We shall continue our discussion on intra granular corrosion of metals and alloys. We completedtwo lectures on intra granular corrosion of metals and alloys. If I can summarizewhat we have seen so far, we are I suppose clear on the definition of of intra granular corrosion right. I think people should be very clear that it is happening at the grain boundary selective attack taking place. Now, we said that among all the metals and alloys stainless steel suffer extensive intra granular corrosion especially when they are being welded when they are not properly heat treated actually. So, in order to understand the intra granular corrosion of stainless steels, I gave very brief introduction to classification of of stainless steels and the role of various alloying elements how they affect the corrosion performance right we saw that. Then we went on to discuss the mechanism or you may call it as a theory of intra granular corrosion of stainless steels. Please notice that the the intra granular corrosion mechanism may not be the same for all metals and alloys. So,we focused on what kind of mechanism operating in the intra granular corrosion of stainless steels and very specifically towards the austenitic grade stainless steel ok. And if you recall the major problem is the chromium depletion because of the formation of the chromium carbide. And that occurs in the selective temperatures in the range let us say about 450 to about 800 to be degree Celsius it occurs. But more importantly here it is just not the formation of chromium carbide and the depletion of chromium as a result of the formation of the chromium carbide. The chromium carbide formation is heterogeneous nucleation it forms at the grain boundaries. So, it is heterogeneous nucleation at the grain boundaries and so, the depletion of chromium is centered around the grain boundary area. And so, the stainless steel at that area loses the the stainless steel capacity to repassivate to passivate. So, there is a selective attack taking place. The sensitization process we said was dependent on what dependent of course, it is it is it is the chromium carbide formation. But what are the governing relationship there? The governing relationship there are the temperature, the time, the holding or if you are going to cool it the cooling rate. If you are going to look at cooling it is going to be in the cooling rate. These are the essential relationship that happens in the stainless steel. In a sense I can have a very high carbon containing stainless steel I can still avoid sensitization provided I cool it fast enough to avoid chromium carbide formation that may not be practical, but ok in all cases. But you will see later it is possible in some cases with high carbon content I can avoid sensitization. That means, the factors that govern are the kinetics ok. The kinetics are temperature, time, cooling rate. These are the factors that actually control to what extent the sensitization can happen or if at all it can happen in a given thermal process. Then we went on to discuss the factors affecting intra granular corrosion from the point of view of the alloy from the point of view of the metallurgy of the stainless steels started looking at it. And we said that of course, carbon content is a primary one you know you need to reduce carbon content. By no way you can simply increase chromium content and let the carbon content remain the same and avoid the sensitization process ok. We saw that you know we discussed that in detail. In addition to carbon content there are other alloying elements can marginally influence the this sensitization process. Some of them are beneficial some of them are detrimental ok. We saw for example, nitrogen you know is beneficial. Chromium is beneficial ok, tantalum niobium are beneficial whereas, nickel is not good. So, you just look at the relationship actually. But one thing I forgot to tell there was that the nitrogen is beneficial over a range of concentration range of composition. Somewhere I would say below 0.16 weight percent. If I keep adding more nitrogen to stainless steel what could happen? It can also form chromium nitride right. It can form CR2 N, it can form CR2 N. That also you see here 1 nitrogen captures to chromium it can happen. But within the limited extent it is it is it can be beneficial. Then we looked at the the the grains right role of grains. After all the sensitization occurs at the grain boundary area. So, the nature of the grain boundaries affects the corrosion. So, we said that the energy of the grain boundary which means you know the energy of the grain boundary dictated by whether it is going to be low angle or high angle grain boundary. This has got low energy. So, less IGC or no IGC you can say equal to high energy you have high IGC occurs. I do not say high IGC because you know I mean most of the material that you encounter alloys and all have high angle grain boundaries only where. So, we we did not of course, go in detail about the definition of high angle low angle. But I just say that twin boundaries are supposed to be low angle grain boundaries. So, if you have twins in the in the austenitic stainless steel the twin boundaries will resist the the the formation of the chromium carbide and so, the sensitization process. In fact, these are important from the point of view of intergranular stress corrosion cracking. So, stress corrosion cracking we have not discussed so far. Stress corrosion cracking can be assisted by the sensitization of the grain boundary because the crack can travel along the grain boundary and make the metal more susceptible to cracking under tensile loading conditions that part we will see later. Now, we look at the grains and we look at the grains from the point of view of the energy of the grains. There one more thing that we need to look at from the the the grains coming continuing the grains is that the size of the grain size of the grains you call a grain size of an alloy right. Find out the grains better it is from mechanical you know properties point of view you can have high strength and toughness together actually right. So, what would happen? What do you think will happen if I reduce the grain size I keep the composition same the carbon content the same the chromium content the same even other alloying elements content to the same, but I reduce the grain size. So, what do you think will happen to sensitization increase? Why do you think it will increase? The grain boundaries becomes more it makes yeah one way it makes some sense. But look at other way around the chromium carbide formation occurs only along the grain boundary. There is a limited carbon right the carbon content is limited. So, you cannot form more chromium carbide than that is allowed in a given alloy that is dictated by the the carbon content right. So, assume that all the carbon is now converted to chromium carbide now I have alloy which has got smaller grain size and larger grain size so, what will happen understood or not? The volume fraction of chromium carbide formation does not depend upon the grain size it depends upon what depends upon the carbon content of the alloy right right. I want to say that the volume fraction of chromium carbide formation is the same, but the grain size of the two alloys are different one has higher one has a lower one. So, what will happen to sensitization now? So, suppose like that now look at visualize now I want you to think yeah, but then over a time period you cannot have more carbon you know I mean the carbon content is limited only right. If you are going to have infinite source of carbon then probably you will have more sensitization right. Assume that the chromium carbide formation volume of 23 C 6 is the same. Now, I am distributing this chromium carbide over here and over here. So, what happens? See if you look at here the overall grain boundary area right the grain boundary area in this area is more grain boundary area is is less am I right.  So, if the if the number of grains are increasing in a given in a given volume the number of grains are increasing then the volume of grain boundary area or I would say volume I would say the grain boundary area is more. So, I distribute this chromium carbide here and here the distribution becomes more dense here. So, this could be less continuous less continuous distribution of chromium carbide here happen more more continuous I would say continuous distribution of chromium carbide. So, you will see that the grain boundaries are so well closely packed with the chromium carbide here it is not packed with the chromium carbide because same chromium carbide has to be distributed over a larger area right. So, where is the attack here? Attack is more here, attack is less here. So, lower the grain size is beneficial from the point of view of sensitization. But please notice it is not a overriding factor you know you I cannot keep the carbon content at 0.08 and lower the carbon content I mean I mean keep the carbon content at 0.08 and then lower the grain size yeah it can have some effect, but it is not going to have overriding effect right. Please understand that ok, but it does affect the sensitization because of this particular factor. So, the depletion of chromium is more in the grain boundary areas of the larger grains as compared to the depletion of chromium over here ok. So, you find the smaller size are better from sensitization point of view as compared to the larger larger grain grain size in a in an alloy. I hope you you get this idea right or still anybody has a problem. The next point that I would like to talk about is role of crystal structure. We saw earlier we classify stainless steel as austenitic, ferritic, martensitic, duplex and precipitation order of the stainless steels. By nature the precipitation order of the stainless steels do not have very high carbon content. The carbon content is very low the strength of that stainless steel comes from where comes from the alloying elements right like aluminum and copper they form precipitates they give rise to strength. So, the carbon content of that is very low. So, the the remaining ones we should look at how these class of stainless steels perform with respect to sensitization. Let us take the ferritic grade. Let us look at the ferritic grade now and see how we if you take a an austenitic grade and ferritic grade which one will suffer more or what is the tolerance of carbon when it comes to ferritic stainless steels? So, for more right. So, what is the solubility of carbon in ferrite as compared to austenite? So, ferrite is dissolves very low amount of carbon right. So, it cannot saturate more. So, that means, when you are going to heat it it is much easier for the carbon to precipitate into chromium carbide in the ferritic stainless steel as compared to the austenite stainless steels. So, the solubility level of because you know you know isn't it for FCC structure the solubility of carbon is always more as compared to a BCC structure of steel right. So, you find that ok. So, that means, here it is a poor carbon solubility. So, in this case in this case even nitrogen is detrimental. So, we can say that carbon plus nitrogen has to be less than 100 ppm. So, what sometimes people do is they add some titanium, some stabilizes titanium is added to stabilize. Of course, modern ferritic stainless steels have very low carbon I mean there is no problem, but even then you can add some titanium because it is easy. But there is always a problem in the low carbon varieties right. When you weld you can you can pick up carbon from the surrounding suppose you have some grease or something right you weld it the grease gets converted into carbon on on on when you when you strike arc and carbon gets into the material right. So, ferritic stainless steels are more problematic compared to the the austenitic gray stainless steels. Austenitic we have discussed very extensively before right here the the carbon content can be less than 0.038 percent because the solubility of carbon in the austenite is better as compared to this. Let us take the case of martensitic. Martensitic stainless steels are generally containing higher carbon content right. Why need a higher carbon content? Yeah it forms a modern side and secondly that is what gives hardness also right. So, in order to form you know modern side you need to have reasonable carbon content without that you cannot form. So, the carbon content of martensitic stainless steels are higher compared to austenitic grade of course, ferritic grade actually, but even then they are less susceptible they have higher carbon right. In fact, highest carbon in among all the stainless steels they are less susceptible to IGC you know tell me why. So, modern side stainless steels are used in what condition generally or modern side steels generally what conditions do you do use it in fully modern side condition? What do you do that? You temper it you know if you do not temper it then what happens? Then becomes so brittle you know the toughness is so bad. So, when a temper is what happen? They form what? They form carbides right. So, they form carbides. In fact, the modern side is stainless steel also form carbides actually without that you cannot temper it right. So, when you are going to temper it you form carbides you can form chromium carbide you can form iron carbide, but preferentially it forms it forms chromium carbide because chromium carbide is more stable as compared to the iron carbide. But even then I say it is less susceptible to IGC as compared to austenitic grade why do I say that? Have you have you heard of tempering martensitic steels? Forget about stainless steel for a moment right tempering of martensitic steels anybody have seen the microsex of temper tempered martensite? Tempered martensite microsex is anybody seen? No? It is sad. Then you cannot get an idea about what it is actually right.  When you temper it how does the carbide form? The carbon forms within the martensite isn't it? What is the martensitic? What is the martensitic phase? It is actually it is a BCT right martensite is a it is a BCT structure we saw it before right and this is a FCC structure right and this of course is a BCC structure. So, it is it is total lattice. So, so much of carbon is saturated now it is not martensite is single phase. So, when you heat it it forms carbide, but what does the carbide form? The carbides form within the martensite martensite is given by some called alpha prime. So, you have more or less more or less uniform nucleation it is not right term to use, but I will use it. So, within so, the grain boundary precipitation of chromium carbide is very less here. So, the chromium carbide occurs all through ok. Now, please understand IGC occurs only when the chromium depletion occurs in the grain boundary area that will happen only when the chromium carbide forms at the grain boundary area. If forms everywhere IGC does not occur of course, the chromium carbide formation by itself can bring down the passivity you all we know that right because the matrix chromium content comes down passivity is lost I am sure. But the issue here is we are talking about the IGC we are not talking about the overall loss in the passivity. In fact, the martensitic stainless steels when they temperate they temper optimally so, that you do not lose too much of passivation. If you do not temper it it is brittle. So, they temperate optimally in order to have good passivation at the same time good toughness actually. So, there is optimization process. So, coming back to the point here the martensitic stainless steels are not prone to IGC primarily because of the fact that the chromium carbides form within the lot within the martensites ok.  But of course, we keep on aging for long time they also can undergo intragonal corrosion, but generally they are not prone to intragonal corrosion. So, please understand the concept of intragonal corrosion in a proper manner actually ok. So, it is not the chromium carbide formation alone is responsible the chromium carbide formation of the grain boundary. And the consequence depletion of chromium the grain boundary is responsible for the intragonal corrosion of of stainless steels. Why does chromium carbide precipitate inside martensite? It is a good question ok. Yeah, then I think then you have to go into the the metallurgy aspect of what is called a nucleation and growth. See martensite when what is the martensite? The martensite consists of a lot of dislocations most of you know about it that is that is the reason why it gives you higher hardness higher strength. So, when you have lot of dislocations within the martensite when you do annealing or aging process or tempering process what happens now? The precipitations occur on the dislocations. The dislocations are large in number within the martensite. So, they preferentially precipitate along the dislocation that is why when I say uniform corrosion I say within quartz it is not really that uniform corrosion. I am sorry when I say it is uniform nucleation I do not mean in true sense of it ok. The true sense means you should not happen at the dislocation also. But because you have lot of dislocations martensite and so, they are very well uniformly distributed in the martensite. So, you have lots of chromic orbit being precipitated there only ok. So, so that is what happens in the case of a martensitic stainless steels. Any other question? Let us get into the next class of stainless steel duplex stainless steels. The duplex grade we need to talk about we say it is a mixture of alpha and gamma each of them in 50 volume percent each it is more resistant than ferritic and austenitic grade. So, very interesting thing actually right. Ferritic stainless steels are more prone to sensitization austenitic stainless steels also prone to sensitization. But you have two phases in the alloy they are better than both of them actually ok. And the reason is not very difficult to understand actually ok. Let me draw some diagram. So, this is an alpha phase and this is the gamma phase in a duplex stainless steel. The precipitation of the chromic orbit occurs here the grain mood I just take only one one precipitate here it occurs very interesting thing happened. Chromium diffusion in alpha is much faster than in gamma. Carbon diffusion and the solubility both are high in gamma phase look at how the cooperation takes place. So, you have here more carbon isn't it because the solubility of carbon is more here. If you take if you take alpha phase and the gamma phase in a given alloy can you guess which would have higher higher chromium content with the alpha or the gamma? Is chromium is what stabilized? Is it gamma stabilizer or alpha stabilizer I mean alpha stabilizer also. So, come on here you should be able to tell right. So, it is a chromium is it has got higher chromium level here isn't it. Partitioning taking place in that you will have more chromium it may even have more molybdenum also anyway that is not important for us. So, you will have more chromium here and the diffusion of chromium is higher in alpha higher carbon. Now, what happens now? The carbon diffuses here fast and chromium diffuses fast here. So, what happens? Now, if it happens now, now what happens? As a consequence chromium depletion is minimal on both the sides because when you have faster diffusion then what happens? Then you do not get a strong concentration gradient right quite fast and there is no need for the chromium in the austenic side to diffuse because when the carbon goes over here the chromium moves from alpha to form the chromium carbide right. So, that means, the grime boundaries are not going to get depleted so much as it happens in the ferrite or it happens in the austenite right. So, that means, what happens? So, it is minimal and so IGC is minimal. So, duplex stainless steels are generally more resistance to IGC as compared to austenite grade and ferrite grade. Of course, modern stainless steel the issue does not come into picture because they they they nucleate in the in the grains of course, there the the corrosion resistance of modern stainless steel falls because of the tempering process. So, this is about the castle structure you have seen how they affect the the sensitization of of the stainless steels ok. So, this should be a known to you any questions here right ok. So, let us let us move forward effect of cold work. If at a cold work when you do a cold working what happens to the material or dislocations right. So, cold work at a low level increases IGC because dislocations easily transport carbon actually right easily transport carbon. High level high level of cold work lowers IGC and you can anybody can guess why at high level IGC is getting reduced. Yeah you have lots of dislocations now in fact, they get entangled right. So, because they promote chromium carbon precipitation within the grains. Of course, you see overall passivation all this will come down you know we are talking please. Again do not try to club everything together we are only talking about IGC. I am not saying that cold working is better for overall performance of stainless steel that is not the the idea here ok. So, this is about the intergranular corrosion the theory the factors affecting the integral corrosion of stainless steels. We have seen so far and any of you have any questions please let me know. How does dislocation facilitate diffusion of carbon, but not chromium? Yeah see when you do the when you see what happens is when you do cold work and you anneal it at temperatures the dislocation gets annealed you know they go to the grain boundaries and all right. So, the dislocation move and carbon can go along with the dislocation actually. So, it it facilitates the movement of or diffusion of carbon to the grain boundary. So, of course, it is not going to facilitate that much of chromium because see and chromium I mean carbon is so small atom it get entangled with the dislocations right ok. So, let us now go to the main topic of weld decay this is the real problem in industry ok. What you have seen is science of that it is a real problem in industry. I am going to show you the one diagram ok one diagrams photo of the weldment ok get back to this here.  What do you do in a TIG welding you strike arc right and use a filler wire you an arc is stuck between the metal and the electrode right. The temperature is so high it melts it melts the electrode either it is it is a consumer electrode for example, or use a filler wire it melts and then they deposit and they join that is how you do fusion welding you do that ok it is a thermal welding here. So, you have a TIG welding you have a mig welding you have laser welding your electron beam welding the brazing the several kind of metal joining techniques they do exist. In all these cases what is common is the joining process is due to the thermal process. They melt and the union between the two pieces they occur. So, stainless steels are being heated the molten things join them together. Now, what is very interesting you you look at this diagram here is the highest temperature this is the highest temperature and here the lowest temperatures the temperature starts decreasing from here to this onwards temperature decreases. Though the maximum temperature is here the sensitization does not occur at the fusion zone it occurs away from it which is called as a weld decay zone generally termed as a heat affected zone. Actually, the heat affected zone is is generally categorized as what that zone where there is no melting takes place, but there is some solid state transformation metallurgical transformation occurs. Over here the so called metallurgical transformation occurs only here not even here also it happens here it does not happen here of course, lower temperature nothing happens. Now, we need to understand why it happens here why not here why not here. Also, we need to understand why can it can move towards left can move towards right you show what happens that means, you need to understand clearly what governs the formation of the weld decay zone that is very important for us to do that. We have seen the science of it we have looked at the interrelation between the metallurgy of the alloy on the time and temperature cycles that you have seen that actually. So, with that we try to understand this particular phenomena of weld decay ok. Now, let us go back sensitization is temperature dependent and time dependent composition dependent can you make a statement like that ok. So, now, now let us see why should the weld decay occur at the heat affected zone though that is the that is the first discussion that you are going to make it. Let us take a schematic of this it is a plain view this ok. Now, when you weld when you weld if I keep a thermocouple here or if I keep a series of thermocouples here up to this point what I can follow? I can follow temperature rise and fall with respect to the time can you do that? So, when I start welding from one end to another end put a thermocouple there and and monitor the temperature with respect to time. If you do this very interesting thing can be observed I am going to give you very schematic of the the temperature variation with respect to time say at location A say fusion zone and this is the heat affected zone. Let us take the fusion zone the maximum temperature will be at the fusion zone right. So, what happens now? The temperature suits up something like that you know something like that goes actually right. What is this temperature? It is well above the melting point of the alloy that you are talking about right 1600 beyond that ok. Let us take this let us take this zone here this is the fusion zone this is your weld decay zone and this is your base metal. Now, let us identify the the weld let us let us identify the sensitization temperature region that is between 450 and 450 to 850 degree Celsius right. So, you have between 450 somewhere in about let us say 600 or 70 you know it may be 1800 you know temperature is quite high temperature. So, between these two temperatures the alloy will form chromium carbide provided what provided you give enough I mean you forgetting that right. It may sensitize between 458 850 this temperature region provided you give enough time. If time is not sufficient then the guy is not going to give rise to chromium carbide precipitations. Now, let us look at the heat affected zone. Now, I am going to now look at sensitization I am going to draw a small temperature time sensitization diagram for you because you need to also know this right what is this temperature around 850 what is the temperature 450 degree Celsius. If I take it to this temperature and quench it very fast no sensitization right or I put to other way around if I can draw a nice thing look at this this is the maximum time that is allowed for the material to cool down right. When you hold it in the gamma this is what this is called gamma region right this is gamma region. This is the maximum time allowed to cool if you go beyond that what happens chromium carbide forms right. So, when you take it to this temperature if you are going to cool it faster than this that means, less time no problem slower than that you are getting into sensitization that means, the time that can be held in this temperature in fact, this region right or actually speaking you should go from here you know if you if you really look at it is a time and is a time am I right time is it starts from here and goes here right this is the time right. If you draw in fact, you know more appropriate way of talking about is what this is the delta t I hope you get it isn't it time taken starts from here right up to this temperature is no problem after the start. So, this is the this is the delta t critical temperature critical time required to avoid to avoid the why the sensitization right. So, this is delta t here now look at this look at this this curve I have started from here this is the time is started and time the ends is here this time it ends. So, this is the delta t that I have here assume that it forms the chromium carbide even chromium carbide forms when you rise the temperature above what happens to chromium carbide? Dissolve right. So, it dissolves. So, this time is not counted because when temperature goes up the chromium carbide dissolves now it starts counting from here and then count from here right. So, this is the delta t the fusion zone am I right where the material is held in that in the sensitization temperature of region am I right isn't it? It starts this temperature it ends here because below there is no problem. So, this is the time it has been kept in the temperature region of 450 to 850 right. If this time if this time delta fusion is going to be smaller than delta t critical what happens? This small t no oh yeah yeah I am sorry yeah thank you very much. If it is if it iswithin that then there will be no sensitization agreed. Now, let us take this case of e temperature zone you guys are ok. Now, let us take the case of e temperature zone it starts from here where does it end ends here delta t it says that let us follow or not follow ok. Now, if you look at here it becomes so obvious for you it becomes so obvious you would find at least delta t fusion is much smaller than delta t h is that can you make it you get it from this diagram. Now, what happens in the case of base metal yeah it it does not get into the region at all. So, there is no sensitization. So, the sensitization of the e temperature zone is quite understandable right because the time the e temperature zone resides in the sensitization region is good enough to form what to form chromic orbit precipitates to get sensitized. So, the e temperature zone is is prone to is prone to sensitization. So, this is the thing that you should be looking at. What is the significance of this delta t? It only says that when you weld it the fusion zone goes through a sensitization regime from 450 to 8, 850 for this much time ok. It may not sensitize even it sensitizes assume that if this delta t is much larger assume that this delta t is much larger even then what will happen because it goes through higher temperature that will that will get dissolved chromic orbit get dissolved. So, that means, this one anyway has no significance from the point of your welding right there is no significance. I am only trying to analyze the thermo cycles during a welding process ok, but otherwise this one does not have any significance at all because even it gets sensitized for argument sake if you make it they get dissolved when the chromic orbit you know I mean when the temperature exceeds the solubility of the chromic orbit precipitate. My word is taking in case of the heat of the kettles zone at the temperature 4 to 3 degrees Celsius yeah taking delta t from that point to that point that is yeah, but in case of fusion zone yeah same weld thermal cycle cutting 4 to 3 degrees at 4 to 3 degrees is equal to 2 points. Yeah. But in that case we are taking only little bit. Good question ok, but I want somebody to answer yeah see here look at here, here look at this I start from here the temperature goes above it is still within the 850 right. So, what happens the alloy continues to transform continues to form chromic orbit right and till it reaches back here that means, all this thermal cycle the alloy is subject to heating which means chromic orbit will continue to form right. If it goes above this only what happens even there is a chromic orbit form they will start dissolving right. So, if this assume that this curve goes here then what happens I would again will take only the second half of it or put it other way around these portions you see here see this is the this is thermal cycle for this right this is for that. Now, I can have a series of thermo cycles starting from here to this many of them are in between things right can you can I can you visualize that what will be the thermal cycle for this will be somewhere here only this guy will go the time is more it is it is it is more than this ok, but then the guy has gone up. So, if I have another thermal cycle the guy again exceeded here right. So, the guy dissolves if it does not dissolve completely of course, then you can count it also I mean it is not there no order first rule, but that you need to make a calculation and see what happens at all ok. So, what we are assuming here is that when it goes up the chromic orbit dissolves actually dissolution of carbides are much easier than nucleation. If you look at generally dissolving is much easier does not require you know that that kind of under you know normally over heating is not required when you melt it you do not need a overheating when you cool it down you need a under cooling because nucleation growth is a problem, but apart from that ok you can able to calculate and see what will be happens in the in the in the in the in the thermal cycles actually yeah. Delta t delta t f is smaller than delta t c then the sensitization does not occur. If delta. If f is smaller than delta t critical. Yes, yes, yes, yes. But why. That is what no you see here you know the fusion zone it starts from here and ends here right this is the delta t fusion zone right if that and generally this time is very small right you see what all are trying to say is that assume that I am going to take 304 of 0.3 percent carbon ok failure wire suppose I take hypothetically do things they do not sensitize it may sensitize why the time take required to form chromium carbide decreases when the carbon content is increasing. So, when you are increasing the carbon content even the fusion zone also can form chromium carbide provided the carbon content is very large, but the carbon content of the fusion zone is almost equal to that of the base metal. So, it requires same amount of time for the formation of chromium carbide ok. So, we need to understand from the point of view of again temperature time cycles ok. So, chromium carbide formation the temperature time required is the same whether it is in the base metal whether it is in the in the heat amplitude zone where in the fusion zone I am not looking at other small variations like you know I am not looking at all complication arising out of nucleation growth and all. Generally, you would say that time temperature required is same. If that is about the case then the fusion zone by inherently will have less time in the in the in the sensation region as compared to the interpretable zone because interpretable zone never crosses the never crosses the the solubility regime of that actually right does not go up that is the reason why it is happening at all. Any questions? This is a good question people asked I think that also brings to clarity in in in terms of understanding what is happening in typical welding of stainless steel. Can we now move? So, what it means to us actually? It means to us that we understand the science of welding in addition to the science of sensitization. What is science of welding? How much heat input I give to the weldment? It all depends upon how much heat I deposit on the weldment but that decides the cooling rate right. Suppose I have a weld somebody welds like this this sheet somebody welds like this this is called as a narrow gap welding now somebody welds like this. The heat input required to fill here because you are going to deposit some amount of amount of molten metal here you deposit small amount of molten metal here the cooling cycle here and here are different. So, the way they sensitize are going to be different am I right. Similarly, the conductivity of this metal and this is different things will be different. So, we need to superimpose the sensitization kinetics with respect to the science of the welding process then only you can be able to understand how the weld decay occurs right. So, this probably start very well in the welding course I do not know how many of you have taken the welding course there you will go through much rigorous treatment of the welding and all the things we will not go through that. I will give you very minimal things to appreciate how the welding processes can affect sensitization weld decay in addition to the alloy chemistry. Now, let us take the cases of types of welding ok I am I am I am going to now look at types of welding ok. Now, we know we can look at an arc welding we can look at laser welding we can look at electron beam welding look at the gas welding. How many of you have taken a welding course? Ok for you guys must be very simple actually it is not that difficult to do that ok. So, before we get into this let us look at some simple properties of this. Let us look at the heat input maybe in terms of joules per mm square or whatever right isn't it something like you give it right. Let us look at the heat input required to weld in the case of arc welding, laser welding, electron beam welding, gas welding. So, how do you consider that? Which one is the highest here in this? Heat input required to weld. I am not talking about the power of the welding I am not talking about power of the welding right. I am talking about the heat input required to weld this much area required to weld right as we are doing. So, if you are not confused bring this to right isn't it ok. So, gas is the highest which is the least here electron weld welding is the least it is the second least this is the third least it is not the right way of defining I should put number 1 2 3, but anyway I hope you can understand this better actually ok. So, these have a consequence like this. So, I want to weld this is a cross section actually you know it is a cross section maybe let us say about 3 millimeter I want to weld and of course, you can you want you can draw this this also right. So, I keep welding using many of these techniques. If I take a if I take if I take the so called heat temperature zone and I measure the thermal cycle schematic only not very easy right. Now, can you map these thermo cycles versus this yeah. The first one is the electron beam welding great, second is the laser, third is arc and forth. Now, you can now see that what is the role of the welding technique on sensitization of a stainless steel can you can you not ok. Now, I I want to let us say I have 0.02 weight percent carbon ok, I have 0.8 weight percent carbon 1 and 2. I have 0.02 weight percent carbon and I have 0.08 weight percent carbon. I welded this this one I did not get sensitization I welded this I got sensitization ok. I welded the first one in one of these techniques I found it is weld decay a sensitized. I use one of these techniques I welded this even then it does get sensitized can it happen? Good good answer. If so, you tell me the technique that led to no sensitization electron beam welding for it there you go right and I use this silicon welded a problem which only this is the technique that technique. So, there is no sense in science. So, so, you need to understand the sensitization in terms of that it is not in abstract terms. You translate the sensitization kinetics in terms of welding techniques then you can able to appreciate it and if I want to weld it. So, what happens essentially the cooling rate right. Suppose, I use a TIG welding I have 0.05 weight percent carbon I do not want sensitize is a 304 stainless steel 0.05 weight percent I do not want sensitize what I should do possible, but yeah of course, I mean this good answer I would say when you increase welding speed what happens now the Q goes up, but the problem is you need a minimum Q in order to not fuse otherwise it will be a improper welding right ok. So, that may not give us a good welding ok. Now, what else we can do? I can think of cooling it right if I can think of cooling the system right I think of cooling the system. So, there is cooling I mean so, that the rate of cooling becomes we need to look at it from for a point of view of that ok. There are so, many variations that you get there are people you know ok. So, this should be seen in that light so, that you can understand it better. So, it is not simply that you know you know look at in abstract sense you know you need to correlate the process parameters with respect to metallurgy and then see how you can able to control weld decay. So, that in practice we can do that you know same answer that you have been giving you know the people have found thick welding 0.03 weight percent carbon sometimes they found there is no weld decay and sometimes they formed weld decay why it is a manual welding the guy got so, tired he was not welding very fast he started slowing down the slowing down the the torch ok. Now, what happens more heated both got sensitizing problem. So, it does not guarantee you that no sensitization taking place at all ok. So, that is how you need to analyze the problems when you go to industry you know problems are complex, but what gives you the way analyze is the scientific understanding you find carbon is same no carbon why does it happen we need to understand why things are really happening the way they are happening now to find a solution to the problems. I will stop here ok and I hoped we will finish this IGC when I go on to meet in the at 530 right 530 I will finish off that actually ok. And meanwhile we have any questions you please let me know how we can you know clarify those those doubts actually ok. So, thank you very much.


Okay, so let's try this one. Osmotic pressure problem, it says a solution is prepared by dissolving 6.00 grams of an unknown non-electrolyte in enough water to make 1.00 liters of solution. The osmotic pressure of this solution is known to be 0.750 ATM at 25 degrees Celsius. What is the molecular weight of the unknown solution?  Remember that has to be given to you. So r 0.0821 liter ATM per mole Kelvin And this T, remember that's in Kelvin temperature. Okay, so let's change that right away. So this is in Celsius, so we want to do what? 273, right? So that's gonna give us 298 Kelvin. Okay, so let's look at this equation here. What do we not have? Well, we've got osmotic pressure. Right? We've got molarity. No, we don't have that. We've got r and we've got t. So let's solve for molarity. So molarity equals pi divided by RT there. Okay, so effectively now we can plug and chug. Excuse me for this part of the problem. So pi 0.750 ATM divided by 0.0821 liters ATM divided by one mole Kelvin. Multiply that by 298. We like that. So hopefully everybody got to that point. So let's now just cancel out the units that we got. So Kelvin and ATM cancel out and one divided by liters divided by moles is going to be moles per liter, which is molarity units. Okay, so Now let's just get on our calculators and solve this part of the problem. So 0.75 divided by 0.0821 Multiply that by 298 and I get a molarity of 3.07 times 10 to the negative 2 molar or let's just say moles per liter. Okay, so let's just keep it like that. It'll be easier for us. Okay, so it's asking us for the molecular weight. So let's keep that in mind. But in order to find that from these types of units with the mass involved, it's best to find the molar mass first. So what's the molar mass? So we need to look for it. So we've got units in molarity here of moles per liter. Okay And we've got the total volume here. So we should be able to figure out the number of moles of this thing as it. Okay, so the number of moles is going to equal So it's one liter. So it's just going to be 3.07 times 10 to the negative 2 moles for every one liter and well, we've got 1.00 liters of it. So the number of moles of the solute is 3.07 times 10 to the negative 2 moles like that. Okay, so is everybody fine with that? Okay, remember the molar mass is the mass per mole, right, like grams per mole. Okay, so the mass divided by the number of moles. So we have the mass and we have the number of moles. So let's figure out what the molar mass is. So 6.00 grams divided by 3.07 times 10 to the negative 2 moles And that's going to give us units in grams per mole. So to three sig figs I get 196 grams per mole. Okay, but that's the molar mass and it asks us for the molecular weight. So the molar mass is 196 grams per mole. That means the molecular weight is 196 amu. So remember to make that distinction between molar mass and molecular weight. Okay, because this is the mass of one mole of this substance. Okay, that weighs 196 grams, but one molecule weighs 196 amu. Is everybody okay with that? Yes. Questions? Question on that? Okay, I'll hang on. Yeah, sure. Okay, cool.


Thank you Mountain View Dodge for the $10 oil change. It's very appreciated for my sister's oil change.


Some of you may have noticed, I'm not David Litchfield, so I'm not David Litchfield. He's supposed to be speaking now. This is David Litchfield. Okay, I'm under cover. So I won't be offended if you all get up and run away now.  Just get up on stage, do something. Because all Brits look alike, right? Yeah, and sound alike. And we know about cricket, by the way. Allegedly.  Anyone else? What? No. No, but thank you for the money. Would you please explain the rules of cricket? Would you explain the rules of cricket was the question, so. So, yeah, if you want to run away, alternatively, if you want to get on the phone and quickly tell all your friends to come in and fill up the room, so they actually pay attention to my CFP next time, I'd be delighted. So this talk is called Aliens Cloned My Sheep. You may have already seen it as RF idiots. When I sent my CFP and I had this great idea that I was going to do some really wacky talk about cloning that it must be aliens because I'm being told it's not humanly possible to clone RFID chips. So, since I'm cloning them, obviously it's the aliens. But since my CFP kind of vaporized, I didn't get a chance to prepare it. So I've just changed the front page and the rest of it is pretty much the same talk as I've given on RFID. So if you've already seen that, again, I will not be horribly offended and have the goons track you down if you leave, so feel free. Damn, they're all leaving. Are the slides going to be on the website or is the video? The whole thing's videoed, so I guess it'll be on the website. You can come and watch it in about a year's time when they get around to posting it, I guess. The slides, yeah. I'll create a PDF and make sure it gets posted, yeah. So you're free to leave now. So I'm sorry, I haven't had time to plug in either. Okay. Right, quick introduction to who I am. Until fairly recently I worked for a company in the UK that does secure hosting. We buy up ex-military nuclear bunkers and convert them for civilian use. They're pretty cool. You get to see where the UK government spent all our tax money on hiding underground in dark holes with lots of very thick concrete walls. But, you know, very high tech. So they spent millions and millions of pounds doing these places up. And then as soon as it was ready, they closed them down and sold them to us. So, thank you, Mr. Government. As you probably know, I'm a death congoon. Yeah. And recently I've been doing stuff on Bluetooth, RFID, but I'm now a full-time freelance. So I'm still involved in the hosting company. I don't work there day-to-day. So I'm available for freelance work. I do weddings, bar mitzvahs. So normally when I'm speaking to a more corporate audience, I try and give an explanation of the kind of stuff we get up to at events like this. And I've got a little video I'm going to show you. I'm almost embarrassed to show it here because we've got, you know, people like Deviant and Mouse and so on who are expert lock pickers. This was just a little attempt that I made when staying in a hotel recently in Miami. But it has a couple of other relevant issues that I'm going to show it to you anyway. And one of them is the law. In the UK, they've just changed the Computer Misuse Act. So it used to be illegal to break into computers. What's happening now is it's illegal to develop tools that may be used to break into computers. So basically what this is doing is looking at, well, what if you applied that logic to the physical world? If we applied the exact same logic to the physical world, would that make things like paper clips and pliers illegal tools? So this is just a sort of quick illustration of that. The other thing is that I talk about not believing what manufacturers tell you. You should always check security for yourself. And just because someone says something secure doesn't mean it is. And don't discount the obvious. You know, go for the simple attacks first. In this case, this hotel in Miami was not just some old dive. It was a brand new state-of-the-art hotel. And so it had a brand new state-of-the-art hotel safe in it.  Now, one of the other things I do when I'm speaking on Bluetooth is I have a couple of other co-presenters. And they... We have a kind of competition going. Who can get the most hands raised in the audience? And you can't just say raise your hand because that's lame. You have to actually ask a question that's relevant to the subject you're about to discuss. So I've come up with one which I think is going to get me ahead in the competition. So my question is, raise your hands. How many of you have ever stayed in a hotel? Excellent. I win. How many of those have ever used the hotel safe? Wow, lots of you. How many of those believe that it's secure? None of you. So why do you use it? That's crazy.  Okay, so anyway, this little video, it won't take long. It's just showing me when I got left alone in my room and I had time to fiddle with my safe, you guys. The voiceover is taken from the website. So this is the manufacturer telling you how marvellous their product is while we have a look at their product. So here we go. Through the past three decades, we have developed the largest line of in-room hotel safes in the world, specifically designed with the particular needs of the hospitality industry in mind. Our safes are available in a wide variety of dimensions and colors, with either electronic or mechanical locking systems. Manufacturer continuously researches the development of new features, functions, options, and designs for its products. From removable core locks to a variety of electronic systems with digital keypad, credit card readers, or chip cards, manufacturer offers you products in the forefront technology. Our safes are installed in the most prestigious hotels and cruise lines throughout the world, which have recognized manufacturer for its quality, warranty, and superb technical service. Our uncompromising pledge of satisfaction to the client. Uncompromising quality. So if you ever get your mini bar and you're safe confused, you know where to come, right? So yeah, who's the criminal there? It's me, the guy that made the paper clip, or the guy that made the safe. I can't figure it out. Okay, so what we're really here to talk about, and again if some of you want to jump up and run from the room screaming, I'll understand, is RFID. And what I'm going to talk about is not the low-level technology, how RFID works, but some of the stuff I've found, we're actually using it against itself. So again, don't believe what the manufacturers say, see what we can do with it ourselves, and how we can bypass stuff using the actual devices without building extra circuits and so on. The original talk was RFID hacking without soldering irons, and that's the main point here. It's important to understand a little about how RFID works, and in this case we're looking at passive chips that get activated by the reader. So RFID is a little bit of a misnomer. It's not actually sending a radio signal. What it's doing is interfering with the signal coming from the reader. So the reader creates a field, an energy field, you put the tag into it, it charges up from that field, and then it shunts its own antenna and interferes with the antenna of the reader, and by modulating that interference it sends a message. So it's not actually sending out RF. That's relevant because it limits the range at which you can attack these things from.  That's just not possible because you can't deliver the energy. So that's the only reason I mentioned that stuff. Okay, so we've got two basic classes of RFID tags that I've been looking at.   The smart cards, the smart ones are essentially smart cards. You just remove the contact chip, put an antenna in its place, and you have a smart card that can talk RFID.  We have a system in the UK called the Oyster, which is the London Transport debit or pre-payment card system, and the new biometric passports, which we'll look at specifically as well. So the kind of things that it's getting used for, animal ID is probably one of the first. We're now seeing it in things like hotel keys as a replacement for the Magstripe, car immobilizers, everyone's familiar with that, events, things like ski passes and so on, one-off event passes. And one of the things I'm really interested in is the human implants. So actually sticking these things in humans instead of animals. Anyone here implanted, by the way? Don't laugh, that's probably several. If they knew that I was doing this talk, I'm sure the room would be full of people with implants. If anyone knows someone, or there is someone here that has an implant, particularly a very chip implant, I would really like to drag you up on stage and see what we can do with you. If there isn't, I do have the equipment with me, so. Okay, so looking at actually installing human implants, I don't know, is that too blurry to read at the back there? Yes? Okay, so in the wrong section he's saying, the big burly guy's saying, we want to implant this tag in you.  So he says, okay, we want to implant this tag in you. And it's also a cell phone, a digital camera and an MP3 player. He's going cool. Which I thought was pretty funny. I guess not if it's blurry. Okay, so here's a guy. The guy at the top is a journalist. Works for a Spanish radio station. He's reporting on a beach where they've set up a scheme where you can have a prepaid digital wallet. And all of the vendors along the beach front, so the ice cream parlours, the bars, the deck chair sellers and so on, and nightclubs and so on, will all subscribe to this system and you can have a chip implanted in your arm and you go and put money on it. And the idea is you then go to the beach and you don't have to take your wallet with you where it's going to get stolen from the beach. You can leave it safely in your hotel safe, for example. Seemed like a good idea at the time, I guess. The guy at the bottom is working for, I believe, the Mexican government. And what they're doing is they're implanting people and you need the implant to get access to certain parts of the government infrastructure, so buildings and certain restricted areas. And the reader in this picture is recognizably a very cheap reader, so that's the technology they're using. And again, I will discuss that specifically. So the whole premise of these dumb tags, which do ID only, is that they have a unique ID. So it's absolutely guaranteed to be the only one of this tag with that number, right? If you go and read the manufacturer's websites, the white papers and all the descriptions will describe great detail, how their patented algorithm cannot be cloned, cannot be cloned, impossible to clone, blah, blah, blah. So, of course, we've seen people have come out with devices that will actually clone these. So last year, Jonathan West, who gave a presentation here, he built a device that would clone a very cheap. He's since come out with do-it-yourself kit. So this kit you can download from the link there. And for about 20 bucks worth of components, you can build a device that will clone the chip. So we all know it can be done. So what happens when something like this happens? The industry, of course, always has a defense. So I like to sort of imagine what happened last year when Jonathan gave his presentation, and there was probably some kid from very cheap here who saw the presentation, went back and went, oh, my God, it's game over. They're cloning our chips. The bosses say, oh, that's not a problem, don't worry. We'll come up with something. We'll sort it out. So this is what they came up with. So we're now into semantics world. We don't have to worry that they actually open doors and they are effectively the ID because they don't look like the original. So not a problem. Second line of defense, if that isn't good enough. Some of you may remember or may have heard of, there was a talk going to be given that Cat Federal had got pulled at the last minute. There's no one from HID here, is there? No? Okay, I'm safe. So IOActive, they produced a cloning unit that would do the same thing for HID devices and mysteriously at the last minute pulled their talk and the two have been sort of pointing fingers at each other and saying, you told me not to talk. No, I didn't tell you, blah, blah, blah. So full story is there. Whether they did or didn't, I don't know. I believe they sort of kissed and made up now, but they still haven't given the full talk. But the bottom line is that a reader can't see what the device looks like, so effectively if it's spitting out the same ID, it is that tag. So when I was researching this talk, I did some, you know, searching on the internet and there are loads of these things. This is not a new problem. They've been producing devices that can clone tags for years and in fact this last one on the bottom right is a weekend sort of do-it-yourself circuit from circuit seller. Build yourself an RFID cloning kit over the weekend. But as you can see, none of them look like the original chip, so not a problem. We're all safe, nothing to see here. So I took that as a challenge. I like a challenge. Can I get away from the whole semantic argument and create a true clone that really looks like the original and has the same ID? So first to do that, we have to actually understand, you know, what makes up an RFID tag and how do you send the ID? The thing with these circuits is that they just, they don't need to understand what they're seeing. They see a signal, they record it, they play it back. If I'm going to try and program a device to be an arbitrary ID, I really have to understand what that ID looks like, you know? So the nice thing is that we're using industry standards. ISO 11784 tells us exactly what this ID looks like, how it's constructed. So the way it works is if the reader and the tag communicate with certain parameters that match, then the exchange will take place. So they use a particular frequency, 125 kilohertz, in the case of the dumb tags, 1356, typically in the case of the smart tags. They'll use a particular data bit rate, which is going to be the radio frequency divided by some factor of two, and they'll encode it in a particular way, so match, store, by phase, and then you obviously have the actual data pattern. So if we look at an example, if you were to take an animal tag and read it on a dumb reader that doesn't try and interpret the data, what you would get is eight bytes of data, and you then have to do a bit of tweaking. So you reverse it, you reverse the nibbles, you do a bit of left shifting and so on. So I put these examples into the slides just so that you can follow it right through from beginning to end. So here's an example, 8-bit raw ID, turn it back to front, reverse each nibble, and then I end up with a number which I can pull the three fields out of. So I've got the application ID 8000 that says you're an animal, country code F65, which you then right shift and converts decimal. That will then be a number which is, if it's below 900, that's an ISO standard country code, if it's above 900 then it's an icar.org manufacturer code. And you can just go to icar.org and download the table and look them up. So in this case the chip is digital angel which is now known as Verichip. And they will then program the national ID. So this is what gives you the uniqueness. You've got control of the country code and the individual country or manufacturer has to control the unique ID. So obviously if I want to create an ID I just reverse the decoding process. So I take the 64-bit ID, add a header, add some bits. What they've got here is the header is 9 zeros. So to make sure you don't accidentally get a header in the data stream they chop the data up into 4-bit chunks into one in between each chunk. So it's impossible to have 9 zeros in a row. So now we have 128 bits of raw data with all the headers and everything we need in it. How do we deliver it? So I thought about this from the manufacturer's point of view. If I was a manufacturer getting into this industry where there's a plethora of new standards coming out and all these different RFID applications what I would do is make a sort of super tag that could be programmed, set the parameters, make it behave the way that each application wants it to behave because that will make my on-going cost much, much lower. So if I can think of that then obviously manufacturers can too and indeed when I searched the market I found a couple of tags that actually matched that requirement. So there's one called the Q5. Q5 you can independently configure each of those parameters. So you can set the bit rate, you can set the modulation, it has 224 bits of data storage that I can put my ID into and you can tell it how many blocks to dump when it wakes up. So the way these things work is when it goes in the field it will just sit there constantly barfing out its ID. High tag 2 made by Philips is the same idea except they've just got three sets of parameters that they call public mode. So public mode A is a particular modulation and a particular bit rate and the data constructed in a particular way and that matches the animal tags. The second type is door entry systems and the third type is car immobilizers. So the three sort of common uses of the system. So great, we found some tags that potentially could be programmed to be another one. So then I had a bit of luck. I started writing software to look at this stuff and I discovered that my own office tag was indeed a Q5. So I now had a device that I could potentially program to be another device. So all I have to do is figure out the bit rate, the modulation and so on that I need to set. Give it the data and so on and we're off. So I'll give you a demonstration of sort of what happened next. I'm going to look at first an access control system. Is that readable? Is there any way we can do anything about the focus on these projectors? It's the projector, okay. Blame the projector. Okay, so what I'm going to try and do is this is my door entry tag and I'm going to try and reprogram this to open this door entry system. So what I've got here is an example of an entry system. So I've got some logic, a little battery. This would normally be connected to a door opener but I've put it onto an LED so you can see it lighting up and a reader. Actually, how many of you flew here? I flew here with this. So you can imagine going through security was fairly interesting. I actually carry it in my hand luggage because if I put it in my checked-on luggage I'm really concerned that they're going to find it and take one look at it and take my bag out the back and blow it to smithereens. So I carry it in my hand luggage to make sure I can actually explain what the hell it is, right? So I was going through security and there was a couple in front of me with a newborn child and they had a whole shitload of stuff with them. They had bags, they had nappies, they had milk, they had prams, they had everything. So anyway, they start pushing all this stuff through and the baby goes through and the bag and nappies goes through and everything goes through and all that's left is the husband and the milk. And the guy behind the scanning machine says, well, you can't take fluids on board. He's like, well, we've got a newborn baby, we're going on a 12-hour flight, we really need to take the milk along. So he calls over his supervisor and the supervisor says, yeah, of course they can take milk on, that's exempted, that's fine, so I'm thinking, okay, what kind of milk is that? And the husband then has to taste each bottle and prove that it's real milk, which he does. So obviously he loves his wife and he takes a sip of each bottle.  This may be completely unusual for them. Anyway, eventually the milk goes through and the husband goes through but by now, as you can imagine, the dog has built up at the scanner.  Boxes, batteries, circuit boards, wires. And now we've got the supervisor, we've got the original guy, we've got the guy who runs the screen and we've got this big crowd of agitated people who just want to get through and me standing there. And I'm thinking, you know, now everything would be cool. So I'm thinking this is going to be trouble and these three guys are just staring intently at this screen. And eventually one of them looks at the screen and he looks at me and he goes, there's no fluids in there are there? No, fine, okay, on you go. Take your little bomb thing with you. So the world we live in now, everyone's ticking the fluids box something that actually just looks like a bomb. That's fine. So I'm just going to quickly wire this up so you can see what I'm doing. Okay, so the way this works is hopefully you can see the little red light. If I use the right tag, so this is the real tag, if I do that red light comes on. Can you all see that at the back? Yes, red light off on. Okay, so if I use my own tag, nothing happens, right? This is my door entry tag for my office. So it's not going to open this door. So plan A is I try and reprogram this to open this door. So this is what's called a keyboard wedge. This is a really cheap little reader. Stick it in the USB port. You present a tag to it and it just acts as if you've typed it at the keyboard. So if I do that, that's my tag number. So I'm now going to try and write the tag with that. So this is a little off the shelf reader writer compact flash unit. Stick it in PCI adapter.  Should get bigger podiums up here. Okay, so these tags are sold under one of the brand names that's used is Unique because it's got a Unique code, right? So I've written a little program called Unique. So in theory, I've now reprogrammed this tag to have the idea of the other tag. So I'm going to go back to my door. See the light? Can you see the light? And I'm in. So if that was your door and you just walked out of the office and I walk past you with my little scanner can scan your key as I go by or potentially I could wire up a door or a couple of gates and you walk through them and I get all the tags that go through and then I have a nice little supply of tag numbers to get into buildings with. So that's door entry systems. The other demonstration I was going to do is animal implants or in particular cow implants. I live in the country, we're surrounded by cows. So I was going to bring my cow Daisy along, but she got stopped at security at Heathrow Airport. Something to do with fluids I think. So what I brought instead is my little mouse friend here. I quickly implanted him with a chip. This is a little handheld sort of veterinarian's scanner. Incidentally is anyone here got a dog or a cat that's implanted? Okay, my dog was implanted. I have a female dog, she's about four years old now and when we got her as a puppy we had her implanted and the tag was put in the back of the neck. I think that's the normal place. When I got this I thought I wonder what her tag number is. I'm going to see if it's compatible and scan it. So I scanned it and I couldn't find it. And when I got a bit more confident that I really knew what I was doing and it should actually work, I tried again and I scanned it and eventually I did find it and it was here. Okay, so it's just above her elbow. So it was put here, it's now here three years later. So if you're thinking of getting an implant, choose your location carefully. These things travel. It could get uncomfortable. Okay, so basically the way this works is you press scan. It'll go beep, hopefully. What I'm going to do is plug it into a screen so you can see what I'm seeing. So if I scan our friend, let me just make this bigger. If I scan the mouse so you'll see it gives us, or you may not see, because that's bad. So it says it's an FDXB country code 968 and that's the ID 47, etc. Okay, so what I'm going to do now is try and reprogram my tag.  And then you get it wrong and then you find you've bricked your device. I managed to do that to this card fairly quickly so not only could I not clone cards anymore but I couldn't even get into my own office building anymore. So then I discovered well actually I can just buy blanks on the web. So I bought 10 blanks and pretty soon I'd bricked all of those too so I couldn't do any more research and I was on a train on a really long journey and I really wanted to get this fixed and carry on working on it. So I kind of put my mind to it and eventually I did come up to fix them. So before I reflasher I have to reset it I actually found the master sort of reset to get it back to normal. So I wrote a little program for that. So that's now reset I can reprogram it to be the mouse. Actually well when I said at the beginning we're going to do I'm trying to emulate the same form factor so I'm going to go one step further. I've actually got one of these implanted in my wrist. So I'm going to reprogram myself the mouse. So just to show you there's nothing up my sleeves as they say. If I scan myself now so scan my wrist nothing happening. Just scan the mouse again. So I've got his ID so country code 968 that's the number 8000 because I'm going to become an animal 968 unique ID I want to write that okay so it's waiting for a blank okay so in theory I've now reprogrammed my wrist to be the mouse so if you remember this number 4708897 just clear the screen do the scan so I am now that mouse can you spot the difference my wife can't say again I'm a different form factor I'm not a true clone it's true I'm working on it okay or actually I know I'll feed him up that'll be easier okay so the other demonstration that I was going to do but it's basically the same thing and since we don't have any real humans to try it against one last call is there anyone here with a verichip implant implant okay so I wanted to clone a verichip now I believe that I can do that because they're using the exact same standard okay but they're selling it as a security device so there must be something about it that's unique and difficult to reproduce and yes there is remember I said it's a three digit country code verichip go to 4 so that's it can't be cloned because it's got 4 chips and 4 numbers and the standard says 3 and actually that's true of commercial software I've gone to commercial vendors and said can you program me a chip with a 4 digit country code and they're like why would you want to do that and actually no we can't our software won't let us do that obviously mine since I wrote it will do whatever I tell it to so if I put a code 102.2 in that's verichip's unique code and it will quite happily do that there's actually room for I think about 6 digits in that field even if they add another one it's not going to save them so as far as I can tell that is their security mechanism I have cloned chips and I have used readers to read verichip clones and it come out fine so what are the threats behind that obviously if I can read other people's implanted chips I can track them I can track them I can target them I can impersonate them to gain access or spend their money on the beach and run out of money from their wallet gain access to restricted areas and actually it works both ways so impersonating someone isn't always just to get you in somewhere it can also be used to prove that you were somewhere where you're not of course so if we were to start using these devices in things like probation proving people within the country I could start offering a service if anyone wants to contact me afterwards where I just pop into the police station for you and obviously worst case smart bombs that only go off when the right person or the right number of people or the right class of person comes along okay so how do we protect against that simple answer don't use just straightforward ideas put something else on top the biometric passport is a very good example of that we've got up to 48 items valuable data stored in there fingerprints are going to be out in the UK passports in 2010 it's already got your image your facial image potentially it's going to have the document that you use to get the ID in the first place so your birth certificate or whatever document you produce home number, phone profession and so on so very very sensitive information incidentally people ask me how do you tell if you've got a chip in your passport that the clue is this little logo here that's an international standard if your passport has that logo at the bottom then you've got a chip in it if you're from the UK there's another clue which is there's this damn great chip in it looks like that not all countries it's that visible sometimes they're hidden in the the cover some countries have like a thick plastic page and it's embedded in there so we've got some stuff in there we need to protect it, how do we protect it well they do two things one is unlike the unique ID devices they do exactly the opposite they deliberately don't give a unique ID so they don't want me to be able to say well I've seen that passport before I know that Joe Schmo is now stood in front of me so if I ask the passport for its ID and nothing else it will just give me a different number every time, pseudo random number the other thing is strong authentication so before I can read any data from the passport I have to actually log in and authenticate to it and I do that using a standard called basic access control the important thing to understand about basic access control is you don't have to do it but if you do it you have to do it according to the standard so every country will follow the exact same procedure for locking down the passport and they use a three days algorithm for that in addition to that you can encrypt the content that's called extended access control I haven't seen any passports doing it but if you do it it's up to you, there is no standard how you do it so the standard that defines the passport application says you may do this but you don't have to do it in any particular way so I don't think it's going to be particularly useful until that standard's agreed and once it's agreed it's going to be widely known and therefore presumably anyone can do it but if we look back at basic access control you see it's using three days so anyone know what kind of cipher three days is broken, well maybe it's a symmetric cipher so you have the same key on both sides so unlike public key where you have a public private key both sides have to know the key so in order to be able to read this passport I have to know what the key is we got all this super safe data in there so we're going to store our key somewhere really safe, right? Yeah, we print it on the passport so the way you derive the key for the passport is you read the MRZ which is the machine readable zone you take the passport number the expiry date and the date of birth you glue them together and that's your key that's the same for every passport in the world so I'll give you a quick demonstration of that just have to quickly edit my conflict file so again I'm using a commercial off the shelf reader runs at a slightly higher speed now normally the procedure would be you hand this to the guy at the passport control he swiped it through an MRZ and then he reads it I don't have one so I'm going to type it in but I've pre-typed it so you won't fall asleep while I do this okay so it's logged in it's read some data I'm reading the rest of it so you can see it's got the basic name, date of birth, passport number and so on it's now reading one of the biometric files so that's the image stored in the passport as you can see I was much better looking when that picture was taken actually that's my son's passport he's not allowed to travel when I'm speaking so in fact he was actually in Estonia last week nothing to do with the problems they've been having out there and I was a bit worried what am I going to do for my talk I don't have his passport so I arranged that my flight left the day he was coming in and I called him up and I said you're flying into Gatwick, I'm flying out of Gatwick I'll meet you, we'll have coffee it'll be nice, we'll have breakfast it's his birthday next week I'll give him some attention so he shows up and I meet him at the gate and he's like hi dad how are you let me see your passport a second so I've got his passport he's going nowhere so basically I've read all the data out of that I now have an exact digital copy of the data that's stored in this passport it's already been demonstrated you can just write that back to a blank there are no anti-cloning mechanisms and it will be indistinguishable from the original there's also no anti-brookforce mechanism so if I didn't know the whole of that number I could say put two question marks there instead and it'll just keep trying so you've got a challenge response challenge response, fail, fail, fail and I'm going to be in there in a minute so one of the questions I get asked is okay so you can read it but you can't change it so what's the big deal and until recently the answer was well you can change it because on the passport that the way it works is these files there's a cryptographic hash, okay so they're all signed so I read the file that has the name and address and so on I read the file that has the image I read another file that's called the security object security object has within it a certificate and a bunch of signatures and what you do is you check the signatures against the signatures on the files and then you check the signature against the certificate and if they all match then you know it's genuine can anyone spot the deliberate mistake there okay the thing I'm checking and the thing I'm checking it against have both been delivered to me by the thing now so why don't I just sign it with my own certificate and put the new certificate on on the device okay so there is actually a cure for that now which is good there is a thing called the PKD the public key directory so that you can now connect to the PKD and you can download a certificate that the one on the passport is actually the valid one that's only true of April this year these things have been out what three four years now in some countries there are 28 countries participating in this type of passport program and yet there's only 15 countries currently using the PKD I think they only ratified the design for the PKD in sort of July of last year so I'm very dubious as to you know how well this project is actually maintained but anyway before that happened I had a look at how hard it would be to create a fake certificate and do the signing so this is one I pulled off a New Zealand passport and this is my forgery so if I flip between the two you can see the only thing that's changing is the crypto modulus very easy to produce a fake that looks the same yeah so again the threats that come from this we found that the key data because there's no anti-brute forcing if you can obtain some of the key data through other channels then you can reduce the brute force to such a small space that it's actually doable I believe in Holland they've got it down to two hours so they can actually brute force an arbitrary passport in about two hours two minutes the other thing is passport profiling so even though I can't read the passport where it came from so without logging in because of the implementation differences I can say that's an American or that's an Australian or that's an English passport which again could be bad I've got to wind up really quickly so this software everything I've used today is published it's open source it's on rfidiot.org feel free to download it the hardware I use is available also from that site you probably find some supplies in the US that are going to be cheaper than buying them from me but if you want to buy them from me that will help support further research it interfaces to those manufacturers so ACG, Frosh, PCSC Devices, so OmniKey for example and there's a cool project coming along called OpenPCD which is a completely open source implementation of an RFID reader I'll take one question before I wind up where's the bar yes why do I have a chip in me okay I'm crazy but I'm not that crazy it's not really it's in my watch trap okay that's me I'm done


There's like maybe two sentences and that's it What I'm going to talk about today kind of is my my journey through the tech industry and Into where I am now which working is working predominantly exclusively as a social justice writer and speaker and It is because of my relationship with tech that I actually am where I am today So I hope you guys are interested in hearing me talk about me because that's all I'm gonna do See if I can make this quick Alright, so this is the beginning. This is me and my brother and we did not start out the way that many people in Seattle Who find themselves in tech start out? We started out really poor like not poor when your friends say like I can't afford to go to a movie Poor like we were living in a car. We had no electricity. Oh, we had nothing so we had no tech In fact, I remember when Super Nintendo came out and we wanted one really bad. My mom went and found us an old pong console And she was like, it's just as good And we invited our friends over we're like, no, we got this cool game and they were like wow you guys are so poor and Ever big jig was up So we really did not know anything about technology. I think I Was 14 so this is 94 95 when my mom got us an apple to a computer So, you know, we were always about a decade behind as far as tech goes But then I got pregnant Had a baby and I got a husband and not one of those cool husbands. I got a really bad So I needed to get a job and So I got a job and I just happened to get one in telecom Which is I think pretty normal for a lot of people who need to get a job in Seattle At least it was probably 10 years ago 13 years ago when like 18 teen singular all that good stuff is happening I started off just in regular customer service and then I started volunteering for projects like testing things like that turned I did not for it So I moved from testing to actual business and analysis project management things like that but Still my love had always been politics and this this will make sense So like social issues had always been a love of mine, so I decided I was gonna go back to college and this is at Western so if anybody went to Western. Yeah, you recognize that statue right away and I went back to school To study political science and I continued to work in text that whole time. So I supported my son and I By working in text, so I worked from home doing dev releases Red hat things like that from my house Look to the point where people that I was in conference calls with knew my son so well that one time He was asking me for a lollipop as a conference call and one of the directors in Atlanta Shout out Malcolm it is 10 o'clock in the morning. You cannot have a lollipop So I was going to transition out kind of use my skills to transition into areas I was passionate about and I had actually Received an offer from the Gates Foundation To work there kind of combining my tech skills with my social justice love but then I got pregnant again and so I Was not going to be able to move to Washington DC To begin work at Gates Foundation, which is where this particular program was Done, so I just focused on finishing school And I don't know if you can tell that I'm pregnant in that robot is like, oh my god, everyone looks pregnant But I my son graduated from kindergarten the day before I got my bachelors So he was pretty excited and he wore his hat and made everyone tell him congratulations So I went back into tech and started working and kind of fell into the tech world First I start working actually is a T1 provisioner and a switch switch technician So actually, you know going in pulling wires Writing out circuits things like that. It was an interesting environment for me having spent the last couple years immersed in The world of academia political science To come back in to tech especially landline tech, which is like this I don't know if anybody here has worked on that It's a really strange world because it's like a mix of like half Navy guys because that's really where you learn a lot of things like switch Switch tech stuff and things like that and then just you know, well like the rest of the tech industry kind of Mashed together and I did not Fit in that industry, but I was very good at it That promoted like three times within two years Was working, you know really hard doing well, but I was constantly Confronted with sexism in the industry lots of racism in the industry I remember being asked during in an orientation for a promotion. I had gotten if this was my real hair I've been asked that so many times Is it a weave because I saw that good hair movie and I know what black girls have to go through with your hair I've been kissed on the elevator by people. I don't know It's a it's been really weird environment And it was kind of one of those things that you just played along and I actually was I was really happy I had friends, but I noticed that who I was what I started talking about who I was talking to changed, you know My subject matters Revolved around tech things all the time, you know, my friends we talked about work when they were hanging out and Getting drunk and stuff like that And I was doing okay There's me at a conference, you know talking about digital marketing and advertising But then Trayvon Martin happened and It's really hard. I still struggle to put into words what that meant what that breaking point was for me But I was traveling. I was working as a trainer in digital marketing a travel the country Basically explaining the internet to old white guys. That was my job I was on the road when this happened and my brother was on the road as a musician and my son is now 13 and I saw so much of my son in this boy and I saw so much of my brother As well and I was absolutely heartbroken But what I noticed Turning to the avenues that I was so used to relying on the internet Was the absolute silence that I encountered from my community Nothing, I mean and it got to the point where I was begging especially to because I was on the road So I'm trying to find connection home And I would say somebody say something and the response I would get back was I Don't really feel like this is my place. I don't really feel comfortable What if someone yells at me if I say something and it was utterly heartbroken I've grown up in Seattle Seattle's been my home And it was the first time I ever Really felt like there was a concrete wall between me and the rest of the community that I lived in So kind of out of desperation of survival. I just started writing I started writing about what I was feeling because I needed somebody to talk to about it and it ended up Kind of changing my social life. These are right, you know some groups of people I met who just started listening to what I was saying I ended up Kind of shifting to a whole another social circle but as I was writing more and Speaking more at conferences talking about police brutality talking about race talking about feminism really just to kind of Keep alive after seeing that disparity between you know the place I spent most of my day and the rest of my identity It became really harder to be quiet. I was already known as a loudmouth and I remember people saying You know, okay, you know Joma's great at presentations and they would bring me out to like impress big clients But if it was a question about we need someone's opinion They were like let's not include Joma in this meeting because she does have opinions She has a lot of opinions and you'll know what they are to the point where actually I you know The last promotion I got in my job before I left the industry someone called me and she said you're so good at this You know you're great at your job and she's like, you know, and I was worried because When you applied someone called me and said that you have a very strong personality. I Don't see that necessarily as a negative and I certainly don't think it's something that Had I not been a woman, especially a black woman in the industry would have ever been used as a detractor To describe someone Especially in tech. So then all of a sudden I started like showing up on television, which was weird It was really weird to the point where I mean because I had I still literally was working in digital advertising and then I was getting emails from from CNN and from CB CBS Evening News saying you want to fly to New York and talk about race in America And so I would because I didn't want to ruffle feathers at work. I wouldn't even tell them I left. I Could fly to New York And like work like I was there and just like start a couple hours later be like, yeah, no, it's fine Hey, you know, I've just got a meeting for an hour and I would like run Sit and make up get on TV because I knew that none of them ever watched There's much no chance and in the whole time only one person ever and it was a vendor came in and was like No Totally someone else Like what But as I was doing this more and more It was it started to kind of bleed into my life And so I started things like people on Facebook going look I found a quote of you on Twitter on Tumblr and it was like this weird Inception world where things I tweeted about when it up in Tumblr and then my friends on Facebook would find it on their Tumblr and put it on my Facebook and then my friends were like, what are you so mad about a gentleman? I'm like, well, this is what I'm talking about all the time So eventually I couldn't do it anymore, and it was a weird break where I just had a day where I said you know, I think today might be the day I quit my job and I was writing a lot but I had started to make decisions where I had to turn down writing and speaking assignments because you know, like my boss was not gonna like he was gonna notice eventually that I was like flying out of town or Showing up on the radio in the middle of the day, which I totally did like ready. I would go out to my car for like 15 minutes And do a radio call and I'm trying to muffle the noise of traffic So it doesn't sound like I'm in my car and talk about race and social justice and then I would run in and my boss would say something like Joma, Joma, Joma. Okay. Okay. See there's this commercial of this like Really ugly dude, and I just need you to make fun of him and make an ad for it And I'd be like this is the worst job I've ever had in my life and So one day I just I did I just quit my boss sent me another condescending Sexist email on my reply was yeah, I'll get that done for you also like quit and he was like are you kidding me? I said no, I'm done I quit and And it was really strange because I said goodbye to tech but in the same time Completely immersed myself in the internet because that's really where you live today If you work in social justice and if you are a writer So I thought I was like leaving the tech world and instead it was like all I do is technology In fact, I've completely forgotten how to have face-to-face conversations with people. I don't do that anymore It's really weird sometimes because I'll read something I wrote like this is what it sounds like When words come out of people's So I'm still active on Twitter And It's worked pretty well, and then I also got an opportunity to really Take what I had learned from working in tech working on the internet And really start to do some good with it primarily with I believe you it's not your fault this is a Website that we're currently redoing but it started out in Tumblr, and it is a anonymous website for people who have survived physical sexual abuse problems with Disability acceptance fat acceptance and want to talk about it, and so that's the premise of I believe you It's not your fault because that's often what people want to hear and the beauty of the internet is For all of the vile hatred that you can find out there There's also community that you can build out of anywhere So we get letters like this probably a dozen a day right now from young people especially saying, you know, this was my fault what happened to me was my fault and To be able to say no, it wasn't and have other people respond to go. You know what that happened to me, too You're not alone People also get to write their own story, and if they just want their story published It can go out there to reach out to other people and people can get to read it So what was interesting was, you know, I still get calls from my old friends in tech Saying what's it like to leave the industry, you know, I bet you're so glad to be done with it But I wouldn't be where I was without it because I did not understand I was very insulated from how important it was until I was in an environment that was So adverse to addressing Social issues especially issues that affect the brown communities the queer communities The disabled communities It wasn't until then that I realized how incredibly important it was So not just be a good person but to have a voice And to get out there and try and change your environment And I use those tools From that place that was so inhospitable and so hard to live in to Make a difference So I kind of want to talk about this because you know, I'm 34. I'm not a baby And this is something that is fairly recent to me And it's something that's not incredibly hard to do And everyone in this room has an opportunity to look at their environment And see where those gaps are see those things that nag in the back of your brain And make that environment a better place For everyone there and we all have privilege that we can leverage To help those and help dismantle that hierarchy In this very structured environment that we all work in So I think I have just a couple more minutes if anyone has questions, but I don't know what possible Yes No, you know the one thing for me luckily Oh, yeah, so he asked how I deal with jerks on twitter And I have a ton of them and it's actually kind of a weird thing like a specialty of mine is dealing with online trolls I kind of have fun with it at this point. They do because they can really drag you down The internet works very hard to silence marginalized communities For me primarily it I always keep in mind the irony That this person is so invested in what I have to say So why wired up about it that they're trying to come up with ways to make me feel a thing I don't know who they are and when they go away. I still won't know who they are So when you think of it that way, who's trolling who I'm the one like in their brain Right now that's got them so in sense that they're like, I'm gonna look at her family history I'm gonna find I mean people have made profiles of my dead grandfather Um That's a lot of time that's been thinking about me Like a lot and it makes it reminds me that what I'm doing is important and That these aren't the types of barriers. It is so important that people are fat threatened to take that action So I kind of have fun with it a lot of times. I kind of be absurd with it But do whatever you need to do also don't ever let anyone tell you How to handle harassment on the internet. I see a lot of that I see a lot of people trying to white knight they come in and go ignore the trolls Don't talk to the trolls don't do this, especially if you're around the internet It seems like everyone rushes in to be like, hey, do you need do you need help? Do you got this?  So if you guys want to come up to me later, I'll be here. Thank you for your time