'm concerned about you know whether we establish a monopoly or something I'm worried you know it makes sense for me to get on a bike feasibly you could actually get on a jump bike and if we were all on the same page you'd get on Santa Cruz and ride it to Watsonville wouldn't that be a great concept so I think it's you know the position I'm taking obviously second the motion I'd like us to move forward and look at it I just have a lot of concerns you know the the the we're looking at electric buses for our buses and we're worried about technology with with electric batteries I would say the same thing about jump bikes you know it this could be the model in 2018 and 2020 there's a better mousetrap so I just don't know has a county because that's how I think about this program I don't think about it just as the Santa Cruz program we've seen the bikes in Capitola it's something that's going to probably be good for the entire county so I just I just like to move forward cautiously so I think it's good that we're going to take the time and research it obviously like to get some input from the county and see what they're planning on doing and yeah I'd rather see that Capitola is being part of some cohesive program I don't really want to go to bike racks and have all the bike racks in Capitola look like the Venetian hotels with all different color bikes so I just think it's great I think it's great that people embracing bikes the numbers in Santa Cruz obviously are overwhelming just would like to see it obviously as you would as a as a countywide program so thank you Kristen anything nothing more there's been motion in second all in favor aye opposed unanimous thank you we'll move on to request for proposals for tax revenue consulting program the services sorry good evening American council so this next I don't have a powerpoint presentation but I'd spare you that one so we've been as I mentioned in our my previous staff report we've have a consultant that does sales tax reporting and auditing we've and that consultant is muting services we've been in contract with them since 2001 and they were purchased by another firm Avenue insights and analytics earlier this year and have requested that we execute a new contract with them under a gfo a government finance officers association best management practices they recommend evaluating these types of contracts for financial services every five years similar to what we do with our auditors in addition we've been talking to I've been talking to Jamie about getting an auditor in and looking at our t.o.t. and and whether that was better to do with with internal staff or use our new auditors or to is there another vendor out there and actually Katie and I have met with a different vendor that not only looks at auditing the t.o.t. from those entities that are paying it now but also going out into the Airbnb world and those types of things and looking at short term vacation rentals as far as are they in the right zones not only are they just paying the tax but are they complying with with our our zoning codes and then also we have the cannabis business tax coming up and we're not quite sure from our standpoint if we're going to need to dedicate resources and at what level to monitoring those so with with those kind of three things up in the air right now the t.o.t. the cannabis business tax and then Avenue insights now asking for a new contract we thought this was a good opportunity to just go out and and test the market make sure we we do have competitive pricing on on the services that we're currently getting are we up to date with technology on those services and then just coming back so I put together it the the RFP is in the agenda packet and I wrote in it in such a manner that one vendor could respond for all services or I could so that we could select multiple vendors depending on who does what best so what we'd like to do is is have council authorize and direct staff to issue that RFP and then come back at a later date once we gather all that information and award a contract or contracts if it if appropriate and with that I take any questions person so many services does not do t.o.t. auditing at this point they do they do they do it's just not one of the services that we currently contract with them and they would also they could go out into the short-term rental market and see who's out there participating are they submitting t.o.t. are they in the right zones they also do the cannabis business tax as well so something that we do now with staff with regard to policing our t.o.t. we could offload onto these folks yes any questions one point I would also add is is that the the state of the art in terms of t.o.t. auditing and scouring the internet to finding these vacation rentals has actually changed and these firms have gotten quite good at it in fact we heard a sales pitch from one firm that talks about they they've developed an AI in fact that actually goes through and will look and figure out when units are rented what rates they're advertising and what the t.o.t. should be and whether or not they should be allowed and or not so I think that there's going to be some real valuable services that we can that we can consider through this RFP process we once had an estimate of how much t.o.t. we actually lose did anybody recall what that was because it was a startling number okay good we'll find out excellent anyone from the public like to address the council seeing none a motion to authorize staff to pursue our fee second all in favor I opposed unanimous thank you good luck with that anything further staff any other comments council well capital they know bid you good night remember you're lucky to be here there's millions of people who trade places with you be nice to each other good night


Hello and welcome to NewsClick. Today we are going to be talking about the recent ceasefire agreement in Syria and for that we have Prabir Purkayastha, Editor-in-Chief NewsClick. So Prabir, if you could tell us what is different about this ceasefire agreement than the previous one, seeing how they failed the previous ceasefires. Well, you are right. The previous ceasefire agreement generally ended up not being successful. They held for some time, maybe a few days, sometimes a couple of weeks, but really didn't hold. And what is different this time is an important question. I think the first and the most important part is it has been worked out without the United States. This is really an agreement which is being done between Turkey, Russia, Syria and Iran. In fact, Syria was not directly a participant in the discussion. It was really Iran, Russia and Turkey which negotiated the ceasefire with of course both the sides. Clearly, Al Qaeda-Affliate, what is used to be Jabhat al-Nusrah, now Fatah al-Sham, is not a part of the agreement. Neither is ISIS. This is what Russians as well as the Iranians and the Syrians have said. Interestingly enough, the rebels have said no, they should be a part of this agreement. So there is already a point of discord whether this agreement covers the rebels as well as Al Qaeda forces and what are we called rebels and whether it does not. So that's an open question. So there is a possibility this will not hold. But the important part I think is that this time it's Turkey which has really changed sides. Earlier it used to be with the Western powers. It used to be Saudi Arabia, Qatar, Gulf Emirates, all these Gulf states. So there is a change of the part of the correlation of forces outside Syria as it were which has directly influenced Syria because this is in some sense a proxy war. It's a war which has been done against Bashar al-Assad's government by a whole range of forces including NATO powers as well as the local Gulf monarchies which have been behind this with of course also Israel support. So the fact that Turkey has changed is I think the significant part of it. Will the ceasefire hold? Open question. So what are the areas do you think where the ceasefire will hold and where all it can feel? Well, I think it's a there are four distinct areas we can talk about in terms of shall we say the larger strategic moves in Syria. One is near Damascus the southwest part of Syria. In that part it does appear that the major players are the so-called free Syrian army rebels and Al Qaeda is not as strong as it is in other areas or ISIS is not as strong as it is in other areas. So this is an area which looks like could be some could be a place where the ceasefire would hold and the rebels would actually lay down their arms come into some kind of strategic understanding with the Syrian government and would slowly be in that sense assimilated in some way into a new setup. So there is a possibility in these areas that you will actually have the ceasefire hold. Now there are pockets where ISIS is there Al Qaeda is there and so on and there are pockets which have been independent rebel areas which have been very close to Saudis and so on. But at the same time given the turn of events after Aleppo's fall I think they're all beginning to recognize that the Saudi government is here to stay it's not going to fall and if it doesn't fall then they can go on fighting but they're not really going to achieve anything and at the same time with the Syrian air force the Russian air force having control over the skies increasingly the turn of the battle is turning against them. So I think that's an area where you likely to see some resolution. Eastern Syria that's where the ISIS is in control which is largely desert this is really going to see how the Russians Americans play this among themselves because Americans have now backed the Iraqis in Mosul which is their joining area to the eastern eastern part of Syria. So what happens in Mosul what happens in Raqqa what happens in Deir Ezzor are in some sense linked because this is where the ISIS really holds sway and this is the area where it's continued to shrink but ISIS still is powerful over there. The other part of it and I'll come to the most difficult part later other part of it is northern Aleppo what's the whole northern belt of Syria where the Kurds and the Turks as well as Syrian government and the ISIS are in battle in different ways and in this the Turkish interest at the moment seems to be north of Aleppo or northern part of the governorate that part of it if we look it does appear that Turkey and Russia have reached some agreement among themselves that this part Turkey would and its rebel allies would hold sway and ISIS will be eliminated from that part and the same time the Kurdish northern part which if that part falls also the Kurds become one contiguous area which is what they call the Rojava state or Rojava some entity called Rojava that will not take place because the Kurds then would not have a contiguous area. So this is the this is something which is between the Kurds Turks and the Syrian government that is being worked out it seems by which the status quo would see Turks play some role in northern Aleppo. The last and the most difficult is where the so-called rebel forces are mixed with Al Qaeda very closely it has a Harald Sham which is really what we call Al Qaeda light and that's again once the Sharia base state very close to what the ideology of the Al Qaeda really is. So Harald Sham and Al Qaeda are the leading military force in Idlib which is the last bastion of the rebels so to say in northwest of Aleppo and that area is where we will likely to see that the so-called true ceasefire really break down. No ceasefire ever eastern is Syria where the ISIS is there everybody agrees that there is no ceasefire there northern Aleppo yes a ceasefire which can hold southwestern Syria where ceasefire can hold it includes Homs Hama townships and so on where slowly the rebels would lay down arms and get assimilated and Idlib is the place where it appears the ceasefire will not hold and we're likely to see further war continuing over there. So you mentioned that this is the first time that US has not been part of the ceasefire agreement so what do you think the Americas role would be in the future of Syria? That's a very important question I think that's the biggest change that we are seeing right now that till now the Western powers including the United States which is of course the leader of the Western block has called the shots whether it's a UN negotiations the negotiations that were carried out earlier in Saudi Arabia with all the parties it's really the West which is called the shots and has been and tried at least to put everybody together as it appeared in which one of the major demands used to be Bashar al-Assad has to go that's how most of these negotiations really did not bear any fruit. The first time that you see the United States has virtually lost its place in the negotiations for ceasefire and so it does it does seem that it is increasingly becoming irrelevant in the civil war that is going on or the proxy war in Syria. Now that is a significant change from whatever we have seen in the past I don't think it's possible for the United States to be or the West to be completely squeezed out of Syria but the simple fact that they are players they are supplying arms they have supplied in the past what are called manpads they have supplied anti-tag missiles which are in the control of ISIS large part of it is followed to ISIS or to Al Qaeda forces so they will still remain spoilers their ability to spoil anything that happens the region is there including as we knew we know now earlier that ISIS itself was partly the product of the American policies either of benign neglect letting it happen or of active connivance so this is being the US policies in the region to keep it fragmented break it up not have a continuous so-called Shia axis which is Iran Iraq Syria and Hezbollah so all of these policies now would see the United States is not a part of what is going to happen in Syria in terms of an active direction but nevertheless could be a spoiler and if it acts as a spoiler then it can keep the civil war or the the current war that is going on also for some time by neither not coming out against ISIS beyond Iraq border or for instance supplying still through Saudi Arabia through Qatar other Gulf states arms to Al Qaeda forces and its allies in the name of supporting the so-called free Syrian army so the US role would could also could also be that of not wanting any peace in Syria not even talking about it but instead wanting the war to continue looking at Israel's interests looking at US your strategic interest that could be a possible line that it could take up under Trump will this line change we really don't know this has been Obama's position this has been some in some sense the continuity of the West position in West Asia break up the countries particularly those that pose a threat to Israel so we really have to see whether Trump would change policies or he would be unpredictable to the extent of either wanting peace or more war we really don't know the last point is I think it also depends a lot on Turkey US relationship now it's also clear that the coup attempt against Eddogan was seen by Eddogan and the AKP in Turkey as a threat posed by the United States to the kind of policies they were building so they have turned against NATO for policies they have really broken in the US right now in foreign policy terms and they have therefore tried to work out some orders we went in with Russia with Saudi Arabia with Syria Syrian government which until very recently and even after their so-called re-approach ma with Russia they have been talking about that Bashar al-Assad should go so they have really changed their fundamental position but it does appear that they have broken at least significantly on the question of Syria with the United States and with NATO will that also last will they also come back again to the NATO fold will the break with Russia again it's a big imponderable because at the moment Eddogan is a bit like Trump we do not know which way he's going to swing thank you Pravee for talking with us on this topic and we will have more interviews as it proceeds this is all the time we have a news click thank you for joining us


Hi there and welcome. I'm the Technician Project and today's tutorial is going to explain how to update and restore an Apple device back to the original settings. This is very similar to our Force Restart an Apple device video. What we're going to do is we're going to boot up iTunes. We're going to plug our device into our computer. Mine is a Mac. And we're going to hold down the home button and the power button for at least five to ten seconds until the Apple logo appears. If you keep holding down those two buttons a new logo will appear and that will be the iTunes logo with a cable underneath it. That is telling you to plug it into the computer. If you do this whilst it's plugged into the computer, the device will automatically sync with the computer. A message comes up. If you want to restore it, you can restore it back to factory default. It will wipe everything off the iPad. So I'm going to click restore today and then this box comes up saying are you sure you want to restore the factory default settings? All media and data will be erased and the newer version of software will be installed. I'm going to click restore and update and it's going to extract the software and it's going to prepare the software to be installed onto the iPad. This may take a couple of minutes. Once the software has been verified on the iPad, it will take five seconds and it will appear in the iTunes window. We're going to wait for that to happen and you give it a couple of minutes whilst the iPad is still finishing up doing its few little bits and then it will appear in the iTunes app. Like that. Welcome to your new iPad. If we click continue, we can restore from a backup we've already got or we can create it as a brand new iPad. If you enjoyed the video today, please leave a like rating and subscribe for more. Thank you for watching and see you next time.