Welcome to Inet's webinar, COVID-19 and surveillance technology. It is a topic that I believe is on many of our minds as technology plays an ever greater role in our lives in the wake of the crisis. Our speaker today is Bruce Schneier, who may be familiar to some of you from his blog Schneier on Security and his newsletter, Cryptogram, both of which are very widely read, contributing to his reputation as a security guru in the words of the economist. Bruce is a fellow at the Berkman Klein Center for Internet and Society at Harvard University, a lecturer in public policy at the Harvard Kennedy School, and a board member of the Electronic Frontier Foundation. He has written over a dozen books, the most recent of which is Click Here to Kill Everybody. We're delighted that Bruce can be with us today to help us make sense of some of the issues around privacy and security. And what to some of us seems like a pretty stark trade-off between what are clear benefits from the use of technology to navigate the issues raised by the pandemic, and the threat of a shift closer to a surveillance society as expectations of privacy are slowly being eroded. The trade-off is starkest perhaps when we consider the use of digital contact tracing, which has been used extensively in several countries, sometimes with fairly extreme enforcement approaches like GPS tracking bracelets that inform health workers when someone steps outside a quarantine zone and they are told to return. The apps we are discussing in the US and that are already being used in parts of Europe are of course supposed to be less invasive and opt-in, but even with the supposed safeguards that will be put into place, there is some question as to whether the benefits of these apps are sufficient to outweigh the costs when we consider factors like asymptomatic transmission. Bruce will talk about this in the broader issue of surveillance and privacy for about 15 or 20 minutes and then we'll open it up for questions. At the bottom of your Zoom screen, you will see a Q&A icon. You can type in your questions there and we'll get to as many of them as we can in the time we have. So Bruce, over to you. Thank you and thanks for showing up virtually. This is our new normal and we're making the best of it. So I want to talk about privacy, security and contact tracing both specifically and generally. There are a lot of issues here and it's worth teasing apart what they are. I've written about contact tracing less about privacy and more about efficacy because the first question in any of these electronic systems is, is it any good? Is it effective? Is it going to do anything positive? And I maintain that contact tracing apps are effectively useless and the fact that we're considering them is really just tech solutionism and doesn't reflect any actual defense against the pandemic. I want to walk you through the reasoning. The contact tracing apps are very much like an authentication system. And they're trying to figure out whether something is true or not. When you get any of these systems, you look at accuracy in two ways, in terms of false positives or in terms of false negatives. So if you imagine an ATM machine, you have an ATM card and the security, you look at it in both of those perspectives. If it's false positive, can someone else get money out of my account? And that would be the ATM machine mistaking someone else for me. If it can do that, it fails as a system. But there's another failure mode that's actually even more important and that's a false negative. When I go up to my ATM machine, will I be denied my money? And that actually will happen more often just because the number of legitimate requests, vastly outnumber the number of fraudulent requests. And in any of these systems, an ATM machine, you know, the fingerprint ID on my iPhone, false positives and false negatives. Can someone else open their iPhone with their finger pretending to be me? And is there a point where I can't open my iPhone because the phone doesn't recognize that I am me? So with that model, let's talk about contact tracing.  I'm going to make this up. So contact is more than 10 minutes, less than six weeks. And that's what the system will register. And we can build in different privacy safeguards, we can build in where that data goes, who gets to see it. All that aside, it's registering what it defines as a contact. So let's think about the false positives. And that's things that aren't causing a concern. There are inaccuracies in both the geographical location of the phone and the proximity sensor. So there's using multiple systems, actually three systems to do that on your phone. There is the cell system. Very coarse tells you what cell you're in. And that has to work, otherwise this phone can't ring, it doesn't know I'm here. There's a more accurate GPS system, which you've used if you've used any kind of navigation system. And you know it's pretty accurate, but makes mistakes I play Pokemon go on this phone. I know how GPS drift works and I see it all the time. And then lastly there's Bluetooth. And that's the system you use to communicate with other objects close by. There's no location, but kind of signal strength is a proxy proximity. And that's what it's using. So those all have error rates. There are a lot of times this will register that you're close to somebody when you're actually not. The second is that the phones don't know about extenuating circumstances. The third one is when I am less than two feet from somebody else for a period of eight hours and we're separated by a hotel room wall or a glass partition. I could be in a car and someone can be outside lots of times when that we are in close proximity, but it doesn't matter for disease transmission. The second source of false positives is that there are contacts that don't result in transmission. It is not the case that less than six feet more than 10 minutes equals a disease transmission. It equals a possibility at lots of times when we were actually much more sophisticated about how the disease transfers now than we were even a few months ago.  Right, so this thing registers a contact doesn't mean I have the disease.  And that's me getting the disease without this regular contact. So we have the same inaccuracy problem. This doesn't always know where I am and who I'm near. Not everyone has the app. Even Singapore had a 20% accept rate for the app. You need 80 or 90 to make this a useful system. Lots of people, you're going to be near don't have the app. And then there's the transmissions without a contact. Right now I think we've all watched the animated videos of a sneeze and how far the particles travel. It's way more than six feet. And so there will be lots of times you will get the disease without this phone realizing there's a contact. So given all that error rate. Here's the question. If I have the app, I go out grocery shopping and come back and this thing beeps. Does that mean I have the disease. No, does it mean I should quarantine probably not doesn't mean anything useful. Not really. Similarly, I go out this thing doesn't beep. Does that mean I'm safe. Kind of doesn't. And the most important thing we have in this pandemic is trust and squandering that trust an app that doesn't work. In the next three days they'll be Twitter posts. This thing didn't work it didn't tell me I got I had the disease that it told me I was sick and I wasn't it didn't register that I was sick. So there's not value in that there's value in contact tracing. That where it's done effectively you South Korea, the Boston area, it's manual it involves trust involves interviews and involves people is not an app. There's a lot of tech solutionism here. So let's sort of put that aside and think about where we might want to use technology. There are three things I'll hear about when I hear about tech and and COVID. The first is is contact tracing. The second is some of these aggregate statistics, which seem to be very valuable and there's a company that makes interactive thermometers fever thermometers, and they've been posting hotspots of fever around the country based on their aggregate data. Really interesting. We see charts on how people are staying indoors by how they're using Apple Maps to get to driving directions walking direction. We can know a lot about general movements, very anonymous, very valuable. The third thing you see here talked about our here I'm under a lot of names I think there's immunity passports. Is there some sort of digital document. I will need to be able to get into a movie theater a restaurant a dance club that proves that I have immunity. Haven't seen those those are talked about. In a sense they're no different than credentials we have today I mean right now I have a driver's license which is my age verification card which I need to prove to get into a to a bar. So it's those similar things. I don't think the the the the mechanism will be any different. When you think about any of these things. There are a bunch of general privacy principles that that we have that we apply. I mean, is it effective. And more importantly, is it proportional. You know we're in a global health crisis. It makes sense to make extreme trade offs of things we wouldn't do in normal time, we might do today. If contact tracing via app was a an effective thing. We would all probably say yeah that's a good idea. Now today, not last year, maybe not next year, but now. Is it effective is it is it proportional. And then we want to see six different things we want to see consent. Does the user consent to it. We want to see minimization is the data minimize to the extent necessary. Is it secure is the data secure. Is the system transparent. Do we know what it's doing and how it's working. Is the system biased. Does it disadvantage some group in one way or the other. And then lastly, is it temporary. Is something we can turn off when the crisis is over. And those six things are how we should evaluate a seven, if you count efficacy and portionality, or how we should evaluate any of these systems. It's really not just true here in COVID is true everywhere. And a lot of people writing about how contact tracing can undermine privacy by putting us all in our surveillance, we're already under surveillance.  And Google your search knows your innermost hopes, fears, dreams, as you search on them.  It's just a new usage. But surveillance is the business model the internet. There's no change here, adding a one app to the 50 on your phone that track you. So what, but I want to close with an interesting, I think, interplay, which we're seeing here as increasingly important. So data has value to us as society and us individually. Contact tracing, let's assume it's effective. As you make this choice. Data together will help us fight the disease. Your location data, who you talk to who you're with, yet that is incredibly private in person. That is a balance. And you and there's a similar balance appears in a lot of other places. And when I used to drive places I use Google Maps that got me route would route me around traffic. That worked because everyone who uses Google Maps is under surveillance. And that's how the system knows where the traffic is. The group value is we all get where we want to go faster. The individual risk is our location information. Now you think of Facebook, Facebook will give you free access to talk to your friends and have your communities do all that cool stuff. Yet they want to know everything about you to target advertising. That's the trade off. More generally in health, I think there's enormous value in taking all of our medical data, putting it one database and letting researchers at the benefits would be enormous. At the same time, it's incredibly personal intimate health data. In all these cases, the same question. How do I balance this value to me as a member of the group to the value to me individually. And there's no one answer to this. It's very domain specific. All right, so Google Maps I can make this up. The data is valuable only 10 minutes. You don't save it. You don't need to know who it is so it's all anonymous. And you don't need all the data so you sample one in 10 cars, like done. I've kind of just solved that medical data. That's not going to work. I need everybody's data by name or ever in a database. Everything. So I can't do any of those solutions. So maybe do something else. I secure it very, very strongly. I only allow queries that have been pre approved under strict guidelines and contractual obligations, where research questions are approved in advance, and only aggregate data is provided in return. Unless there is some rules about unmasking and I'm kind of just making this up, but it'll be a wholly different set of trade off. And it'll be yet a third set for contact tracing, and maybe a fourth set for free internet services in exchange for advertising, and a fifth set when we talk about data that the police might want to stop crimes and terrorism. But this to me is a fundamental question about data in this century that we haven't explicitly answered. Obviously we allow for profit corporations to do what they want to sort of figure out the trade off that works for their near term profitability and kind of accept it. But I'd like us to think about it more deliberately and make decisions about it more deliberately. And that's what coven among other things is bubbling up. We'll see how that goes. Any other questions. Thank you, Bruce. That was a really good overview of some of the issues and I'd love to be able to delve a little deeper in some of them. The point that I hear coming from you loud and clear is that we actually need a bigger, more federal approach, let's say to thinking about how we feel about data privacy. And the problem is that this hasn't been handled at the level that it needs to be handled. Given that we are where we are, we are looking as you point out at very specific trade offs in each of these places. So I want to drill down a little bit deeper into the six issues that you mentioned. Starting with this idea that which was the last actually on your list about efficacy, which was, you know, the first thing you started with, it doesn't seem like this would be very effective. There are studies that have come out the Oxford University University Big Data Institute found that a coronavirus outbreak in a city of one million people is halted if 80% of all smartphone users use a tracking system. And, you know, caveats in this model they assume that the elderly are expected to self isolate on mass. But, you know, since what we really need is to get the RO below one, we really just need to shift things a little bit. And no one I think is talking about digital tracing contact tracing in and of itself, we're all talking about using it in conjunction with the manual system. So if you have this army of digital contact tracers that Cuomo talks about, we're still going to need that the question is, is it helpful to have this as an added little thing to add that little extra bonus, which potentially pushes the number down the RO number down far enough that we can actually get this thing moving in the right direction. And the issue that I think we're going to run into, you know, obviously there's this idea of 80% of people choosing to download the app and you say even in Singapore it's only 20%. If we can actually address some of the privacy and security issues which I would like to go into a little bit further. Isn't that the key to getting people to adopt this you say trust is the most important piece. Isn't that the key to be able to build trust so that we can actually get people to comply with a system that allows us to move this in the right direction. I think the key is the thing that we need otherwise this is this is a waste of time, which is ubiquitous fast, cheap, accurate. Without that, none of this matter. With that, a lot of things are good enough. So sure, this, a digital app, if you convey its limitations, its problems, if you don't treat it as this is the magic thing that will keep you safe, could easily be part of a more extensive manual human base system, because it will be more trusted. The key is testing. The thing that that we need to make this this this work is testing. And, you know, I'm actually not worried about the privacy of these apps the the Apple Google system is fine. It's got a lot of privacy protections and actually what it does is it pushes all of the decisions about who gets the data how it's dealt with when it's made, not public when it when it bubbles up to the to the to whoever puts the system together they just building an API. They actually punted on all of the hard questions, because they didn't want to be responsible for it. So, you know, different countries will have different rules about centralization and decentralization, and how it could be made voluntary a mandatory or how to make it work. That's what we can do that's just the tech tech is actually not the hard part here. The hard part of the tech is the testing part, but it really is getting societies to take this seriously and work together. So sure, an app can be a part of this solution. Usually you just understand what it can and can't do not expect more of it in Singapore is dumped their app, because I mean it was really just policy giving policies let me talk about wasn't actually doing any of anything valuable. I think by the time we get this system, like in place and scaled. This is like a year or two year project this is not something that's done in a week. So it'll be too late. You're not going to really see this. You're not going to see this actually mattering. But if we had testing if I'm trying to we try to teach at Harvard in September, and try to figure out if the school can open up. And basically dorm dorms are the same thing as cruise ships. It really seems hard. But if you can test the entire student body once a week. Maybe you can do it. And if you can't is probably no way you can. And an app isn't going to fix any of that. So then manual digital tracing also is not likely to be helpful. It's more helpful manual involves interviews. And there's some really, really interesting studies I've seen reports where they're looking at transmission was that we know a lot more about transmission, where a restaurant I think was in Hong Kong was mapped who is sitting where where the person was who got the disease. That's how we kind of know that the low of the air conditioning mattered a lot. It was a call center where one person was sick and people didn't didn't getting where they were in the room. A church which was a choir we know a lot more. And those are all through contact tracing, but that was apps don't give you that level of detail that fine grain knowledge. But the app at scale is basically something to tell you as an individual, you are now at risk. That's what the app does. And the app can't do that. Unfortunately, yeah, because the error rates are too high in both directions. And you in order for it and this is hard. We have we always run into this when we want to tell the general public to do something has to be actionable, immediate, and useful, like wash your hands. I can tell you to do that. That works. Where a mask, I can tell you to do that. But if the app beeps quarantine for two weeks, not a chance. Unless that thing is dead on accurate. So going back to the six things that you mentioned one of the things you brought up was the issue of bias. There's obviously a huge issue with respect to inequality in terms of who's actually being affected by the disease. An increasing discussion as to how any kind of digital approach to dealing with this is just going to exacerbate it because if you look at the fact that I don't know if it's true but rumors are that Android based systems aren't as effective with this and you know about that. You're right. That is definitely a cultural divide. A little bit about that to be the wealthier have the iPhone. So if it's going to exacerbate the issues that we're already seeing with an equality around this. There's a lot of inequalities around this disease because the co morbidity conditions are so important. Right.  So if you have had bad in a bad nutrition, if you've are obese, you are diabetic, you have a heart condition. This is more likely to affect you. And I think we're seeing that both in the United States along racial divides on national divides and I mean Germany is surviving this like surprisingly well and probably in five years we're going to understand what is it about the German lifestyle. Very typically, it makes them more likely to survive. Oddly, smokers are more likely to survive. You know, we don't know why yet. So it was a yes I think that there are we have to worry a lot about how this affects different groups in different ways, not just the app that in general, it's really exposing the inequities in the American health care system. Right. Given that you're pointing to the fact that we have not answered these questions more broadly in terms of controlling privacy. And what we've heard so far you say that it's not a problem in terms of the technology with respect to Google and Apple and we can tell them to delete the data anytime we want. But as a political economy question, we all understand that the way that this has worked is that it's being much of the privacy question is being driven by the ad revenue question and the fact that we have these tech monopolies. So from a political economy perspective, how do we think about the issues of, you know, we're handing over the potential to do this to Google and Apple, we're handing over the ability to collect yet more personal data to these companies. How do we think about actually putting into place some kind of regulations that say the data is going to be deleted at such and such time there are only these restrictions and maybe not even Google and Apple how do we control the fact that this data could then go over to governments and we've just sort of handed over yet more of our private data to them. So I don't know that I don't know that yet more. I mean this has been happening for the past 10 years. Nothing is new. This data has been collected. This data is being used against you. This data is being handed over to government. Well before cove it. I don't see any change. And yes, this is a huge issue. Shoshana Zuboff has a book this thick called arises surveillance capitalism. It was published well before cove it again you know on a scale of one to 10 it's already a 9.5 and maybe now it's 9.5 001 and so on. But yes, I mean right now, we're living in a world where these systems are designed with a near term financial benefit of large multinational cooperation. That's the way the system works. And I don't like it. I think we shouldn't like it. And we should try to fix it. How is going to be hard. You know in the United States there's no appetite for any real regulation that would offend the wealthy. Instead of in any way shape or form it's not going to happen here. I'm looking more towards Europe right now they they seem to be the regulatory superpower on the planet and are doing something a little bit, try to increase privacy not very much. But these are important questions to have me isn't are these business models moral. Do we want surveillance capitalism to be the driving form of capitalism in the century. Do we want to give up all of our data to be used really against our interest right it's you being used to manipulate us. That's advertising that's been all for at, you know, for corporate needs and increasingly for political needs. But I don't see the content tracing apps is adding to that. I mean, the, the protocol is I know people have an iPhone iPhone has sort of a find my phone feature where if you've lost your phone, you can do something and other phones are in the nearby will look forward for you. That was extraordinarily well designed system that protects privacy at all level. There isn't this big database of phones and where they are. We can do the math. We can build the privacy. And yes, there'd be one private app among the 50 apps that are tracking location that are not private. So, you know, so what. Already in the US, we have governments querying these databases for law enforcement for counterterrorism for for lots of applications already China is using location data on your phone in Hong Kong to track protesters. Nothing to do with coven doesn't make that worse cover doesn't make that more likely. It's already happening and it's already a big deal and coven just means people are thinking about it more. Okay, let me turn to the questions that we have coming in so if you're just joining us you weren't there at the beginning there is a panel at the bottom that says q amp a so feel free to type in any questions that you might have the Bruce. Um, and we have a question here that's asking about the state of the specific apps. And while you say they might not be very helpful. There is a question as to where we are with the Google and Apple app and then something about the Bloomberg contract tracing initiative in New York Tim cop cop seal is asking is the Bloomberg contract tracing initiative in New York app based any thoughts on what's being done there. I don't know about what's being done in New York sorry I can't comment on that as to where the, the Apple Google system is it's sort of interesting they're building an API, they're not building an app, they're not building a system. They are building a set of tools software tools that you as a country as a state as a city can use to build a system. And what I know lots of groups are looking at it. And nothing has been fielded yet. So there was a Singapore system which has been abandoned. It was this Israel system I can't tell how much it's being used if it's being used. So stuff was happening in China, Germany is thinking about something lots of people are piloting and thinking, but I don't know how much of it is being done on a broad scale, and trying to be effective. And you know there's something I thought I lost a point and I want to see if I can get it back it'll come to me later to keep you going I'll write down if I hear it. Yeah it does seem like there actually are a number of countries that are experimenting with this and I think many of them are using Singapore's original app and they're building variations on this. So I think a number of European countries for example. But I guess my question is, are they then finding that they're really ineffective do we know anything about what's coming from those digital apps from countries that have already implemented it. I think we do. I haven't seen a lot of info on the efficacy we just know Singapore doesn't kind of dump bears. That's what I think it's another another area that where apps are being used, and that's to monitor compliance.   Yeah. So that is another area, and that would be effective we have to talk about the, you know the civil liberties of that kind of it effectively it's kind of a sloppy house arrest ankle bracelet. So you're expected to hold rather than it being attached to you. That's the same kind of idea. You know, so we can do the tech the issues tend to be the policy above it may immunity passports, I can do, I can build you a some kind of digital credential that's tied to you. You can't give to somebody else has your picture on it or something. You can show and say look, you know, basically a digital driver's license on us. We have to decide do we want a society with that kind of two tier have and have not know the safe and the unclean it does sound kind of icky. But you could imagine a saying, you know, yes, we want to be able to reopen these businesses but the only way we can do it the only way we can have a concert hall. In 2021 is with it with an immunity passport there's just no way to do that safely. And then we decide do we want to make this very extreme privacy and liberty trade off. Yes, I don't know what the answer is but that's not something I want to do lightly. I want to really have a national conversation about that. Before I just say sure that's a great idea. Well that's exactly it how do we get to the point where we can have a national conversation about this because you know now that it's our health at stake people are much more likely to be willing to give up some amount of privacy but then the question is, is there a way to dial this back. Once we've got a question I would go back to you say how do we have a national conversation about pretty much anything. Okay, the problem is bigger than this. And I have I mean I have stacked up some pretty serious issues in society and you know United States and other countries that we really need intelligent thoughtful, kind national dialogue, I mean I can't even talk about wearing a mask that are becoming a political statement which is crazy. Right, I mean clearly it's out of control but there is this issue of you know since we're talking about the tech in particular. We really do need a policy at a federal level that thinks about our privacy and how do we roll this back because I think you know when you talk about the issue of trust. How much of the trust issue is dependent on how much do we believe that at the end of the day we're going to be able to get back to someplace before this or are we just letting them erode our privacies on a day by day basis. We're letting them erode many countries have privacy commissioners United States does not that but you know the big tech does not want this big tech basically wants all of our data all the time, and because it's an incredible wealth generation machine. And we have a lot of trouble as a country enacting policies that go against incredible wealth generating machines. My belief is that you fast forward 20 years, and we will look at surveillance capitalism, the way we look today as a business model of sending six year olds up chimneys to clean them. But sure it was a great business, but it was fundamentally immoral and we stopped doing it. Right. It's going to take a lot to get from here to there. Yeah, something's gonna happen next couple years. I really believe it's going to be the younger generation. When they start coming into power coming into politics, they'll be able to make these hard trade offs, and we as a generation aren't capable of it. You know climate change. I live in Minneapolis. Right now there are protesting riots in my city, because for policemen basically executed a black man who we're pretty sure didn't actually do anything. The problems sort of we have that require the dialogue about the militarization of police. That's an important one. That's more important than this one. And I can't have that dialogue.  I'm very sympathetic. I want this to work. But a lot of me is kind of like get in line. Well, my fear about looking to the younger generation for this particular issue is that I feel like with the younger generation they've already in some sense accepted the trade off and been willing to give up so much of their privacy to live their lives online that they're less likely to be upset about it than those of us who still have some expectation of privacy. So that's a common myth. It is a myth. The whole young people don't care about privacy. Okay. The thing we know about young people from you research studies to deep dive sociological studies, say that is not true. Oh, okay. Young people they think about privacy differently. That for us it's private by default and being public takes effort for them it's public by default being private takes effort. And they are much more sophisticated and nuanced about their privacy. They understand it to a degree that we tend not to we think Facebook everybody knows that the younger generation is much more sophisticated. And to them privacy often matters their peers, their parents, their teachers. And often like many of us they feel powerless. And this is where the the sort of where the nature of the social networks matters. What's important to us as human beings is communication. We are having this seminar on zoom, because we want to communicate with each other. We have a lot of privacy issues, a lot of security issues they've gotten better, but really I use it all throughout is way more important was setting up a zoom call with friends and having virtual dinner together. That's what mattered. And we are all such social creatures, and these platforms play on that and pray on that to take advantage of us. Young people don't care about their privacy. They care, they do what they can, and they understand how powerless they are. Fair point. I have a question here from Nylo Olivero saying instead of privacy transparency must be the goal to all, including disclosure of companies actions and capital movement. Why do we need privacy let's get aware of everything as long as it's shared broadly. So we'll assume the person I said question is wearing clothes. In the question there didn't type is sexual fantasies in, and we'll assume actually he does want some privacy to so we'll sort of get rid of that do away with privacy nonsense because no one actually believes it. Even, I'm blanking on his name, who so as the CEO of Google said you have zero Eric Schmidt, zero privacy ready to get over it. I mean he still keeps a lot of things private. So privacy matters for power. So here I'm going to sort of give the real explanation that the notion is transparency let's all know everything. So sort of sort of to sort of I guess equilibrium states, everything is private. And everything is public. So, let's pick one and not the other let's pick transparency is that privacy. The difference is the power level. So data about privacy increases your power. So think of government or cooperation so use government is up here and individuals are down here. So privacy in individuals increases their power. There's less differential. There's more liberty is privacy and government is closer. Transparency individuals lowers individual power is a greater difference. So liberty is decreased. Okay, but watch what happens the other way corporations secrecy of privacy and corporations increases their power. Again, the differential is increased less liberty. Transparency and corporations or governments increases that power is more liberty. So you tend to want transparency or the powerful governments and corporations privacy for the individual. That is what is best for liberty. I have a question here from dark Carmichael. How close are we to big tech and government merging into a single big database of database system of complete monopoly. I don't know five years ago. You don't you don't need a single database. You just query each other. We learned from the Snowden documents the NSA is breaking into corporate databases all the fricking time and getting data. And we know that they were using national security letters to get databases, and they got the entire Verizon list of who made cell phone calls to whom. So you already seeing this public private surveillance partnership, you're never going to see one database that doesn't make any sense. You're going to see lots and lots of different databases, and then all using each other. So already, we have this, like the public private surveillance partnership, you already have the merging of government and corporate interests, the United States under our rules in China under their rules in Europe and Russia and all, you know, in all those other countries. So this is not something that is coming to something that is here. It just doesn't look the way that you see depicted in science fiction. Um, you know, there is a question of how much we as a populace have to say, in this question, because if I think about India, I actually have a question here from Ishita Mukhopad from India, who says we have a rogue a say to app in India. The app generates data and the data shared by private health providers who use this as a market survey without the knowledge of the consumers. And, you know, my understanding of this particular setup in India was that it had 50 million users within the first 13 days of its release. So there was a huge adoption in India. And India is already seeing a problem with the ID system that they've been using before this, which was supposed to help everyone access social services. And there've been tremendous privacy and civic violations as a result of that. So I think, you know, we're seeing countries like that where technology is being used really in its most extreme dystopian form. Yeah, I mean, under her I was, I think it was a problem from the beginning. The promise makes sense and the government sold in the promise that we just need to know what our population is and how to get them benefits and how to understand them. But actually rolling that out among, you know, a country as large and diverse as India had huge problems and I think we're seeing the fraying and any of those systems it's always the edge cases that are that caused the problems but they're the things that matter. So, so yes, there's, there's, you know, India has on the heart and United States we really have driver's licenses, and they are linked. So again it's not one big database it is 5052 individual databases that can be queried together and can be can be brought together. China is building their own sort of national system here called the social credit score, which is trying to bring a bunch of disparate data streams into one large decision making process. I think of this in three in three different way in three different steps. United States is a lot of conversation now about face recognition that there are cameras that will automatically recognize faces. They do that through databases of tagged photos. So we have provided Facebook with an enormous resource to violate our privacy by tagging all of the photos we give to them. So, and these systems can be used to put a camera on a street, watch who walks by and attach names to them. And this talk in the United States about banning is Cambridge has banned it. I think Oakland in California has banned this use for law enforcement. But it really is the a much more general problem. And that's identification. And it could be your face. And it could be the MAC address of your phone. It could be the way you walk could be your voice. It could be a retina scan that is grabbed with a with a very high resolution camera. Lots of ways you could be identified without your knowledge of consent identification in any way, then this correlation, taking that at any data and running it through databases and learning more stuff about you. And whether that is your rest record, that is your credit card purchasing history. That is your Google maps information of where you go, or combination there of maybe information about your finances.  If you use a use case, you walk into an apartment store. I guess when you can walk in apartment stores once again. The system knows who you are somehow. It grabs information about your buying habits and your income level, and it either treats you well or poorly. The information is given to lower sales people who treat you well or poorly based on that is a use case. That's fair. Do we think that's just how different is it from right now, when I when I go to the airport back when I went to the airport. And I used to fly 280,000 miles a year. I had the top tier secret status on Delta. I assure you my flying experiences was different than everybody else in that airport. Do we think that is fair. You know, this happens at Disney, Disney World, you can buy a more expensive pass allows you to cut the line is that fair and just identification correlation discrimination. The technologies matter, but it's that flow that really matters.  We want to discriminate and they want to devote their resources to the more profitable customer. Right, and that's going to fall along income lines obviously, but gender lines racial lines I mean pretty much every demographic line, they will be a difference. And some of those are probably illegal. The more dystopian vision that I heard of this is once they have facial recognition down to this extent and they have access to all your contacts they can essentially take faces that are familiar to you. Merge them together so that you don't actually recognize it but the composite is likely to tap into your psychological perceptions and you tend to react more positively to people who are familiar. So they have a way to sell you advertising with faces that are composite that have the ability to actually get you to feel positively disposed to as far as you know there's only a research study.  You will feel more positive towards them when you see them, either in a print either in a static ad or a video ad, you'll be more likely to buy the thing that is in the realm of technology. And I can deliver web pages that do that individually. I don't know if it has been done. I believe it is legal to do. Yes, I mean that is, that is a deep psychological manipulation based on you know these this this identification correlation discrimination. Right. So apropos of that there's a question here that I think really gets to the heart of the issue. It's easy to feel powerless and how my data is already used. As we move into the next phase of data being collected, what can a person outside of tech, government and law, due to ensure that our privacy is considered when new policies are being put into place. Make this a political issue. Say more please. Fortunately, the era of the era of tech things you can do is almost over. Your data is not in your hands. Your email is stored by Google or Apple or somebody else. Your photos are stored by flicker or Falkie or smug mug or somebody else. Now your, your conversations are on Facebook and, and WhatsApp and YouTube and you know, so a lot of our data isn't under in our hands and our financial information credit companies have. There's not much we can do individually. We don't control our data anymore. They're in the cloud controlled by corporations. What we can do is agitate for better policy. The thing that it hurts us the most that this has never been a political issue, except a little bit around the edges. And this becomes a major political issue. When people campaign on this issue, then we'll get some change until then we're not likely to get much. But you know, there are exceptions. California passed a data privacy law. It's not great but it's something. You know, and there was political pressure to make political noise that is the most important thing we can do. It's not it's not a tech trick. There are tech tricks but they're all around the edges. I can give you advice like don't have a credit card don't have an email address.  The living in the first half of 21st century need those tools. This gets back to the powerlessness point I made earlier. I think that people think that Facebook isn't spying on them. They know that Facebook is spying on them. But that's how they talk to their friends that's how they see their relatives. That's how they, that's how they're human. So that they're, they understand they're powerless, and they're accepting it because they have no choice. Well, Bruce, thank you for taking the time to share your ideas with this on on this issue with us and what's disturbing is that once again, I feel like what we're seeing is that the issues around coven are simply highlighting the issues that we've been dealing with for a long time around privacy and the political economy issues that we're dealing with big tech and monopoly. And, you know, there is going to be this question I think that as we look at contact tracing because I do think we're very likely to have these digital apps put into place and you know they're already being used in many countries now and we're very likely to see something being used in this country so I think we're not going to be able to stop it and you know maybe it's a tiny little bit of privacy over lost over and above what we've already lost but I do think it's this constant erosion that everything about the pandemic seems to be pushing us towards and the fact that most of us are now having our meetings over zoom or having conversations over zoom means there's just that much more of our personal private lives that are now accessible to these companies. So we're left once again with the big political economy questions. We don't know how to how to handle except you know try and address through political context. Yeah, I think it's exacerbating a lot of things is exacerbating the problems with our health care system, especially problems with income inequality with our policies that favor big corporations over small businesses with our, our centralized food production, with the idea that that the market will affect all inefficiencies out of a system in terms of profit, and it turns out it turns out inefficiencies were a security mechanism that we've lost. Yeah, so I mean a lot of things this crisis is really exacerbating and highlighting. And, and this is a singular moment. And I think this is something the likes of which we have we've seen few times in our country and previously American Revolution, American Civil War, and the Great Revolution that there will be a lot to that there will be enormous potential for social change. And I think we need to seize it. Very important words I think for all of us. We have a lot of young people who tune into a net events and I think this is really something that they need to be taking and running with I think this really is a call to action to all of us. Thank you so much for joining us and for taking the time. And thank you to all of you who tuned in. We have this more or less running as a regular webinar series now so our next webinar is going to be on June 11. We have Danny Roderick talking to us about issues around globalization in the age of COVID, which of course is another critical issue because we're seeing the rise of ethno nationalism and isolation. But in part, I think which is once again an exacerbation of issues that we were dealing with previously where there was a backlash against globalization and the pandemic has just highlighted many of the issues underneath that so I hope you will join us for that and you can register for that if you go to the website. So thank you all and thank you Bruce. Thank you. Bye bye.


SCP-167 Object Class Safe Special Containment Procedures SCP-167 is currently kept in room ██ of Research Command-06. Its door is to be padlocked at all times when not under study. Anyone wishing to obtain the key to conduct unscheduled exploration of or to study SCP-167 may do so only with the permission of the relevant level 3 personnel assigned to this SCP. Description SCP-167 is a cube measuring approximately 10 meters on its edge, created from an unidentified shiny white plastic polymer. A fix to one of the faces of the cube is a large metal door. It is unknown if this door is part of the original SCP, or if it was affixed by someone else before the object was acquired by the SCP Foundation. The interior dimensions of this cube are identical to the exterior, minus several centimeters for the width of the cube, except that two of the remaining three walls each have doorways in them. These doorways lead directly to identical rooms, each with two more doorways leading to more identical rooms. This pattern continues for as far as the research teams have been able to determine. The placement of these doorways appear to be random. No pattern has been found that explains which two of the three remaining walls have doors. SCP-167 shows signs of being explored before. A number of rooms, especially those at a low depth, have red dodge or other markers painted next to the doorway back to the entrance. Researchers are recently taken to replicate this behavior on any rooms they visit, after the events mentioned in Document No. 167-08. Additionally, several man-made and natural objects have been found scattered in some of the rooms of SCP-167. Religious idols, circa 500 BCE, several treasure chests, circa 1500 CE, and several SCPs, most notably ████, Addendum 167-01. SCP-167 does not appear to follow the rules of Euclidean Geometry. A different path to rooms which should be the same room was taken by two researchers. Both arrived their destination, but neither saw nor heard the other. How SCP-167 is warping space to create this effect is unknown, but warrants further study. Addendum 167-02. A request to test the effects of SCP-184 on SCP-167 has been suggested. This experiment is under consideration. Document No. 167-03. A request to use SCP-167 as a compact storage space for benign SCPs have been proposed by Dr. ████. This proposal requires a reclassification of SCP-167 to safe class, so a reevaluation is pending. Document No. 167-08. As most of you are aware, Dr. ████ was videotaped entering SCP-167 several days ago without the requisite ball of twine, and he has not yet returned. His ultimate fate is unknown, but the search teams have turned up nothing. Let this be a reminder to all of you just how easy it could be to get lost in there if you don't utilize some method of marking your path. If I find that any other researcher has disobeyed the safety regulations and entered without a ball of twine, no matter how far or deep they intend to go, they will find themselves being transferred to another facility for researching Keter-class SCPs, so they should have ample motivation to learn to follow safety regulations quite quickly. Dr. Klein


Hi, everyone. Today, we are going to give a talk on fast execution for function compositions in serverless computing. So this will be presented by myself, Retran Chen and my colleague, Stanley Akin-Akus, from Nokia Bell Labs. So I hope you will all enjoy our talk. So cloud computing has been a huge success. So in the past few years, there is a trend in cloud computing to enable application developers to focus on only the business logic of their applications and to abstract away from the actual infrastructure, which is running their applications. So this trend is so-called serverless computing. So as the name indicates, serverless computing refers to the concept of building and running applications that do not require server management. So it describes a very fine-grained development and deployment model, where applications are composed of a number of functions, and each function can be individually executed, scaled, built in response to the incoming traffic. So all major cloud providers, including Amazon, Microsoft, Google, IBM, so they have all embraced serverless computing concept. So so far, the current serverless practices can deal with the highly parallelizable tasks and can handle this sporadic, unpredictable node in a stateless manner. So companies in different industries are migrating their applications onto serverless platforms, such as data analytics, video encoding, decoding, events processing, and so on and so forth. So this certainly covers a lot of real-world use cases. However, the current serverless practices still can't live up to its full potential. For example, it couldn't support latency-sensitive applications and couldn't support applications which require faster state access. So those missing capabilities are critical to many modern applications. For example, many applications at the network edge require the short latency. And also, for example, the video processing applications that require the state management and the faster state access. So the current serverless platforms couldn't efficiently support those applications. So in this talk, we will show you how we can extend the applicability of the serverless computing to support those types of applications. So here is the outline of this talk. So first, we will give an overview of the serverless computing paradigm and its wide adoption. So while it's quite promising, so we will still show you what the problems are with the current serverless practices regarding function invocation delays and application state management. So afterwards, we will dive a little deeper into the existing serverless platforms and then give our approaches to address the problems of the existing platforms. So towards the end, we will give two demos to showcase the benefits of our approaches. So let's first take a look at the serverless computing in general and its adoption. So here is how serverless computing works at a very high level. So with serverless computing, a developer doesn't upload the entire application onto the serverless platform. Instead, the developer uploads the code of each individual function of his application onto the serverless platform. Then the developer will define what the events which can trigger the execution of the functions. So here the events can be anything like database triggers, timer events, or the events can be some detected network anomalies, some sensor ratings from the IoT devices, and so on and so forth. So basically, the developers can define any types of events. So whenever there is such an event coming in, the serverless platform will create an instance of the associated function to process the event and generate the result. Of course, if there are multiple concurrent events coming in, the serverless platform will simply create multiple instances of the function to process them in parallel and generate results. So those results can be returned back to the users or can serve as the events to trigger other functions in this workflow or in the application. So basically, this is how serverless computing works in general. The functions of an application can be executed, scaled, and build individually. So with serverless computing, there are several significant benefits for application developers. First, developers don't need to care about server resources and the server management. So they just simply deploy their application functions into serverless platform, and the platform will manage the applications for them. So there is no server management for developers. The second benefit is that an application is now consisting of individual functions. So each function can be managed and scaled up and done separately and individually. So not like before where the entire application or a big component is a unit for scaling. So with serverless computing, the function is a unit for scaling. So whenever there is an event coming in, the serverless platform creates a function instance to process the event. So once the event has been processed, the function instance is terminated. So this needs to greater scalability. So the third benefit is that with serverless computing, the platform will schedule the necessary number of function instances in real time to handle the incoming events, no more, no less. So this needs to lower cost for users because they only pay for what they have actually used, not like before with virtual machines or containers. So users usually have to pay for what they have reserved. So with those three benefits, serverless computing further enables higher productivity because now developers don't need to care too much about server management, scaling and cost. As a result, developers can more focus on application logic. So this needs to higher productivity. So here, let me give a concrete example to show that serverless computing is being widely adopted. So as we know that AWS is one of the market leaders in cloud computing and its AWS Lambda platform is also the pioneer in the serverless computing area. So at the beginning of 2020, Datadog performed an analysis over its customers who use AWS services. So from this Datadog diagram, so you can see that nearly half of those customers, they have now adopted AWS Lambda. Also, the AWS Lambda is quite popular among the company's running containers in AWS. So from this diagram, we can also see that nearly 80% of the companies in AWS that are running containers have now adopted Lambda. So those reports show that AWS Lambda or more generally speaking, serverless computing platforms are no longer limited to early adopters or niche use cases. So instead, serverless computing is widely adopted for various real-world use cases in various different industries. So serverless computing seems quite promising so far and has gotten a lot of adoption, but it doesn't solve everything at least yet. It still gets some significant problems which limits the applicability of serverless computing. So next, let's talk about those problems. So as I just mentioned, serverless computing does not solve everything yet. The current serverless practices are good at dealing with concurrent and easy to paralyze jobs and are good at handling sporadic, unpredictable traffic. So this is simply because that whenever the serverless platform receives an event coming in, it will create an associated function instance to process the event. And the many concurrent events can be processed in parallel. In addition, the serverless platforms usually work in a stateless manner. Whenever a function instance has finished, it will be terminated, but there is a big however. So the current serverless practice is bad at dealing with two kinds of applications. First, it can easily support the latency sensitive applications which need to react fast on events. For example, many applications as a network edge are latency sensitive and cannot tolerate, for example, an extra delays of hundreds of milliseconds when start. So to give you a better understanding of this problem, so we have run a typical image processing application which is composed of four functions. The first function extracts the metadata from their original image and then process the metadata recognized objects in the image and finally resize the image. So we have run this application on two serverless platforms including AWS step functions and IBM cloud functions. So here are the results with the average of 10 runs with warm starts. So the blue bars here indicates the total runtime of this application and the purple bars indicates the actual compute time of the four functions which compose this application. So ideally for both platforms, the purple bars which are the actual compute time of those four functions should be the same but they are a bit different because of the different hardware of those serverless platforms. So then the difference between the blue and the purple bars is the overhead introduced by those serverless platforms which is fairly significant as you can see. So for example for AWS, the actual compute time is a little over 400 milliseconds and the serverless platform incurs an extra of 200 milliseconds overhead. So this is an overhead of 50%. For IBM cloud functions, the overhead for this image processing application is even higher over 100%. So this substantial overhead severely affects the applicability of the existing serverless platforms to support net as a sensitive applications. So in addition, the current serverless practice also doesn't support applications which needs fast access to state. For example, in a video processing application, some states needs to be maintained across the processing of different video frames. As a result, the fast access to the application state is also needed. However, in a typical serverless platform, so functions are executed in a stateless manner and function instances in the platform are not addressable and there is no direct access to functions in memory states. So this needs to a situation where if one function wants to transfer the state to another function. So it needs to trigger the next function and pass over the state. Or as an alternative, the first function externalizes the state to a storage and then the next function can retrieve the state from that storage. So this needs to snow access to the application state. So before I describe our approach to those two problems, let me first dive a little deeper into the existing serverless platforms. So in a typical serverless platform, so that there are multiple hosts and those hosts are interconnected via a method bus or other mechanisms like service mesh or something similar. As I mentioned before, so with serverless computing, developers upload functions individually. Let's say there are two functions. One is red and the one is blue. So in a serverless platform, functions are usually isolated with containers always light with the ends. So here, let's say the red function is loaded into the container in red and the blue function is loaded into the container in blue. So those function containers are then deployed onto the hosts where there are enough resources available. For example, the red container which is hosting the red function is now deployed onto host one because this host has enough resources. And here, the blue container is also deployed onto host one which still has enough resources. But of course, if there are not enough resources, the serverless platform will deploy the function in containers onto other hosts according to certain policies. So those function containers handle the associated events and stay deployed until a timeout. So if there are multiple functions and the function containers, if they want to interact with each other, the interaction is usually using a distributed message bus, service mesh, or other similar techniques. So what are the implications of the existing serverless platforms? So there are three aspects. So regarding the function execution, so in the existing serverless platforms, there are a few options. So the original approach is to start a new container for every function execution. So this is so called a code start. So before the function gets actually executed, the code start process needs to set up a container, note the runtime, note the function code as well as the libraries and dependencies are required by the function code. So depending on the complexity of the function, so this code start can easily take seconds or even tens of seconds before the function gets actually executed. So this is a significant overhead because quite often the function per se takes only hundreds of milliseconds to execute. So people have realized the overhead of the code start and proposed the warm start approach. That is instead of starting a new container or light with VM for every function execution and determining it once the function has been executed. So we can actually keep the container warm and idle after the function execution has finished. So maybe it's better to reduce the idle existing containers. So this can skip many of the steps in code start and reduces the invocation delay of a function significantly. But those warm containers would unnecessarily occupy system resources. In addition, either the platform or the users as they need to manage those warm containers in certain ways. So the third approach is that if the traffic is more regular or more predictable, so users can provision the usage of the containers and the light with VMs to process the traffic. So in this case, the users will have to pay for the provision containers or VMs even if they are not being used. So for example, AWS provisions concurrency is working in this manner. So the second aspect is about the function concurrency. So if there are multiple concurrent events with the above three approaches, either you have to start a new container which may be slow or you can reuse the existing or provision containers if some of them are idle and available. Otherwise you would still have to start new containers or the concurrent events have to be queued until some containers become idle and available. So the third aspect is about the function interactions. So in many existing serverless platforms, if functions want to interact with each other, they need to go through distributed messaging but with very little locality consideration. So in this talk, we propose a set of mechanisms to enable the fast execution for function compositions in serverless computing. So our goal here is to address the two pain points in the existing serverless practices. The first goal is to reduce the invocation and the interaction delays for function executions. And the second goal is to enable the fast access to the application state. To achieve those goals, we developed three mechanisms namely application-level sandboxing, local messaging and the addressable function executions. So we have designed and developed an open-source serverless platform called KNICS to realize those mechanisms. So with this, I now hand over to Akin who will work you through those mechanisms. Towards the end of this talk, Akin will also use our KNICS serverless platform to showcase the benefits of those three mechanisms that we propose. Let's start with how to reduce function invocation delays. The first approach that we propose is the application-level sandboxing. Imagine there are four functions. The red one and the blue one are composing application one. The purple and the yellow one are composing application two. In many serverless platforms, each such function is treated independently regardless of the applications they belong to. Our insight here is that the different concepts like functions and applications should have different fault isolation. Strong isolation is desired between different applications. However, such a strong isolation between the functions of the same application may not be needed. The rationale behind this is that the functions of the same application tend to interact with each other and they are usually from the same developer. So as a result, isolating them if they are total strangers might be actually redundant. On the other hand, we would want to have strong isolation between different applications because we don't want them to interfere with each other. With the insight of two-level isolation, we propose the application-level sandboxing. We put different applications in separate containers. The functions of that application are run as separate processes in the same container and we load each function into its own function worker along with the dependencies. When there's a new event, the associated function worker forks a new process to handle that event. And when there are concurrent events, we simply fork multiple processes as function instances to process those concurrent events. This application-level sandboxing has two beneficial implications. First, forking a process is much faster than starting new containers, such that invocation delays of function executions are actually significantly reduced. Second, once a function instance has finished processing, the operating system will terminate the associated process. As a result, we can benefit from the automatic deallocation and allocation of resources. Our second proposal is to use locality to reduce function interaction latencies. Recall that in existing platforms, functions usually interact through a message bus that is distributed across the infrastructure. As a result, even if these functions are running on the same host, this interaction has to go through this bus. Our insight here is that we know that the functions of an application are going to interact with each other. As a result, we can create shortcuts for these interactions. In other words, we'll exploit the locality of these functions that was created by the application sandboxing approach. Let me show you how this would look like. Basically, we can have local message exchange mechanisms inside each sandbox. For example, a local message bus. And when functions interact with each other, they will do so locally. Doing so usually is faster than accessing a global message bus that is distributed across the infrastructure. And this approach has the following implications. First of all, these local shortcuts for interacting functions of an application contribute to reducing invocation latencies, which in turn reduces function interaction latencies. And second, we have dedicated messaging per application sandbox, meaning that it cannot be interfered by others. Let's revisit that image processing application that we had seen earlier. Recall that we have four interacting functions that compose this application. With the ideas of the application level sandboxing and the local messaging, Canex can achieve the results that you see on the right-hand side. As you can see, the overhead associated with facilitating the interactions among these functions is significantly reduced. As a result, the total runtime is much closer to the total compute time of the functions. So far, we have presented ideas to make regular function executions and their interactions faster. These regular functions are stateless, and if an application requires to keep state, the developers are usually forced to store that state in an external storage. What I want to do next is to revisit that concept a bit. What if we could make these function executions addressable, which is not possible via regular function executions today? And what if we could manage these addressable function executions similar to the way we manage the regular functions? We could start them on demand, use them as needed, and stop them when not needed anymore. In other words, we could still preserve the on-demand computing principle of serverless computing. But what does it mean to have addressable functions? It means that one can send multiple messages to the same function instance that has already started executing. And the biggest reason why this is desirable is that one can access that function instances in memory state, which could be keeping the application state. And as a result, an application can benefit from the fast access and still enjoy the benefits of serverless computing. Let me show you how this works. We still invoke an addressable function like a regular function. Upon receiving a message, the function worker still forks itself to create an instance. The difference here is that a regular function execution finishes and disappears, whereas an addressable function instance stays running. To find this instance again, we keep some routing metadata. And when there is a need, the platform uses this metadata and finds the running instance and delivers the messages using the local message bus. The implications are the following. First, the running function execution can keep the application state in memory and access it fast. And by being able to address it, the rest of the functions in the application can also access that state. Second, it is still a serverless function instance. When it is not needed anymore, it can be stopped by sending it another message. Next, I'll show you two demo applications. The first one is a simple application that showcases the sandboxing and the local messaging ideas. I'll try to show you how these choices lead to significant reductions in function interaction latencies. The second one is another serverless application that is slightly more sophisticated and is more of a proof of concept. I'll first show you a serverless application that is utilizing regular, stateless functions to recognize faces in live video without using a GPU. Then, I'll show you how this application can benefit from using an addressable function for its latency-sensitive tasks, again, without using a GPU. For these demos, I'll be using a single-host setup with all Canex components running on bare metal. Here is the first demo application. Like I said before, it is pretty simple. There are only two functions. The first function, F1, just takes a timestamp and triggers the second function with that. The second function, F2, takes another timestamp at the beginning of its execution. As a result, we can measure the latency between F1's end and F2's start, which is the function interaction latency. In other words, we'll measure how much latency overhead the platform is adding to facilitate the interaction between these two functions. While showing you this demo, I'll also briefly walk you through the GUI dashboard of Canex just to give you an idea. In the dashboard, you can see the functions, the workflows, the key value object store, as well as some documentation about the API that we exposed to user code and the usage of the SDK. Let me create these two simple functions. And here I can add first the function one and I could actually just type in the code here in the inline code editor, but I'm just going to upload the code from my computer. Afterwards, I'll also add function two. Similarly, I'm just going to add that code from my computer. And next, what I need to do is essentially to stitch these two functions together in a workflow. And therefore, I go to the workflow tab. I add a new workflow that's going to be called WF interaction latency. And here I can also get an inline editor where I can basically just type in my workflow description, but I'm just going to play it safe and then upload it from my computer. And after uploading it, I save that workflow description. And later on, I can see it again in the workflow editor. So here you can see that my workflow starts with the first state and it is using the resource that is F1, that is our first function. And then the next one that needs to be triggered with function one's output is essentially the second function, basically F2. And then afterwards, our workflow ends. Let's deploy this workflow. As you may recall, this is running on a bare metal setup. And therefore, we directly get the endpoint of the container address of that application. And we can copy this URL and then use it in our scripts to essentially programmatically trigger this application if we want to. Here I'm just going to basically use the GUI and then open the execution window where I'm just going to type in some sample input and then execute it. As you can see, after a while, we basically get the execution visualization and you can see how the message essentially flows through the workflow. It went to function one and then to function two and then afterwards it ended. And in the execution timeline, you can see how long it took for each function to finish execution as well as you can deduce the actual function difference between the two. Now I can execute this again and then in the execution output again, I can see the milliseconds that it took from first functions end to go to the second functions beginning. So just to give you a quick recap, the application sandboxing approach and the local messaging ideas that we presented in this talk are actually enabling KNICs to significantly reduce function invocation and interaction latencies. Let's see the other application. Here's the first version of the second demo application. It is a proof of concept that shows that one can recognize faces in live video with serverless functions. Basically, in this version, we try to recognize faces without any addressable functions. Let me briefly describe the workflow. We have two execution paths, training and recognition. The training path is for us to upload some pictures and attach names to those pictures. We detect the faces and encode their signatures which we store in our data store. These signatures are later going to be used to recognize these faces in the video frames we receive. The second execution path is about the recognition. For that, we launch a set of parallel recognizers and each recognizer produces a binary response, basically a yes or a no, whether a detected face belongs to a known person in the dataset. For example, if there are three people in our dataset and we have a single detected face in the current frame, there will be three recognizers. When these recognizers finish, they send their results back, namely the coordinates of the faces and the names attached to them. For this application, I'll be switching to the terminal. Here, we can utilize an SDK to programmatically interact with the Canix platform. Let me start that application and let's see how it looks. Using the SDK, we upload the functions as well as the workflow description and then when the application gets deployed, we upload some training pictures and as you can see, my face is being detected and recognized. However, the frame rate is not great. That's the reason why the video looks a bit choppy and the face box is moving around, not in a smooth way. Now I want to show you another version of our face recognition application that takes advantage of the addressable functions. The biggest difference in the workflow is the addressable function that is called coordinator. Before I describe what exactly the coordinator does, let me briefly explain the simple idea of this approach. The recognition task is computationally a more expensive task than tracking a detected object. That is why the previous version's output was not very smooth and had low frame rates. There was no tracking. It was always trying to recognize faces from scratch. In this version, we'll try to improve that using an addressable function. Here, we will recognize faces once in a while and the rest of the time, we will track the already detected and recognized faces. And we will achieve this by utilizing the addressable function coordinator. What the coordinator does is two-fold. Every 30 frames, it launches a group of recognizers similar to the previous case, where each recognizer produces a binary response, whether a detected face belongs to a known person in the dataset. When they finish, their responses are sent back to the addressable coordinator. The coordinator then starts tracking these detected and recognized faces. This tracking data structure is the application state that requires fast access in order to provide a timely response for each frame. Let's see how that works. We now start the application that uses an addressable function. We again upload the functions and the workflow, and we also upload the same training pictures. As you can see, the frame rate is much higher and the video output is much smoother. When a recognition task is done, the application can continue tracking the detected faces in successive frames. And as a result, it can produce a timely response for a better output. This is achieved by keeping the application state in a function's memory and by keeping that state up to date by addressing the function instance. You can also try Canex for yourselves. We have a test system running at canex.io that is incorporating the ideas that we presented in this talk to achieve lower startup and interaction latencies as well as to enable addressable function executions. You can also install Canex on your own infrastructure. We have health charts if you want to install it on Kubernetes with Knative, or we have Ansible scripts for bare metal or VM clusters. And finally, here are some useful links. All the code is available at GitHub along with the installation instructions. We also have a Slack channel that you can join to learn more about Canex or get help if you need any. And finally, the SDK and the command line tool are available at PyPy. Thank you.


Okay, let's get started for this presentation about automatically restricting permissions for the GitHub token. My name is Varun Sharma and I'm the CEO and co-founder of Step Security. Before starting Step Security, I was at Microsoft for 15 years. So this is what we'll talk about today, we'll talk about a story of a supply chain attack on the VS Code GitHub repository and that will lead us to a discussion about GitHub tokens and then we'll discuss how to set minimum permissions for these tokens and then I'll talk a bit about this open source project called Secure Workflows that can set these minimum permissions automatically. So this is a new story from Jan of 2021 where a security researcher was able to push a commit into a release branch of Visual Studio Code and this is what it actually looked like. So this is the VS Code GitHub repository and as you can see this is a pull request that has been merged. It just has a single file which is a proof of concept to prove that it was possible to push this file and the interesting thing here if you see is the user that has actually done this commit and it says GitHub Actions and what that, the reason that is interesting is because typically it requires a maintainer of that project, someone with right access to be able to push and merge a pull request but in this case it's been done by GitHub Actions and what that really means is that this has been done through a GitHub Actions workflow. So GitHub Actions is a CICD platform from GitHub and it's quite popular, in fact if you just search for these workflow files on GitHub you'll find more than 2 million workflows just for open source projects. So I'll talk about more about how this was done but let's talk about what is this token and how is it set up. So in this screenshot you see a typical GitHub Actions workflow and every workflow has a GitHub token and when it starts the token is issued and when the job is completed the token expires and the reason is because it's used to access different GitHub APIs and this token has a set of permissions which you can see in the build log, the most important permission here is the contents write. So this token has permissions to write to that repository where the workflow is running and so what had happened in that case is that the researcher was able to find a command injection vulnerability in a particular workflow that VS Code had and was able to inject their own code in it and exfiltrate this GitHub token and once they exfiltrated it they were able to, because it has contents write permission, were able to create a new branch push changes and then merge the pull request and so the best practice here is to actually set minimum token permissions for this GitHub token and as you can see in the screenshot you can set permissions using a permissions key and this is something which is recommended by GitHub and it is also something that the open SSF's code cards project finds and it classifies it as a high risk issue. Now the problem is that if you actually wanted to set these token permissions you would have to do these things manually so you would have to first of all know about the token and the token permissions, you would have to review your workflows one by one and then for each of these steps figure out what are the permissions needed. If you are using a GitHub action which is written by someone else then you would have to go and look in their code to see what the permissions are then you would have to sum up all of these things and put the right key in your workflow files and as you can imagine this is a cumbersome process which is why very few workflows actually have permissions set which is why they are not secure. So what secure workflows does is it is an open platform to update CICD pipelines to comply with security requirements and you can find it at github.com slash step dash security slash secure dash workflows and one of the things that it does is to set token permissions automatically. So the way it works is that it basically just does the same steps that I had listed but it is done in an automated manner and in addition it has a knowledge base of what permissions are needed by common GitHub actions and that knowledge base is stored as a YAML file so if you see the screenshot on the right you will see that for the labeler GitHub action it says that the permissions needed are contents read and pull request write and there is also a reason specified. So when it evaluates a workflow it goes through each of the actions being used and looks at the knowledge base to find what are the permissions that that action needs and then sums it all up and comes up with a recommendation. So in order to use it you can go to app.stepsecurity.io and as you can see in this screenshot you basically paste your workflow in there, click on secure workflow and it's going to do the evaluation and modify the workflow file and add the required permissions. You can also use this by using the open SSF scorecard action. When you use that action it has a recommendations link and it basically points to the same URL. So this is the impact of this secure workflows project so far. We used it to fix token permissions for top 10 critical open source projects and for that step security was rewarded the secure open source reward by the Linux foundation. In case you're not aware of this, this was actually discussed earlier in the conference where these are rewards given for securing open source projects and over 1500 workflows have been fixed so far and these are some references about the stuff that I discussed but thank you, let me know if you have any questions. Yes, so that is one of the features is to automate a token permissions. In addition, it can also pin the actions to a particular commit shot so that's another recommendation from Scorecard and GitHub so it does that as well and in the future we'll add more things so the idea is to sort of automate the remediation steps for developers so they don't have to spend time and effort doing that. Yeah, exactly.


I'm Christine DeBry, and I oversee the fellowship program on public knowledge. In the past two years, we've had seven public interest fellows. Our first fellow, Kate 4C, was at the forefront of the net neutrality battle. Our second fellow, Ej El Casaperalta, advocated for low income and rural telecom and internet issues. She's now a student in law school, and she's planning to continue the same focus when she graduates. We hope that by training and mentoring public interest fellows, they will go on to careers being a voice for the public. I came to public knowledge with a background in political campaigning and technology communications. And this fellowship offered me the opportunity to combine those paths, while also infusing the arts, which is something I've always been really passionate about. I have been overwhelmed by the support I've had here from the public knowledge staff. From day one, Gene Kimmelman and everyone at public knowledge has made it very clear that their priority with this fellowship program is to really kind of groom the next generation of advocates. And I feel really blessed to be one of the people who's benefiting from that. My fellowship with public knowledge gives me a fantastic opportunity to work hands-on every day with the issues that are most important to me. I came to law school because I was fascinated with technology and communications policy issues. The opportunity to work with public knowledge at a law school has given me an amazing opportunity to learn, to develop my skills, and to contribute to the public interest community on these important issues. At public knowledge, I have the opportunity to work on issues like modernizing lifeline, special access, bringing broadband and accessibility to communities that need it. Part of the reason why I took this fellowship is because technology is at the forefront of the issues. Public knowledge is at the forefront of those debates. And so when I wanted to get another opportunity to learn and develop public knowledge was really the only place to go. I was an undergraduate student in mathematics and computer science at the University of California in San Diego when I decided to take a year off school and do a fellowship with the Ford Foundation and the Mozilla Foundation with my host organization as public knowledge. So I'm a traditional technologist, and public knowledge is a public interest advocacy organization, so I'm kind of an outsider. But that has given me an amazing opportunity to learn all about public interest advocacy, what actually happens in Washington, the reasoning behind the laws that govern technology and everything that is important to me. So this fellowship has been an amazing opportunity to meet people, go to Congress, and actually do work that will hopefully have an impact on the things that affect the rest of my career. I really have been pleasantly surprised by many of the strategies that my time here at public knowledge has taught me. The importance of coalitions, for example, especially for organizations that have limited resources, and the opportunity that you have when you sit down with the opposition and really just clear the air and communicate with them what you both are thinking. These are some really kind of hardcore strategies that I can apply in the rest of my career as an advocate. And it's because of my experience here at PK that I've gotten to learn that. I came to public knowledge because I was inspired by the organization's commitment to increasing opportunities for freedom of expression on communications platforms and infrastructure. And I was inspired by their work increasing access to knowledge, information, and culture. For law students who are just getting out of school, who want to go into public interest, it can be really difficult to find opportunities to launch their career. A lot of public interest organizations don't have the resources to bring recent law grads on and help them kind of learn the ropes. And I think that a fellowship program like Public Knowledge is key to providing the tools for new lawyers to become public interest advocates. I think if you are interested in being a fellow, it's something you should absolutely tap into. And public knowledge, the fact that we have a handful of fellows is really something that's quite unique. We have a chance to engage with each other. We're all also doing our own thing on our own paths and I feel very lucky to be here. I'm Gene Kimmelman. I'm president and CEO of Public Knowledge. And I have been a public interest advocate for more than 30 years. And for much of that time, I have actually been trying to learn from others at the same time as I train young new advocates how to do what I have been doing. This is important for many reasons. Number one, for the advocates themselves. They come with knowledge. Some are lawyers, some are economists, some are technologists. They come with a passion usually for doing public interest. But what they don't have is the understanding of how to translate that into actual policy. How do you deal with policy members? How do you deal with the media? How do you deal with broad stakeholder communities? How do you put together a coalition? That's what we try to bring together for these people. So they have the opportunity to experiment and learn on their own feet how you truly make policy. It's valuable for an organization like Public Knowledge because we get the diversity, the passion of new people coming into the field, a virtual pipeline of new skilled energetic advocates. And we put them to work. But we also give them a full immersion in the process of they understand the nuts and bolts. And we see if it works for them and if it works for us. And then finally, it's really important to our democratic process because by bringing in new people who are wanting to make change, who really want to influence the policy-making process, putting them into the nuts and bolts of what works and what doesn't work, what's effective. How do you work with people who disagree with you? How do you work with the business community? How do you work with ideological policy makers who don't see eye to eye with you? That's so fundamental to making our democracy functional, making sure that the public interest first is fully represented in that process. But also that we have a new generation of advocates who know the inner play, the back and forth of the policy-making process so that they can maximize their influence in our democratic political system. Hi, I'm Whitney Tonkin, Senior Development Manager here at Public Knowledge. I just wanted to conclude our video by saying thank you to all of those that follow our work and continue to support us. We here at Public Knowledge feel very strongly about our fellowship program. The program not only benefits the fellows themselves, but it also strengthens the field as a whole. We'd like to continue to work with the fellows and give them the skills they need to become effective public interest advocates in the future. But in order to do so, we need your help. Please visit www.publicknowledge.org slash give to donate today. Thank you.


Welcome to the Phytec booth. I am Martin Schwan and I am working on update and device management. We have a group of developers working on this system and we provide you with a mechanism to keep your Phytec hardware up to date. This is what we do. So it's all about secure updates, easy updates? Yes, so the main advantage of our product is that we provide an easy way and a secure way to update your Phytec hardware. And we do this by adjusting our BSP so you have not the hardware to do. So we do it for you. Alright, so why do you need to update devices? Well, the obvious reason is for security reasons because you always want to have the latest security updates on your device and you want to do this quite often. So you have to have some kind of automatic system that does this for you. And there are other obvious reasons like updating because you just want to fix your bugs in your application for example. So why people choosing Phytec? Is this a big part of it? It's a main part of our BSP, our board support package that we provide with our hardware. So this is also the advantage. If you buy a hardware from us, it's a standard part of it. And you don't have to pay any extra fees for it. It's a standard part for it and you get the support by default. But what's different between the updating and life cycle management or is it very related? It's very related, yes. The life cycle management is about the whole process. It's about supporting your software for a long time. And then the update and device management process is about actually updating your device. So updating the BSP on the hardware. Is it updating now or what's happening now? Are you triggering something in there? Right. So we have already started a rollout and we see that one of four devices already got updated. And the other ones are about to update in a minute or so. So we might see it also on the screen. So how does the update process work? So we have two main components. On the boards we have the update client itself. We are using ROG for this. This is the Robust Auto Update Controller. It's a product from Pengutronics. And the other component is Hockbit that we see on the screen. It's the interface for managing your devices. We can also list the different devices here. Four boards and two different software versions for the demo. And we can start a rollout that we just did. And this will automatically update the devices. Is this industry standard kind of software? Do you develop this whole UI or did you work together with the supplier? So the interface is an Eclipse project. So this is also open source software. And we did not do any adjustments on it. But we plan to do some in the future. And this is also going upstream. So everything that you see here, the software, the components that you use is all open source. And so what's going to happen in the future? What do you think? One great thing we are working on that's coming in the next month is differential updates. So the way it works is that we only update the part that changed. So this stays very much on the bandwidth and makes the update faster. And the other things is that we want to make this whole system as easy as possible. What do you customers say thus far about how easy it is to use? This is the project we just started. But we already had some very interesting talks to some customers. And I think they'll come.