Hello everybody, thanks for coming. This talk is quit logging or data minimization in Debian. So I'm Daniel Kahn-Gilmore, DKG, and this is Matt Taggart. And so we're going to talk about some issues around privacy and security and the intersection between privacy and a bunch of other stuff in Debian. We're the focus on logs. So just so you know where I'm coming from on this, I work for the American Civil Liberties Union right now. I'm a technologist in their speech, privacy, and technology project. And we are concerned about the amount of data that can be used against people in the world right now. And so I'm coming at it from a perspective of someone who's very much interested in civil liberties and what we can do for that. And I'm part of Rise Up Networks. And we host email and other online services for activists, many of whom are in very repressive regimes and are trying to do things anonymously. And if they're outed, literally their lives are at risk. And so we have to take some of these things very seriously. So that's kind of this perspective I'm coming from. So and hopefully this is a discussion. People have questions. Please raise your hands. We're going to raise a couple of different ideas that we have about things we can do to improve the situation. But we want to hear what you all think is worth doing as well. So just for a background to explain the intersection with civil liberties and logging, we're living in this time of a sort of data flood. So there's more machine-readable data than ever. And there's much more centralized data storage that builds up. So that stuff is available to all different kinds of people for all different kinds of purposes. But it's available to systems that do accounting, so making sure that they know how much to charge you for data usage on your phone. It's used by law enforcement to find out things about what you've been up to. One thing I didn't mention up here, it's also used for things like real-world traffic analysis, like how busy is the road? How fast are the cars moving on the road? There's all kinds of data that's being collected. It's also used by marketers. And some of the data that is generated regularly is also used by the users. But it's interesting to note that the folks who are the subject of the data are only one of a very large, wide group of folks who are using the data. So the data that we are producing as we operate in this very digital world is usable by lots of people besides who it's about. And I just want to remind folks that as Debian, as always, our priorities are our users. And the priorities of the folks who do the accounting systems and law enforcement and marketers may actually be very different than the priorities of the people who the data is about. So there's tons of data. And we can't address all of it right now. I mean, maybe collectively we can. But in this talk, I'm going to focus on just a subset of the data, which is the logs that are produced by network services. So there's lots of other things that produce things you might think of as logs, like your bash history. But we're not going to cover that in this talk. And we're just going to try to focus on network services. So it's worth noting that there are good reasons that your network services produce logs. So I don't know how many of you here are systems administrators in addition to being members of the Debian community. I see a few hands rising involuntarily, like probably most system administration duties. But so it's useful for debugging. It's useful for having an audit trail. I don't know how many people here develop user-facing software, but certainly logs are useful in usability studies about how a website gets used. It's useful for diagnostics. It's useful for analytics to know who is visiting your website or things like that. There's a lot of other things that it's useful for. And the data that's getting logged covers lots and lots of stuff. But in particular, there are some details that are more identifiable that produce these patterns of information that can be used about someone that maybe won't be used by that person. And so IP addresses, like logs of who logged into a machine. There's mail headers that get logged. There's cryptographic parameters that get logged. There's a whole bunch of different stuff that creates sort of fingerprint-able trails in these data sets. And those fingerprint-able trails show user activity. They show what the people who are using these services do. And the user may have no idea that they show that. And in addition to showing what someone did specifically, they also produce, because of the volume of them, you might not care if someone knows that you visited a given website once. But there's also usage patterns, which reveal something about the way that you live your life. So time of day, what time in the morning do you usually get up? If, say, the first thing you do when you get up is you check your Twitter feed, then they probably have a log that shows that this particular user is accessing the data at this particular time. And then because there's these user patterns, there's also this question of divergence. So when did you, oh, you got up really late today. What were you doing last night? It's possible to wine and cheese party, perhaps? It's possible that you can get information just from the patterns that doesn't have anything to do with the actual content of the network service that was being used. And then it's also worth noting that even if some of the data is innocuous on its own, it can be correlated with other data to build a much richer picture about what someone is doing and who they are. Yeah, in particular, I think it's kind of become clear that it's almost impossible to anonymize data sets. Researchers will get some data and they'll say, oh, we anonymized it to put it out there for people to use. And through statistical methods, very often people are successful in de-anonymizing it or using multiple data sets and correlating those. And so even when you try to anonymize things, it still can reveal quite a bit. So why does it matter that these pictures are formable from the logs that we're generating? So the intelligence community wants to just gather as much data as it can. Law enforcement will tend to give a subpoena to someone, like a service operator, and say, we would like to see your logs. We believe that such and such is a problem, so let's see your logs around this time. When they do that, they get a huge chunk of logs. If the person who has the logs has them all, they give them over. So there's this collateral damage situation where anybody else who happened to be using the service, all their information gets revealed as well. Someone who's into compromising systems can get into a system and take the log data from the system for their own means. There's marketers and business types who want to use this log information, which is a slightly different scenario, because those folks are actually often operating from within the service that's logging. So they're saying, someone who works for Comcast actually came up to me at Hope earlier this summer, the conference in New York, and said, oh yeah, I work in the division that records every TV show you've ever watched if you use Comcast. And we know when you watched it, and we know how much of the show you watched, and if you put it on pause, we know how long you put it on pause for. And it's very useful for us to have all of this information going back indefinitely, because it lets us provide you with better recommendations for new TV shows to watch. So they're in sort of a different situation than law enforcement that does a subpoena. And I said, well, do you think maybe you could just stop keeping some of those logs at some point? Have you guys considered a policy on that? He's like, ah, we could, but nobody's ever really brought it up before. In the future, we might want that stuff. Did you want to? I thought by law they have to delete it after one year. So he said, I thought by law, they have to delete it after one year. I don't know of a law that says they have to do that. I don't know of any US law that does that, but I'm not a lawyer. So if you can find that law and point it out to it, I would be very happy to hear about it. So who might be the target of some of this data gathering? So a target in the sense of someone who's actually been, who can be directly harmed by it, as opposed to just feeling a little bit creeped out and not quite sure why. There's activists and dissidents, which Matt mentioned. If you use a web service and they have all this data about you and then the service gets compromised, that's information about you that is now not under your control. And in addition to that, they can use that, especially if it's tied to an email address. And users are notoriously bad about using the same passwords everywhere. They compromise one service, and they can go from there. And that's why it's such a big deal when some of these big providers get hacked, is that it spreads like wildfire. And then companies may also have interests in knowing, for example, the usage patterns of their rivals. So this is not just, oh, we're sticking up for the radical revolutionaries who are under a repressive regime. You have good reason to not want to keep a bunch of data around in the event that your own machines, that you lose control of them. That data is now in the hands of whoever took control of that machine. So there's a few other reasons why you might not want to log too much. And there's performance reasons. So I don't know how many of you, as systems administrators, have dealt with IO contention as a result of massive activity. Your log files get real big, real fast. The disk fills up. There's, and some kinds of network activity actually produce multiple logs scattered all over the disk. And so we have this example here from Taggart. This is specifically a rise-up example.  And it's got a read from the list archive in order to rebuild all the indices and write all those out. And when those were all on the same physical spinning hard drive, it was a huge amount of contention and super slow. And the only way we could fix it was to individually divide up all that IO. And then one of the other things we did is mentioned at the top there, but slow down the rate at which the log files are flushed to disk helps, too. But there's definitely performance implications. And then lastly, people have devices that don't have persistent storage now. And so those devices, you want to be able to make sure that they operate well without having a log. So let's bring it into Debian. So what can Debian do about the situation and what is our responsibility in the situation as a major distro? So I want to point out that there are a lot of players in this ecosystem. And everybody has different responsibilities. So the users, people who use the network services about whom some of this data could potentially reflect, they're the folks who operate the services. And there's distributions who provide the software to the systems administrators. And then there's upstreams. And we at Debian, I mean, this is old hat to say, but our priorities are users and free software. And I want to point out that the users and the systems administrators are both our users. And free software is upstreams. So we have responsibilities to all of the other players in this particular ecosystem. And so a user might have some responsibility, but the systems administrator has a lot more power. We at Debian are not about to override the systems administrators' needs because the systems administrators are also our priority. But we do have a priority to the end user as well to ensure that we can set some kind of reasonable norm about what kind of data should we be keeping. And we need to also make sure that there's a norm about if you're a systems administrator, how do you debug your system when something's going wrong? We need to make that easy, make that useful, while at the same time respecting the needs of the users to not have large amounts of data floating around about them. So just for a second, because I think it's worth thinking about this. And people don't often just make the simple realization, if someone is trying to get data about somebody else from you, there are a lot of different ways you can resist them getting that data from you. But the simplest way to resist is to not have that data, right? It's a super sort of stupid thing to come to, but that is the easiest way to resist giving data away about somebody else's just don't have it. So I think if we can set some sort of standards and priorities as a distro to say, here's what we expect the normal setup to look like, then that's going to actually have follow on effects where people legitimately do have needs for logs. I'm sorry, I'm out of here. Go ahead. But we want to make sure that the assumption is less. Go back to the previous slide. One thing I wanted to say on the slide was that like we have been in so many other situations, devians in a very unique position in the fact that we're between the upstreams and the users. And we have so much in our archive to sit down as a group and collectively try and come up with some reasonable ideas here and help to drive this upstream and write some guidelines that apply both to devian packages in the archive, but also our recommendations for upstreams to say, hey, this is what we're adopting in devian and we really think it'd be a good idea if you did it as well. So concretely, what are some things that are issues? So one of these things is about the length that you keep the data. Maybe you decide you want to keep all the data that we've been keeping, but maybe you don't need to keep it as long as you've been keeping it.  And so we actually keep four weeks worth of logs by default in the regular log rotate package with some exceptions. And I think it's worth noting, so we've broken a couple of out here. Since log we keep a week of and we rotate it daily, the deep package logs are kept for 12 months. And Apache, we keep 52 weeks of logs. So there's a full year's worth of tantalizing data that's just lying around on the disk that if someone comes to you and tries to get it away from you, whether it's by subpoena or by hackery, you've just given them that data. Want this change a lot in Jesse? Is this too loud? Want this change a lot in Jesse because of Journal D? So I do expect there to be some changes in Jesse, but I don't believe that Journal D is going to change our logging policies. It may provide us with an easier way to adjust logging policies centrally, which might be very nice. But I don't think that the defaults are going to change unless we decide to change them. Yeah, so I'm part of the Debian system D team. And we, by chance, just discussed this yesterday. And because we discovered that the current settings, they are only based on size of logs rather than amount of time. So it's quite likely that we will change that to match the current settings. And if people have opinions about what, if the current settings should be changed, then it would be a good time to talk about that now. OK, I think probably we want. Well, speaking for myself, I would love to see the settings reflect both the size and the time. So whichever comes first, kind of a thing. I mean, if it's, so yeah. So great, thanks for being here. Also, it's good to have. So we can also, so fixing things at the infrastructural level, like at the logging dam is one of the things that we would really like to be able to do. I don't know why I don't have. So I do actually have Journal D here, but it's been stuck in the, sorry, the slide fail here. This is supposed to be a separate bullet. So there are specific applications that we can modify to log things differently. And then there's also this idea of doing it at the logging, like the overarching logging dam and like approaching the roles separately, right? Do you fix it at the service? Do you fix it at the centralized logging? And I think we're gonna need to probably fix in both and address the questions in depth. And the fixes you see on this slide are thanks to a few people in this room that have been working for years to get these things fixed and in upstream. For a long time, they were carried as patches in Debian, but most of these things are upstream now, which is really nice. And we can do more. Yeah. For the Debian.org calls, for example, we don't log the IPs anymore. For Debian.org, we don't log IPs. Yeah. Woo-hoo. Thank you. That's great to hear. Is that just the web you're talking about, so far? Are you? Is it? We're moving them and placing them 0, 0, 0. So, yeah, is that- So, Global just said we're just removing them removing the IP addresses from the web server logs and replacing them with 0, 0, 0. Is this Apache you're talking about? So, are you doing that with the log format directive in Apache? But I wouldn't need to take out- Yeah. Okay, I'd like to talk to you about that because you will still log IP addresses in your error logs that way. That's why this live Apache 2 mod removeIP will remove things before they get to the logging layer. So, so there's also, I think we can think about proposals that would affect Debian as a whole. And I think it's worth trying to come to, you know, some attempt about like establishing the norms, and I know I've said established norms a bunch of times, establishing norms within Debian, I think will help to establish norms that are outside of Debian as well. And I, you know, like any other subject that has trade-offs, these are not gonna be without their contention, but I think it's worth trying to have the discussion and figure out what we want to do. So, I think it would be really nice if we could say somehow that Debian is private by default. And those words are, well, default's pretty obvious, but private is not.  But packages could default to minimizing logging. And we can encourage packages to make it easy for assistant administrator to temporarily disable the data minimization for debugging situations. And if a package can't do that easily, like if it's a lot of work to go from a standard data minimized approach to, you know, turn up the noise, let me see what's going on in, you know, like let me get a record in detail, then people are not gonna want to have, they're gonna wanna go ahead and just have the standard be like, leave the noise in and deal with having large logs. I'm curious, a lot of the things that I wind up debugging are transient failures and maybe difficult to reproduce. And so in those cases, it's hard for me to actually go back and debug things if I don't have the information recorded in advance. Is there an answer to that, or is it just that that is one of the costs of having more private logging? Phil might have an answer. Is this in response? But how often are those actually useful? The logs that we are, by default, logging are often just not what you're looking for. So the log suddenly stops and you don't see why. So I'm not sure if there's, in general, in the default setting enough logging for you to debug anyway, so that might not make much of a difference here. So one of the things that's standard for me to get is a question is what happened to my email? Like, did it go through, for instance? And I'm wondering, and the logs really are useful to figure out whether the mail went through or not. So I'm wondering, A, how to anonymize it so that I can still solve the problem for the user, and B, how long to keep the logs for? I can tell you a little more about what RiseUp does in this case. So for our post-fix logs, we anonymize the IPs, but we leave in the usernames and the email addresses, the to and from and that sort of thing, and we can track things down. The only time we find that we ever need IPs is if someone's trying to denial services or something like that, but that's pretty rare. But we also rotate logs pretty aggressively and we only, at any given time, have maybe 12 to 24 hours of logs available and sometimes someone will file a help ticket and say, hey, you know, I'm having this problem. And the cost in that situation is if the problem occurred more than a day ago, we have to say, sorry, we don't have logs that far back. You know, if it happens again, file a help ticket right away and we can jump on it before the logs have disappeared. Or you could say, try to, you know, resend the same message that you thought didn't go through or get your, you know, you can encourage people to say, like trigger the thing now and we'll look at it as it happens. But that's the cost-benefit balance that we've chosen. And I'm not advocating that balance for Debian, we're just advocating less than 52 weeks' worth of logs or something like that, you know. Was there another? For email addresses, another option is to actually hash them in your logs so that you can, if somebody goes, my email address is foo at bar.com, you can look that up, but it's kind of hard to actually just look up what has passed through. And that also, yeah, that minimizes the collateral damage somewhat.  Yeah, that only works for incoming mail because, excuse me, if you have outgoing mail, you have a list in a database of the users, you can just build a rainbow table of all the users in the database. So having done this, done, you know, Central Social Administration for a university, one of the places where we tended to use a lot of this data was because we had a mandate to try to protect our users from attacks, in particular from phishing. And so one of the places where we used IP addresses in the logs a lot was to correlate accesses of different services from a particular IP range where we thought that someone who either had successfully phished accounts or had compromised accounts was coming from. So we used them a lot for security. So giving that up as a hard sell is one of those justified log reasons. I think there's a lot of power in having logs degrade over time instead of trying to do, because I think stripping out data is great if you can do it right up front and don't have those kind of needs. But if you do have those kind of needs, one of the things you can do is you have all the IP addresses in the logs at first and then after some period of time that's relatively short, maybe a day, maybe a week, you hash all the identifiable information. So now you can still get correlations if you need to track down something that's beyond that period of time, but you can't, but it's harder to pull the actual data back out of the logs directly. And then maybe after some longer period of time, like a month, you strip all the hashes out. So now you still have the logs that you need to do statistical analysis of what services are being used, but you no longer have identifiable information. And then after some longer period of time you actually throw the logs away completely. And if there were tools in Debian that did that sort of progressive deterioration of the logs automatically, I think a lot of people would turn them on and you would get a lot of privacy almost for free. I was hoping that you were describing something that you guys were doing. Oh, man. Can you write that? I have two comments to that. One thing that Daniel and I talked about when we were preparing the slides was kind of the Webalizer case because that's one thing that people like is being able to run analysis on their web logs. And my understanding is that Webalizer and some of these analyzers now go through the logs, harvest the metadata and put it into their own data storage. And so as long as your Webalizer is sucking that data in and already doing that minimization it's okay if we rotate the logs more often than 52 weeks a year. So a couple of other proposals of things that might be useful within Debian is an idea that maybe we can separate out what logs need to be persistent and what ones don't. Maybe make it easy for an assistant administrator to identify those things. That can help with some of the performance issues as well but we can basically put all of the logs that don't need to be persistent but just need to stick around say while the machine is up in a temp FS. And if we have mechanisms that are easily available to put that data in non-volatile storage then as soon as there's a machine reboot the data is gone. So and I also think there's this idea that we could ask the user once, the assistant administrator once, what is your preferred logging level as a debconf question and then that provides a hook for multiple packages to go in and say okay they think that a week's worth of logs is all they're gonna need for services that they haven't explicitly overridden. So if that kind of question, if that information were available centrally then other packages could pull from it and make appropriate decisions based on that. It seems like centralizing more of this logging policy into fewer controls would be quite useful. To that end I wonder if we might want to have explicit Debian policy saying if you're packaging software that can either log to SysLog or to its own dedicated log always default to SysLog and the SysAdmin can configure a separate log if they want. That's not in policy right now to the best of my knowledge perhaps it should be Ditto for JournalD. I think we deliberately avoided using the word policy in our slides. But I think our hope is that we get there at some point but we need to lay the foundation first. Stand up for each other please. Okay. So there's also some countries have data retention loads or maybe they have some unclear status right now. But yeah, having also maybe pulling data from going to lawyers and asking them okay where should be Debian defaults for France and so I can say okay, France. And then I'm logging what is only strictly required by load to comply. That would be helpful. Also one thing that we do on the server day I'm sure is that after to we so log rotate log rotate has an option that is called well you can call an arbitrary command as the compression step and we use GPG. And so the logs are still encrypted. And so you can't just go into the server and grab a lots of historical data without requiring a key that is not anywhere on the server. Interesting, that's it. Maybe they should like get more integrated on something. Yeah, I like that approach. So another thing that we noticed was that Debian builds all of its packages with the debug flags turned on and then strips the symbols out as part of the build process. And it's entirely possible that your upstreams might interpret the debug flag as meaning oh yeah, I'm doing a debug build therefore I'm gonna be more verbose. So it would not surprise me I don't have a specific instance of this but if there's software in the archive that in Debian is actually more verbose by default then when people build it themselves just because we have the debug flag turn on during the build. So if you have a package that's producing logs it might be worth looking around and that package is source code to see whether it's something like that is in play. So I think it would be nice to have sort of like a framing document that describes sort of what we're trying to do. And it smells a little bit like the DFSG to me and I'm not proposing this to be on a par with the DFSG but the idea that there are things that we are looking for in software that produces trails of activity and so these are just some sort of, you know this is a document that's gonna be sort of at a very high level not saying you have to do these specific things but say hey, these are the goals that we think that packages should do when they've got data of users. So I'll just read them out for folks, right? To acknowledge that the data they produce could be sensitive and that some data is especially sensitive and if you can identify that and you don't need it in the logs strip that especially sensitive data. I think most packages are pretty good about for instance stripping passwords out of the logs that they produce but maybe we need to think about more things than just passwords as sensitive. So I don't know, Tiger, I think Colin has a... The other thing to be careful in light of stripping passwords is something that I think OpenSH does this various other packages do it. If you're pre-authentication be careful about logging usernames. Be careful about logging usernames and failed logins because it sometimes happens that people type in the wrong way around. In the fast-forward field and vice versa, yeah. So if we could have a set of these things so minimize what you keep, minimize how long you keep it make it easy for logging to become more verbose for people who need it and for instance is when it's needed and it might also be nice if there are ways I don't know of anything that does this right now but to be able to say to a tool increase your logging for diagnostics and while I'm telling you to do this I'm also telling you that in 10 more minutes I want you to decrease your logging so that you could say I want to capture this stuff but I don't have to worry about getting distracted in the middle of whatever I was doing and then I come back two weeks later and find that my logs are full and I've got a lot of data that I didn't want to actually have. So if you're a DD and you maintain a package and the package produces logs think about this compile time debug question if you find an instance of it I'd be happy to hear about it see if we can take it out. I have a crazy suggestion maybe we should have a version of log rotate that knows how to strip stuff when it rotates the log and then you would be able to say well I'll keep the IP address or the email address or whatever it is for the first few days so I mean what Lunar was suggesting was just that the rotate command runs an arbitrary compression filter and you could have it be GPG or you could have it be said so it sounds like that's something people could do. Also can we move the logs from one place to another? I mean another thing that occurs to me is maybe I want the full information in my tempfus and some redacted version on disk. Yep, a couple more hands. We're just going to say if you store it first disk and then later remove it then a backup could pick it up the data are going to be out there. So I'm totally okay with or I think the idea is good of being able to write it to tempfus if you want to and that should not be the default as you advocate. And also just to point out even if you're careful about your backups nowadays there's copy and write file systems so to my knowledge there is no copy and write file system in mainline kernel that has the ability to retroactively strip out data. So I don't know of a way to solve that. Well it depends on what if you're assuming that someone is coming after your data, right? There are situations where someone comes to you and says give us your data and you can turn around and say well I don't have the data because I've deleted the file and while it may be true that it resides in some patterns on my hard drive I'm not about to tear down my hard drive and rip that stuff out. And then there may be a situation where there's just simply someone who's like if you're being hacked they may not have the technical capacity to do that. So deleting is better than not deleting but I agree with you there's still data left. To some degree you can also fix that by using secure arrays. If the file system does the secure arrays. Right? That's, no that's actually doesn't actually require file system support. Okay I'd like to hear about that more but there's a couple hands. Sorry. No so what secure arrays does is it's a SCSI ATA level command where it will, you'll discard any unused blocks in the file system. And any file system actually knows it will have to keep track of what blocks are used or not. So it's the file system that needs to make the decision. No it's, it's the block. Well, a file system knows what blocks are unused or not. Yes. So we should be looking at the tuning at that level as well in terms of making sure that the data is actually gone. Yes. There's also at least for Butterfest you have the no cow option. So you could have a sub volume that you write all your logs to that doesn't do copy on right. Okay. So with the caveat that I'm not a lawyer what we were told at by legal counsel at Stanford when we were dealing with cases of subpoenaed logs is that basically the way this works is that when you're through with a subpoena for logs you and this is mostly for civil. So criminal is a different story but for civil subpoenas basically the person who's subpoenaing the logs has to pay the cost. And if it's not sort of there's like a customary cost that for reasonably accessible data. If so in the case of things like where it might be residing in blocks in the file system that you have to do data recovery in order to get at it but in that kind of situation you basically get to hand a bill to the opposing counsel who's trying to subpoena the logs for not only the cost of doing the entire data recovery service but all the cost of downtime for your service while you pull the hard drives out and so on and so forth and basically you just to get to start adding zeros. So the opinion of legal counsel was essentially that as long as it's hard enough that they can just start adding arbitrary zeros onto the end pretty much people just go away. So loggeritate also has a shred option now since we see I guess and we can turn it by default, I don't know. So someone just said only on some file systems. Just so folks know we have I think seven minutes left. Instead of trying to sanitize logs after the fact after storing them in persistent storage what I've found too easier to do and been doing that for maybe 10 years is to actually log twice. Some the logs that I want to have a non-rejected version of I log the non-rejected version to tempfs for a small amount of time and I also log the same messages to persistent storage but rejected. So you don't have to find clever ways to remove data that you've already written to disk and find ways to avoid that this data can be recovered later which is actually a hard problem. That sounds similar to what Ross was proposing but maybe a more feasible way of getting to that point. Just on the question of what to do if you're getting civil subpoenas I can't speak for every state I can speak for the state of Washington and for the federal system. Most attorneys involved in high level civil litigation right now are engaging in massive amounts of e-discovery, they're very sophisticated in doing it. They usually send their consultants out to your device and they'll say you leave your hard drive where it is they'll just dump it all out and when you produce it according to subpoena you're supposed to produce it in its native format as you store it. So the bills will actually not be an impediment. It's a good thought but actually they're ahead of the curve right now and they're accessing this data left to right center. All the more reason to not have it. One more hand up here. I'm quite interested in that by this idea of tidying the logs up after you've written them to persistent storage which if you're gonna be subpoenaed six weeks later is useful but if I left my laptop on a train for example and I'm rotating my logs on a daily basis today's logs are right there for you to read and along the same vein at least in the UK I can't speak for anywhere else if a warrant is issued to acquire data from you on a criminal basis rather than a civil basis you don't get somebody doesn't turn up and say give me your logs please they turn up and say sit where you are I am taking your equipment and at that point you have no opportunity to do any kind of scrubbing so you're much better off not having written them in that form in the first place and I don't think we should forget that we're not necessarily talking about civil subpoenas there are all sorts of other ways in which somebody might try and get hold of something from you So I just have one very small point now we've been talking a bit about the arguments that one might have with one's managers if one's a sysadmin about data minimization the situation in the US is pretty bad but in the European Union there's the European Union data protection directives which legally mandate that you should not keep unnecessary data and I won't go into the whole detail of that but one way to look at some of this is to say we should make it easier for people who are running our systems to comply with European law as well as obviously going beyond that and doing what we think is right I think that's a reasonable way to approach it Perhaps you could set the defaults based on what language you selected at the beginning so like if you selected English we could say well you're probably in the US you're right if you selected American English then you know we could say well you're in the US or if you I think asking it as an explicit separate question right no I'm saying like we could ask it as a separate question but set the default based on your language based on a guess from your language yeah exactly I think that has a lot of potential for confusion especially because I know that there are people who run their systems in American English simply because that is the most widely yeah or C yeah what does C have to say about the law I also think as a project we don't want to get in the habit of ourselves trying to interpret the laws of all these different countries and figuring that out we are not the police but there may be someone who wants to do the thankless job that's like TZ data every time somebody changes the time zone we have a way of formalizing something I suspect that the laws around data logging is much more complicated than the laws around daily savings time and please please please don't be confused into the belief that existing geopolitical boundaries mean anything with respect to data protection data privacy who's going to mind what so we've got Tiger and I set up a very rudimentary sketch of a wiki page which is just wiki.debian.org slash logging and we want to start filling that in and we want to start trying to come up with a sort of you know a set of guidelines that we think make sense for tools that are in Debian I don't know if folks are interested in setting up a mailing list as well to discuss this and sort of bat around ideas or if we just want to change things through the wiki and then use existing mailing lists for discussion where it comes up I just heard a whisper of Debbie and DeVell over there that's quite the fire hose to read if you want to filter it through for questions just about what what logging guidelines should be if we decide to set up a mailing list if enough people call up to me and say yes this should be a separate mailing list we'll put the mailing list on that wiki page but I invite you to go to the wiki page and try to add thoughts and observations and concerns that you have and maybe we should probably establish some user tags within Debugs that indicate so that we can find where these policies or these guidelines sorry I wasn't supposed to use the P word where these guidelines are not being met or where we think they're not being met as a chance to sort of come to you know the usual rough consensus within the project later in the week there's a upstream guide buff so if you guys could come to that and we could discuss how we can advise our upstreams about the defaults for logging that would be great the other thing is earlier in the week we were discussing a possibility of a Debian free services guidelines document maybe we could add this sort of stuff to that document as well yeah I think that would be good just to say our wiki has a subscribe option so you can subscribe to that page and you will know when there is a change do that good call alright so I think we're out of time thanks folks for coming and talking about it and I look forward to making Debian more respectful of our users privacy and more protective for our users


Hello and welcome to the session. Let us discuss the following question. It says given probability of A is 3 by 5 probability of B is 1 by 5 Find probability of A or B if A and B are mutually exclusive events To solve this problem. We need to know a fact it says that if A and B are mutually exclusive events then probability of A in the section B is 0 and We also need to know that in that case probability of A union B is equal to probability of A plus probability of B. So this knowledge will work as the idea. Let us now move on to the solution We are given that probability of A is 3 by 5 and probability of B is 1 by 5 Now we have to find probability of A or B. A or B means even A or B or both That is it is same as probability of A union B Right and we know that the probability of A union B is probability of A plus probability of B if A and B are mutually exclusive Now probability of A is 3 by 5 and probability of B is 1 by 5 So probability of A or B is 4 by 5. That's all for the session. Goodbye and take care


I'm Professor John Jackson and I will serve as the master of ceremonies for this very special session on leadership under extreme pressure. I'm pleased to pass the digital microphone to rear Admiral Chatfield for her opening remarks. Admiral? Thank you Professor Jackson. We're so pleased to welcome back Naval Aviator and Professor Emeritus of the Naval War College with us this afternoon. We were so sorry you were cancelled last year due to COVID and so grateful that you've come back to be with us again this year. My husband David Scoville and I have been so inspired by your story and I've invited him to be here with me today to listen to you speak. You'll be introduced at length by Professor Jackson who's known you for such a long period of time but I just wanted to express my my deep admiration and honor to be here and on behalf of the United States Naval War College to welcome you back. Thank you very much Admiral. Well I don't want to take too much time to take away from our speaker. I've been asked to take a few minutes to provide a little information about the events leading up to the capture of Porter-Hollyburton to speak briefly about the treatment of POWs in general during the Vietnam War and then I'll turn our Zoom session over to a man I greatly admire. Please feel free to ask any questions you might have throughout the presentation using the chat function and they'll be addressed after the formal presentation is completed. So first I'd like to ask each of you to think back to where you were and what you were doing on November 12th 2013. Let me spark a few memories. A new animated movie had just been released called Frozen featuring the Oscar-winning song Let It Go. On TV the series Homeland and Breaking Bad were all the rage. In New York City one World Trade Center was dedicated as the tallest building in the United States taking its place on the site of the buildings destroyed on 9-11 2001. And the Denver Broncos were preparing to take on the Seattle Seahawks and Superbowl XLV III or 48 for the non-Romans in the audience. I ask you to consider all that has transpired in your life since that date. Well November 12th 2013 is exactly 2,675 days ago which is the period of time that Porter spent in the prisons of North Vietnam. Seven years three months and 26 days. It's been over five decades or half a century, sorry Porter, since Lieutenant Junior Grade Porter Halliburton and his pilot Lieutenant Commander Stan Olmsted climbed into their F-4B Phantom fighter bomber and launched on a 17 October 1965 mission over North Vietnam. This was Porter's 75th combat mission of the war and it would prove to be his last. During a low altitude run 40 miles north of Hanoi the plane encountered heavy ground fire and took a direct hit in the cockpit from a 35 millimeter anti-aircraft shell. Recognizing that the plane had been critically damaged and the pilot killed Porter ejected ejected from the stricken aircraft. He was soon captured by Vietnamese villagers and at the age of 24 he became the 40th American flyer to be taken prisoner in North Vietnam. Since no other aviators on the rain raid had seen a parachute it was assumed that there were no survivors and Porter was classified as killed in action. To help visualize the events and conditions which followed we will display a series of drawings done by Lieutenant Commander, let me get my slides working, by Lieutenant Commander Mike McGrath who himself spent six years as a POW in North Vietnam. The stark images that were followed were taken from his book Prisoner of War which was originally published in 1975 by the US Naval Institute. Once Porter ejected from his stricken aircraft he was quickly captured by local peasants and militia within days he had been transported to the Wa Lo prison which ultimately became known as the Hanoi Hilton and thus began his seven and a half year ordeal. Mike McGrath drew pictures of their accommodations but more revealing are these photos of the actual cell in which Porter was held. As you can see the prisoners were kept in very austere conditions often shackled in leg irons and handcuffs for weeks and months at a time. When they were not locked down they were subjected to brutal treatment from abusive guards who took great pleasure in their suffering. Most vicious of all were the professional interrogators who were given pet names by the prisoners. With total disregard for the provisions of the Geneva Convention these interrogators use various forms of punishment and physical torture to force information and statements from the POWs. Many were forced to kneel on rocks and other sharp objects for hours or even days on end. By far the most common method of torture was what the POWs came to call the rope trick. They were tightly bound in painful positions which often pulled arms out of sockets and left many permanent injuries. Punishment was routinely given for violations of camp rules. This punishment included beatings with rubber straps and countless painful hours in shackles. Communication of any kind between the prisoners was forbidden but the resourceful POWs maintained contact with one another by various clandestine needs including written notes on scraps of stolen paper, the now famous tap code, and a POW devised mute code which was used when visual contact could be made. From 1964 through 1969 most prisoners were kept in solitary confinement or in very small groups with several events including the attempted rescue raid on the Sante prison caused a significant improvement in treatment and conditions. Over time increasing pressure to improve conditions was brought to bear by the U.S. government as well as by individuals such as H. Ross Perot and organizations such as the National League of Families of POWs and MIAs in Southeast Asia which was founded by Sybil Stockdale the wife of former Naval War College President James Bond Stockdale. Porter's wife Marty was a very active member of the National League as the coordinator for the 10 Southern States. Public support was shown in many ways and many in this audience may have once worn POW bracelets such as shown here. From 1970 on most prisoners were held in large cells in the Hanoi Hilton each holding up to 40 prisoners. Their conditions were still meager and crowded but still far better than they had been before. After over 10 years of war and nearly five years of negotiations the Paris Peace Accords were signed in January 1973 and the POWs began to be released in February. Shown here Lieutenant Commander Halliburton is about to board the C-141 in Hanoi on his way to freedom. The remarkable story of Porter and Air Force Colonel Fred Cherry was told in the book Two Souls Indivisible the friendship that saved two POWs in Vietnam. We were good to note that in February of 2016 Colonel Cherry passed away. Dr. Halliburton served as a professor at the Naval War College from 1979 until his retirement in 2006. He now holds professor emeritus status. I will leave it up to Porter to speak to this final image and at this point I'd like to welcome Commander Porter Halliburton back to the Naval War College. I think you're muted Porter. Okay thank you for that introduction. I wanted to have you show those things since I'm not going to really talk about some of those during this talk because the gravestone that you saw there was because I was declared killed in action for about a year and a half before anyone knew that I was alive and there and so my family had a gravestone placed in the family plot and I discovered that when I came back home and the funeral director asked me what I wanted to do with it. And I said well I hadn't really thought about that a lot but anyway I had the navy move it up to our home new home in Atlanta and so that gravestone has moved around quite a lot and the aside from being a quite a conversation piece if the conversation dies down during a cocktail party we can always go out and look at the tombstone but the great thing about it is to be able to look down upon it instead of up and so I am so grateful for the many many years I have had since that date in 1965 and I asked John to show some of these slides just to set the stage of what the environment was like for us what we were dealing with and it really shows that brutality and boredom were two of the very central features of our captivity. However, they were certainly not the most important the most important I think were how we reacted to these conditions and these events while we were there how did we use these in order to survive and so this is really what I want to talk to you this afternoon about and I want to divide this up into the various aspects of my captivity and there are several different forms of of that I want to divide it into threes there are three roughly three time periods there were roughly three adaptations to different times and conditions I have three reflections about all of that and in conclusion three important things that I would want to pass on to anyone three things that are still very much important in my life today so the three time periods the first one would be from 1964 whenever an alvarez was shot down in august at the beginning of the bombing of north vietnam and of course he was there by himself for quite a few months nine months I think and this period ended in the summer of 1966 and during this time a torture was not routinely used it was used as a punishment the conditions were certainly brutal because they were so different than what we had been used to you know when I punched out of that airplane I was I was cutting an ambilacum cord that connected me to the carrier and life was quite different after that it was during this time that we were introduced I was introduced to three of the great leaders that we had there and I got to actually speak with all three of them Jim Stockdale, Robbie Rosner and Jerry Denton. There were certainly other great great leaders from top to bottom but these three stood out for me because I either talked to them or tapped with them at the very very beginning of my captivity and it was during this time that we learned how important it was to establish lines of communication because it doesn't do you any good to have great leaders if they cannot connect or communicate with you and you cannot connect with them and so communication we we figured out right away was going to be an essential feature of our existence and so like in the Navy you know we say you have to get there early to get the good deals and so sometimes it's hard to figure out what the good deals were and I was number 40 to be captured and so we were just a few of us there but the good deal was that the three at least these three great leaders were shot down early as well and they were there assessing the situation passing along guidance when we could communicate with them and so on so the first lines of communication the tap code talking various other no drops and so on were established during this period and for us it was a period of adaptation to an environment that was entirely different than anything we had really been prepared for even though we had been through Sears school Sears school taught some important things but they also taught some very unfortunate things as well so after about 10 days of constant interrogation I was living in that little cell that you saw spending many hours a day in interrogation doing my best to stick to the code of conduct giving name rank service number and date of birth and that was working because I could withstand all the threats all the beatings all the intimidations the leg irons and everything else and I was successful in sticking to the code of conduct and one day the interrogator said you know if you continued or refused to talk to us we're going to send you to a worse place and of course I couldn't imagine a worse place than that little cell in the cell block in the Hanoi Hilton and the that cell block was called heartbreak hotel but if you do talk to us we'll send you to a better place you'll be with your friends you'll have nice food you play games your write letters and get packages and all kinds of things like that and so I had to make a choice I wasn't sure that they had a better place or that they would even if I talked to them that they would they would fulfill their promise but I wasn't going to do that and so I continued to refuse and sure enough I moved to a worse place now I won't go through each one of these but there were three more about every two weeks I was given this choice better place worse place each time it got harder each place was harder in a different way worse in a different way and finally I wound up in I think the worst place they had which was a cold storage shed in a different prison called the zoo and in the shed which had been used to store coal and there was still cold dust everywhere there were rats there were of course mosquitoes flies every kind of vermin you can imagine and one of the worst parts of it was I was completely cut off from commerce from communication with any other person I could look through the crack I can see what seemed to be normal activity in the rest of the prison but I couldn't communicate with anybody I didn't know why I was being treated this way I didn't know whether everybody else had decided to talk to them and I should or not it was just a terrible terrible time and I was very sick I couldn't eat any of the food I was at the end of my rope physically mentally and nearly spiritually and about all I had to do during the day was ask God for strength courage and wisdom to get through this and I wasn't sure that I could get through this and so saying no one more time was the hardest decision that I've ever made because I didn't think I could survive even the place I was in much less the worst place and so late at night I was handcuffed blindfolded taken up to another cell block and they opened the door and they pushed me into the room and they said you must care for cherry cherry and of course inside was Fred cherry black Air Force officer major 105 pilot shut down five days after I was terribly injured his arm had almost been ripped off of his body he had many other injuries as well could not do very much to him and we quickly figured out that based upon their stereotypical ideas of white southerners and black southerners that putting me in with a black and telling me to care for him to wait on him to do everything for him would be the worst thing they could do for me and would finally break us both down and of course that turned out to be the very best thing that they could do and so that choice there that I made a very difficult choice it brought illustrated to me the importance of the choices that we make I cannot imagine if I had chosen the other way what my life would be like now or whether I would have a life now but that one choice determined the rest of my life and so I think we realized right then that even though we were absolute prisoners of our captors they could do anything they wanted to with us they had no constraints they did not claim to abide by international law there and so they could do anything they wanted to with us including kill us whatever but the one thing that they could not do was take away our freedom of choice our free will God's great gift to us of free will and so in this way we were not fully prisoners we were controlled in control of our life and throughout our captivity this became so clear to us that this was this was the most important thing that we could do was to exercise our free will make choices very difficult choices sometimes and so we learned that during that time I also got to know some of the other leaders they weren't all senior officers and I'll tell you one story about a wonderful man that was he was an Air Force captain his name was Bob Purcell and I heard this story about him and it was so inspirational to me that it it proved to me you know that the great leaders are not all senior and they it's not just what they say but what they do and so Percy was living in a in a building that had been turned from three rooms into 10 and so in each above each cell they had dropped an electrical line down so they could put a low watt bulb in there so they could look in at night and see what you were doing and they had gotten up in the overhead through a hole hole in the ceiling and then Bob Purcell Percy was was in that room and he heard through the tap taps down the hallway that there were several Americans down there being starved and denied water as a method of coercion and so they quite often tried new things and this was the first time that we heard that they were using starvation and thirst as coercive methods and so Percy to make a long story short he figured out how to get up into that ceiling in the hole in that ceiling and he went down the overhead and he got above the cell of a guy named Norland Daughtry and Norland had two arms were broken one in two places the other in three so he's completely helpless and they are trying to starve him which was inspirational in itself and yet Percy went down there and he's looking down the hole and he sees Norland down there and he said hey Norland well Norland had been praying a lot like a lot of us and he must have thought God was talking to him but Percy said no with me up here and so we told him a couple of jokes trying to cheer him up but what he really did was he took his own food rice and what little solid food and he made it into pellets in balls and he took that down there and he dropped it down through the hole for Norland he also took his water pitcher and he poured water down for Norland he kept Norland Daughtry alive and two other men on his own food for two weeks and he survived on just the liquid from the soup and you have to understand every time he got out of his cell through that overhead hole in the ceiling that the Vietnamese would consider that to be a escape attempt and they kill people for that and so he was risking his life every day he was giving up all of his food but he kept these guys alive and the the Vietnamese couldn't understand how they were surviving and they gave up on that program and so Percy's act and this is just an example his act demonstrated a number of things one is that you know this Americans are so tough they can survive without any food and so you know that's not going to work so to my knowledge they really didn't use that method again and you can tell how much it affected me not knowing Percy at the time I was very fortunate to to live with Percy quite a lot and he was a wonderful wonderful leader but stories like this began during this early period and were so inspirational about what they did and so it was so clear even though we got words of advice guidance a few rules from our senior leadership you know it was what people did and it was what Stockdale did and Rosner did and Jerry Denton did that really made the difference and so I think that was an important lesson that we that we learned there well the next period began in the in the summer of 1966 and it began because we chose to bomb Hanoi for the first time and we bombed their POL storage in Hanoi and Haifeng and completely wiped it out over a couple of days and so the Vietnamese decided they were going to take it out on us and that they were going to make an example of us they threatened to put us on trial for war crimes and execute us and this all was launched by what you might have heard of as the Hanoi march in which we were marched down through the streets of Hanoi two by two handcuffed together and it was one of only two times where I feared for my life while I was a prisoner was in I thought we were going to be slaughtered in the streets of Hanoi president Johnson did say that if they tried to put us on trial or executing anybody that he was going to use the B-52s to level Hanoi and so they did not put us on trial but it did usher in the most brutal period of our of our time there which lasted from 1966 to late 1969 so it was not only the most brutal it was the longest and they decided that they wanted to they were going to get what they wanted from us by extreme violence they had not been able to generally get what they wanted by any other means and we learned what what their overall war strategy was they knew that they were not going to defeat us militarily they knew that they had a great deal more patience than we did they knew that we responded to public pressure and so their objective was to convince the American people that this war was either unwinnable was immoral was illegal it was too costly too many people were dying we weren't going to win it and would have to withdraw because of lack of public support that was their overall strategy I believe and actually it was successful so the the time that we were together during this time was a time of great suffering and we found that that suffering brought us together common suffering brings people together in a way that nothing else does and so it was a it was a very very difficult period and we got through it though we learned some very important lessons during that time at the end of that Ho Chi Minh died in 1969 late 1969 and I think that they they reassessed their success what little there was and found that they didn't have very much that they found that we had we had developed what we call second line of resistance and that means that when we discovered under extreme torture that we all of us had a limit and at some point you had to say I will do something what it was was a different matter and so once you said I give then you started thinking well how am I going to resist how am I going to deny them what they want and so we assessed our strengths and our weaknesses we found that one of the the great strengths that we had and a weakness that the Vietnamese had was that they were largely ignorant of a lot of American humor customs history even they had no one who was educated in the United States no one who spoke American a couple of several of the interrogators spoke excellent English but it was not American English and so we could use their ignorance to send signals to a knowing audience that this was being coerced this was not true whatever and so we use the second line of resistance as a form of resistance so I think that they at some point probably some Chinese or Russian was there and they saw that most of the pictures that they had taken of us included at least one of these sometimes two and as they explained to the Vietnamese what it meant and so they realized that we had been pulling a trick on them and so they realized that what they had been doing was not terribly successful and it was beginning to turn American public opinion against them even the anti-war section of American public opinion and during this time you know Ross Perot had been flying plane loads of gifts over there which they refused they wouldn't allow the Red Cross and the National League of Families had been formed by Civil Stockdale my wife Marty was very very active in that once she found out that I was alive which is about 18 18 months after she thought I was dead there were thousands thousands perhaps millions of POW bracelets being worn was all kinds of pressure being placed on the Vietnamese to treat us better not necessarily to turn us loose but to treat us in accordance with the Geneva Convention and so they decided Ho Chi Minh's death provided them with a time to do that and so things got a lot better we began to get packages letters food improved we I got my first my first letter from Marty and first packages and so on and so it was a very very different time the groups got larger for a variety of reasons and so I was I spent a long time in a group of nine of us and some of the things that we could do in a group of nine as opposed to living with just one other person was quite quite different I can talk a little bit about some of that I know that we could do serious educational activities we had classes we engaged in serious athletics in a way in our own limited space and so on I learned to walk on my hands I did you know I did 6000 deep knee bends without stopping we had a little contest we learned to do all kinds of things we never thought that we could and so the we also learned the art of storytelling movie telling and and so during this time there our environment was quite different our health improved our weight increased the Vietnamese were deliberately trying to to fatten us up get our health better we got vitamins and so on from home and packages and so on and so these were the three different periods and they were all they were quite different and so I had adaptations to each of these periods and what I'm going to describe now doesn't necessarily coincide with these these chronological periods but roughly they do and I call these three adaptations the first one is retrospection and it was because we didn't think that the war was going to last very long everybody was optimistic the most pessimistic person that I ever talked to during this period thought that we might be there for two years and everybody else thought it would be much less and so what we did was quite different during this time I need let me read one of the things that I did throughout the time I was there was to write poetry and stories and songs and things like that and so let me let me read the first the first poem that I wrote and it was very early in this time when we thought that we would not be there very long and it's called winter crypt how can I describe the way that I feel as if the stream I was crossing had suddenly frozen and locked my ankles in an icy grip immobilizing that one's fluid force and I with it and we have nothing to do but wait until the thaw well we certainly found out that we had a lot more to do than wait until the thaw but that would come and during this period though when we were just trying to hang on survive do our duty and all of that we I lived in the past a great deal of the time I relived my life I thought about everything I had eaten all the girls I had dated about everything in the past and mostly the good things because that took me out of a very unpleasant present but in the course of it of course I began to realize that my life had a lot of flaws I've made a lot of mistakes I've done things that were wrong things that I needed to atone for and so it was a period of of thinking about the past intensely I spent I could spend days thinking about could I identify everybody in my first grade class and so having a lot of time means that you could spend a lot of time on such a project and you were living in the past while you were doing it so sometimes I have felt I had relived my life to the extent that I could and I began to regret those mistakes that I had made I began to think well how will I make up for this lost time I began to think about the future and so I was really living in the future building my obligatory house you know board by board by nail doing all of these things in preparation for my release because nothing really mattered all that much beyond survival and doing my duty and release and so I lived in this I lived in the future because it was a way of escaping from a very unpleasant present during that time I began to to live with other people and to learn things from other people and I began to think about how my life was going to be in the future and so I began to categorize all of my interests and I put them into an alphabetical list and I began art aviation automobiles and so on right on through the alphabet and by the time I got through with that list I had 77 different categories of interest and of course I had conserved consulted my wife or family at all about any of this and so a lot of it went out the window as soon as I went home but it was during this time that I'm thinking about the future in order to escape from the past or the present and then at some point I realized once we had gotten together and in bigger groups we had educational things we had recreational things we were I had a day every day was planned out you know and I realized that I had to stay busy the whole time I had to keep my mind busy and so and so I realized that actually we had adapted to this environment that we had almost everything that American society would have except for our real families but we had we had grown into a not only a military organization we had senior officers we had a structure we had all kinds of things in that regard but we also were a family and we loved each other we cared for each other you know we people did things like Percy did looking after each other we wanted to make sure nobody fell through the crack in any way and so there were incredible things that were done and in the process you become a family and we developed a culture mid-60s culture and suddenly realized that I was no longer living in the past I was not living in the future I'm living in the present because we had adapted to our conditions that we had made the best of it and so towards the end of that I think we found that we could lead a meaningful life just where we were not that it was the life that we chose but it was the life that we built and so in contrast to when I was first shot down I thought I'd love to be home I wish I'd been in October I'd love to be home by Christmas and then when I wasn't I said I can't imagine being here during the summertime but I was and so gradually we adapted to longer and longer projected release dates and I will say by the end I was mentally physically spiritually prepared to stay there another 10 years if I had to or the rest of my life and still believe that I had a meaningful life so this was you know these were three periods that that were distinct in a way and during that let me read another poem that was written later that perhaps shows a difference in the Gifferton attitude and from the first one and this one is called Reflections on Captivity how can I measure the loss of my dimensions as I lie spread across this crass expanse of time I'm bitter years devoid of latitude or luster my duty days of trial and decision are but pages turned but pages not forgotten those countless hours of aimless retrospection regret restraint and introspection the strange monotony of unwarded unrewarded hopes unconquered hopes amidst my unborn tears have tempered the metal of my structure and filled the empty spaces of my soul so I want to talk a little bit about three reflections that I have on this experience and um these are things that still guide my own life today and that's why I single them out why I think they're important things that I learned and the first is that for me anyway I need to lead a balanced life I did there I I determined uh fairly early that I needed to stay active we heard stories about prisoners in Korea who died not necessarily because of the harsh conditions all the conditions there was certainly in many ways worse than they were in Vietnam it was because they gave up they had no hope they had no proper training and so the code of conduct is actually a result of the failure of POWs in many ways in Korea because they were not properly trained they were not they were not the sort of homogeneous group that we were in Vietnam they did not have they did not have effective leadership and so I was determined that I was going to stay as active as I possibly could every day mentally spiritually and physically and so I tried to divide my day up into those three activities and recreation as well part of mental activity to try and learn something new every day to try establish a connection with with God and to keep my body as as healthy as I possibly could as I mentioned before the other thing that I we realized was that the choices we make determine the course of our lives you know someone said you know that in in life's terrible arithmetic we are the sum of the choices we make and I think that's very true that there are things that we cannot do anything about and so we shouldn't spend a whole lot of time worrying about them but there are things that we can do something about and sometimes we don't realize that we can do something about them and the fact that some people feel that they have no choice is a terrible terrible loss and so I think back you know in making that choice about the better place the worse place and I think all the other choices that we were forced to make there how important they were and the choices that I've made since then I'll tell you another another story to illustrate that I lived with a wonderful group of eight other people the fact that there were nine of us there became important in this particular story and we were very active and we were a quite a quite a diverse group but still homogeneous all of us about the same age about the same rank either Air Force or or Navy and we got along really well and so at some point people wanted to play cards and so we decided that we would we would sacrifice some of our precious toilet paper which was like brown brown paper towels this is a prime selection of very high quality Vietnamese toilet paper and so we we tore them up into little sections about like that we used brick dust and cigarette ashes and pig fat and mark the cards we took us a while but we got a deck of cards and so people use them for a variety of things but people wanted to play most people want to play bridge I was the only one who knew how to play bridge and so there was one guy who did not want to play bridge and so that was crucial to this story and so I taught everybody all the conventions that I knew and so we got so everybody you know could play a fair hand of bridge and we had a special hiding place for these cards because of course this is against the camp regulations and so we we knew when the guards were coming around we make sure they were hidden so on but one day the guards came into the room quicker than we could get the cards hidden and so they discovered them they called the camp they called the interrogators down there and the guards and everything and of course they were quite upset that we had violated the camp regulations and so on so they took the cards and they they ripped them up but they they threw them in the honey bucket and they threw us all in leg irons and so on took away most of the stuff that we had and as they walked out the door they said you are forbidden to play cards and so they slammed the door and here we are sitting around in leg irons and somebody might have been me might have been somebody else said let's play cards without the cards and so this scheme evolved the fact that we had eight people who wanted to play there's one who didn't the one who didn't then became the dealer and he had to divide the cards up into piles of 13 and once he memorized those we couldn't write anything down obviously he had to teach each pile to four four guys who were became the hand so once they had memorized the 13 cards that they had they consulted with the players the four players and they taught them the cards that they had so the players then could bid based on this information and you can imagine it took quite a while just to get to the point where you were going to going to bid but we did we played bridge without the cards and it gave us something to do when we had nothing else to do we were still in leg irons sitting there um feeling a little sorry for ourselves at first but we soon realized that we made it we had made a choice about how to react to this situation and that that choice was very important it not only gave us something to do there was a great act of defiance you know they can tell us we can't play bridge and we can't play cards but we are going to do it anyway and so this idea of choosing exercising that right to choose and and doing so wisely we all need advice how to make the best choices of course well the third reflection is that I think we all most of us realized that we were searching for some meaning in our life you know we can't we're just prisoners they're sitting there doing nothing that we had to have some meaning in our lives and I had not I had not read Victor Frankl at the time but after I came home somebody gave me a copy of his book called man's search for meaning and what he said in this book he was a he was a he was a prisoner in Auschwitz during world war two he had survived that miraculously but he had witnessed so much suffering and death and he had seen so many different ways that people reacted to their environment and so he was a psychoanalyst by trade and a lot about his environment there as a sort of laboratory and human behavior and his method of treating people after after he got out of there was called logotherapy and it was showing a patient that they could they could discover the meaning in their life because he his conclusion was that if you fail to find meaning in your life you turn to other things you turn to pleasure or possessions or power or any number of other things that may or may not lead to a meaningful life but that this failure to discover a meaningful life led leads to mental problems and dissatisfaction and everything and what he said they're really struck home and to me it explained our own behavior that that we were looking for a meaningful life even in this terrible place and he said you can you can discover this meaning we're not talking about the grand meaning of life in general we all think about that as well but he's talking about the me every day meaning what do you find meaningful in your life every single day and so I found that to be so powerful he said you can discover this by doing a deed by experiencing a value or by suffering and he said by far the most effective way to discover this is through suffering and so this this was our laboratory and so you know every day I am still searching for the meaning in my life every single day so three important things communication has been mentioned several times I can't over emphasize that I think it was the thing that saved us it was the thing that allowed leadership to happen it was the thing that allowed us to come together in unity solidarity with one another it was the thing that without it we would have been lost of course the really tough individuals would have made it on their own but we all needed each other we needed inspiration we needed human connectivity and that was the thing that the Vietnamese were trying to deprive us of and they wouldn't you couldn't even speak out loud in yourself you couldn't make any kind of noise and so the fact that we did it anyway meant that that was a choice that we made in spite of terrible terrible punishment for doing that unfortunately I never got caught and I was usually either on the communications team or the head of the communications in every group that I was in and it meant that I was doing something meaningful in my life every day and so this tap code you probably know all about that I'll tell you two things that happen after um after French Harry and I were split up after the Hanoi March and when things really got bad I moved away from him I moved out to a very very primitive and bad prison camp out in the country we call the Briar Patch and I was in solitary confinement again and I could only initially I could only tap on the wall with one one guy and his name was Howie Dunn he was a Marine Corps major F4 pilot and due to the configuration of the cells I couldn't talk to the only other person that I've been physically possible but I'll tell you first that one time one day and this tap code becomes like Morse code you don't think of you know three three columns over and two rows down you just you hear you hear these letters appear in your mind after a period of time and so when Howie and I were tap tapping out we're handcuffed behind our back all day I had to tap with the very end of my finger very lightly on the wall and Howie had to have a cup up against the wall like a like a um you know so he could hear through the cup anyway it was very very quiet because we the punishment there was so so terrible and one day I started hearing a message and I had no idea where it was coming from at first and I suddenly realized that there was a prisoner had been given the job of chopping firewood there was some electricity out there in this place and so everything was boiled you know the water was boiled the soup was cooked with wood and and they had these little homemade machetes and he had been given one of these and so he's chopping on the on the log and he must have said if you can tap on the wall you can chop on the log and so he made this decision and it changed our whole communication network because now we suddenly realized the calling this a tap code was in a way a mistake because you didn't use it just by tapping you could use it by chopping you could use it by hoeing you could use it by any means that you could communicate numbers one to five and they could be by blinking your eyes they could be by a facial twitch they could be by holding up a number of fingers it could be by tapping your toe where it could be seen by somebody else it could be by sweeping the street it any way that you could learn to transmit numbers one to five you could communicate so this you know before we just had a person to person like phone line now when you could chop on the log or you could hoe in the garden it was like having a loudspeaker where everybody could hear and so later on we were able to use this you could use it throughout the camp you could play 20 questions with people and so on I'm going to all of that but I want to tell you a story about howie being the only person that I could communicate with we became pretty good friends I mean we we had gone through this terrible terrible time where we had to choose how to react to extreme extreme violence and we shared all of our reactions with each other I looked at him for guidance he was my senior officer by two ranks we became great friends and we began to share our lives talking about our families and military experience and our likes and dislikes and so on and then finally we decided that we needed something more to do and so we came up with this scheme that one day howie would have to come up with the menu for the day the the virtual menu for each meal and it would tap this across this is what we're having for breakfast this is what we're going to have for lunch and so on the next day it would be my turn and so during the night when there was no light nothing you just lying there on your bunk with nothing to do it gave you something to do to come up with a creative menu and so we tortured ourselves that way but in the course of all this you know we became really great friends it occurred to me one day I'd never seen him we never got outside together of course and I know the shutters were mostly closed at all times and so I said howie I have never seen you what do you look like anyway so he taps back he says you know John Wayne I said yes I know John Wayne he's well a lot like that so I took this image you know this guy's six twos got broad shoulders and there are hips rugged good looks and everything and I put that mental image with everything else I knew about howie done and I carried that with me we eventually moved away from each other I never saw him again I never knew we didn't have many Marines and so I never knew anybody that knew him and so on and so I I told lots of stories about howie and but I never knew anybody that knew him and at the very end when the peace agreements had been signed and that we knew we were going home they were letting out we were you know they were 40 or more of us in a big cell and in the big area of the Hanoi Hilton and they let for the first time they let two cells out together so they were about 80 people out there in this big courtyard and people I had lived with people I certainly knew by sight and all of this and we're having a great time visiting with each other and this guy comes up to me and and he was he was short and he was bald and not not really all that good looking and he stuck out his hand and he said hi I'm howie done I said how are you son of you lied to me and he laughed and we both laughed and he said I know but it was such fun knowing the image that you had of me all that time and so I I loved howie I'd love you know that that experience that we had he he had helped me get through that and I love this story but the reason I tell it is to to demonstrate that you can become you can do incredible things with very primitive communication with numbers one to five I became best friends with this wonderful person and we saved each other's good sense we we saved each other we became brothers numbers one to five and so today you know we have more ways of communicating you wish I could stick out probably more ways than we need and yet the crux of it is effective communication and so that's why I I think communication is so important today and there are so many barriers to effective communication the other thing I think we learned was humor and there were many instances of that I had I had I lived with a guy from Louisiana his name was Glenn Daigle but we all called him the Kunas because he was a Kunas which is some kind of special Cajun quite a character and he always was coming out with these funny sayings and I know that sometimes when things really got difficult and we were all kind of down in the dumps he would say just remember it's always darkest right before it's totally black and so that would kind of remind us you know they you know things can get worse and so don't don't worry about it too much and my favorite story about the power of humor is about a guy named Mike Christian he was Erd Williams BN and A6 former enlisted kind of rough around the edges and he he disliked of yet me is a great deal he let them know know that I tended to be more of a a diplomat I didn't want to unnecessarily bring greater hardship upon myself or anybody else and he let them know how much he hated him and he always wound up with the crummy little deals if there were unpleasant things to do and so on and I remember one time he was taken out for some reason and they they they wrapped him up we could hear him screaming and so on and you saw the graphic images that Mike Mike McGrath drew of the method or torture that we call the rope trick and so we knew they were using the rope trick or or some other method torture and so he was gone for quite a while and finally they brought him back and they stuck him back in the room and we were pretty despondent I mean this you know this was bad and we gathered around him and I remember somebody somebody said Mike what happened where you been and I'll never forget he he got a slight grin on his face and he looked up at us and he said I got tied up and couldn't get away that little bit of humor changed everything it it sent us so many messages you know don't feel sorry for yourself I'm not feeling sorry for myself so you shouldn't feel sorry for yourself either it's over I'm back we're gonna press on we're thinking about the future not the past so Mike's a little bit of humor there conscious humor he used that to change things and I could see how effective humor was in leadership situations other times you know things got so bad that you just had to laugh at your laugh at your circumstances you know how could anything get any worse so if you if you can laugh at yourself and laugh at things you use that as a leadership tool humor can change everything so the final thing that I learned you know I learned this the first lesson that I think is the most important about making choices I learned that at the very beginning when I chose the worst place and moved in with Fred Sherry the second most important lesson that I learned I did not learn until the very end we're sitting around waiting to go home we knew that we you know they had this of being closed we had a shave and a haircut we knew we were going home soon I had my my list of 77 things you know memorized I was thinking about you know what it's going to be like to be back with my family and I overheard I overheard two guys next to me talking about what they were going to do within the first day or so to get back at the Vietnamese how they were going to get revenge for all the bad that had happened now I had built up quite a hatred for the Vietnamese and I realized that this hatred became an armor it was a defensive mechanism if I hated them enough they could not break through that hatred that armor and convinced me of the justice of their cause of the truth of their statements or anything if I hated them enough and I did these guys obviously had hated them as well but it suddenly occurred to me that hatred was a terrible terrible force and that I had already decided when I go home these people are never ever going to adversely affect my life again their punishment is that they have to stay here in this country and I'm going back to the greatest country in the world is there to see that's revenge enough what I was thinking of was this this is the first picture that I got in a package after five years of my wife and my daughter Dabney who at in this picture is about four years old so this is what I was thinking about when I get home this is the first thing that I want to do is to be with my wife and my child that I had only seen for five days and now she was almost eight years old and so I knew this hatred I could not take it back and so when I walked out of the Hanoi Hilton I thought for the last time to get on the bus to go out to the airport to get on the C141 to fly to the Philippines and to fly home I walked through that gate and I turned around and I said to nobody in particular but to that place I forgive you and all of that hatred all of that armor fell away and I walked out of there I walked out of two prisons the Hanoi Hilton and the prison of hatred and so ridding myself of hatred at that particular time liberated my life and I realized that I had to I had to do away with hatred in my life altogether my first act of forgiveness was self-preservation not necessarily a Christian act later I think I forgave everybody in connection with that war only well two people I haven't forgiven but I don't hate them so so that was the most liberating thing that I have ever done and a great lesson now I I've only read I want to I've only read two poems I wrote quite a few but I I want to end with one more and it is I guess ironically called the three of us yesterday on meeting you hoping without knowing you knowing without asking you loving without telling you the young and misty two of us sharing each the best of us accepting two the worst of us and we so good for both of us and as for me the faulty one the wild and hungry needy one to spend my life in search of one and finding you the perfect one and so we shared our pastel days our soft and glowing magic days and you with child within those days and then our few but perfect days now two of you to wait for me to love to hope to pray for me and I still feel you part of me though you and she's so far from me the future still so bright for us for you for me for three of us and she the best of each of us will fill the lives of both of us and so she has thank you