Okay, all of you guys, I'm sure or have a mobile telephone. So this will all be highly relevant We are proud to present castan and Luca Who are talking about the much overlooked defensive side of mobile phones? Take it away guys random applause please for castan and Luca Good evening Honored to be here for the third year on the same topic. I promise it will be the last one But it will be a conclusive one Pleasure to be here with the fabulous Luca Millette who will conduct the technical demos during this talk the last Yes, we Discussed attacks on the much outdated but still very widely used GSM network Supposedly three billion people using this technology right now Today we want to turn to the defenses and Conclude what networks should do or should already have done to protect you and your privacy Much better than they have in the past. Remember. This is a 20 year old technology So a lot of it is broken. However, the people designing this have worked on fixes and now it's time to roll them out so we will focus on how to defend GSM communication from both the network as well as from the phone But we do have one more attack to add there won't be Congress talk without one This new attack slight deviation on on what we presented in the past you may recall that Cracking GSM keys the a5 one keys is pretty trivial these days with Computing power available to gamers and in GPU cards We did use this Capacity in the past to show interception of phone calls as well as SMS But that's not all you can do with it To introduce the new attack, let me show you a related case of in this case fraudulent activity This is some of these Voip bill Note that they seem to have called quite a bit to very strange place This I believe is some some little country in the Caribbean If you look up the details of this this phone bill all these charges are cured within some four hours So over thousand times a call to the same number in the same remote location Clearly this was not in the intent of whoever owns this phone line, but Conducted such that the person doing it get some revenue. So this is a premium number. They call it similar things observed as mobile viruses Premium numbers have equivalent in the SMS well premium SMS Where it will be charged say for two euros on your phone bill and whoever owns the numbers gets one euro out of it the rest of trickles down in the in the in all these different operators that connect the call So there's viruses for instance on Android phones that do send SMS on your behalf to make somebody rich But you don't have to to actually get the virus installed on the phone to do something similar And with that, let me try to do some Connection magic here. There's only one VGA connection this year So hopefully this will now connect the other computer the internet connection isn't working Why don't you just take the key from the phone then I Mean you all believe us that we can crack keys by now, right third year So we'll just extract the key from the phone from the SIM card So this this is all using the Osmo-com software You all have come to probably laugh or hate if you're a mobile network operator A completely programmable mobile phone That was used to intercept data so we could listen to the voice calls and SMS and in this case it again Captures a transaction but not was the goal of actually looking very deeply into the transaction Does this work so each each GSM transaction is authenticated to the network By the equivalent of a username it's called the Tim see temporary identity. It's kind of temporary username And a secret key which acts to decrypt and encrypt all the communications It's equivalent to a password and knowing both this username and the password Of course you could Do fun stuff that we'll get to in a minute, but first we need to crack those of course This is work or should we just skip this demo. Oh, yeah I have a victim victim mobile here and To to get the key and to get the team CD ID of this mobile.  Yeah, it'd be great. So now now we are Just analyzing all the traffic in our cell but filtering the traffic just to capture The traffic for this specific mobile phone And now this is kind of an not not to go to jail filter So of course we could from all these other phones also, but we choose not to so the red stuff you see is the the call Going on and unfortunately I think I think the internet is not working. So I have Sorry increase the font size in the only on your terminal. Ah the phone. Sorry So I have here the key Yeah, the key Is It okay So I have a modified version of Osmocom mobile normal application. This is the configuration file and Here there is some settings for the current cell Current a team C and this is the current key. I have here Yes So what I'm going to do note that it didn't change from where we tried to experiment before so This has been the same key for this phone for a while now I'm going to start a Yeah, yeah, yeah, sure I'm going to do it Okay, so the firmware is Okay, and now holding this number, right? This is the mobile. I'm impersonating. So this is this is the phone That was called before and we can just put it aside. So nobody's doing anything with this phone anymore So now I'm going to start a fake Mobile I Unlarge the font here Okay, so this fake mobile Is on service is without any authentication anything. So Everything is here The key the cell and the identity of the other mobile and now I'm going to call My number Decrease the font size I hope this is Working So I start here The call is going on and this is a call from that mobile So yeah, we just impersonated this mobile phone Do you want to send an SMS? Yeah as well. Yeah for completeness This is clean. Well, you can see them if you can hear the sound and if you look here, there is the SMS I sent Sorry, my number is this one We'll come back to that as a computer later What oh So if if any criminals or business case in initiating a thousand calls on one line That same criminal should have an incentive of inters impersonating a thousand cell phones and doing one call each Why stop at a thousand right this extends to whole populations of phones in cities from an elevated position you can Intercept data from some 35 kilometers away So imagine how many phones are currently active in in that range and how much fraud could be conducted So this finally hopefully is an attacker scenario where everybody feels affected Where the the whole intercept a lot of people tell me they never say anything interesting on the phone So intercept doesn't affect them now finally this should so What what did just happen the the real phone? Made a transaction in which of course the Timsy was was was broadcasted and The KC the the secret key was used to protect it all The 10 euro Osmo com phone recorded that data the computer Had we had an internet connection would have broken that key was in a few seconds Revealing that that Timsy included in the transaction and those two Enough to impersonate a phone call to make calls and there's a mess on some much we have but also to circumvent authentication methods voicemail often Authenticates based on on the network level caller ID. So had the news of the world's newspaper Lift to see this they would probably have liked us as a as a new way of Accessing people's voicemail even where the pin numbers are not weakly set All right, this should serve as enough motivation Well, let me let me jump back for a second to ask for more more net protection on the network and Protecting from from this attack is possible in in two ways Completely independent way. So one is sufficient to to prevent it Either you take away people's ability to crack your key That's how a security system should be designed it uses encryption. So kids should not be able to decrypt Things on their gaming machines at home. Now. We're a couple of years Away from from seeing a deployment of a much better encryption cypher. So we need some intermediate Improvement levers to to protect people today and I will talk about a way to To to improve the the encryption quality without changing the cypher a few slides from here But there's a second completely complimentary way of protecting people and That is by requiring a different passport so to speak for each call In fact, the people I talked to that designed GSM the few that are still around in the community They designed it such that you would need a different key a different authentication token in each transactions Now the networks grew faster than the authentication servers And so that changed it to every second every third every fourth in some networks We only see an authentication in one of ten calls in some networks We don't see any authentication ever for calls, but really only when you switch on your phone or change your location to Different location area So the second measure is really trivial Bump up your your authentication system And such that every call can have its own authentication run And in fact, that was one of the five ideas We put on our wish list a year from a year ago from today Where we said it's it's really crucial for networks to change Their key on every transaction as a security measure and we promised a year ago To check on operators this year whether they have actually done this and also done the other four So that's what we're gonna look into next A little bit of background though So you can appreciate why why these different measures are needed and how how effective they could be even short of Changing the encryption function to something much better GSM cracking equipment and I'll tell a little bit of a war story in a minute about some some actual equipment that I got to see GSM cracking equipment Does rely not just on one factor on one weakness this week encryption function, but on two They work in the following way first They intercept a message just as as we did with this phone and then predict what that message was Since this is a stream cipher what comes out of the stream cipher is x odd with a data packet What the crypt analysis works on though is just the key stream So you need to reverse the x or by predicting what the message was and then given a clear Plain tech a clear key stream that then can be used in the crypt analysis Crypt analysis won't be made any harder until we change the encryption function However being able to predict what the message was that can be made much harder In fact to network security people the the notion of being able to predict what's inside An encrypted packet seems ridiculous. Why would you even send a packet? That's fully predictable, right? The other side already knows what what's in it But GSM works a little different You have certain time slots in which you have to send information And if you have nothing to say then you send in a packet that says I have nothing to say Right or at least I acknowledge the receipt of your last message, but I don't have anything to say Please send me your next message so it goes back and forth and there's a lot of Unused space in GSM at least as far as the control messages go So in a little bit more detail, what would it take to to do away with this predictability the one the one factor that These these crypto boxes or decrypto boxes rely on There's there's two types of messages I'll we'll look at an actual trace on the next slide two types of messages that are predictable Some messages are just very short and they are filled with With a filling bytes it's predictable filling by then if the message the short message could be I have nothing to say is very short Then the whole packet becomes predictable. There's other messages that are That carry more entropy. However, they're sent encrypted and unencrypted Now of course that makes it very predictable Even though it may change for for every cell or even every call now This reliance seems to much easier to mitigate in fact this can be mitigated with just software updates that Luckily are available now a year a year ago that that looked a little different. It wasn't clear who could supply this software update quickly Now just for completeness a third Vulnerability of of GSM and in particular a 51 that's often quoted in particular in in research papers is Is the fact that it's a bad crypto function? However, though this seems to be not exploited by anybody got some people some nice publications But it seems that no one actually exploit the badness of a 51 beyond its short key size of 64 bits That should get people thinking when moving to a 53 Which also has a 64-bit key? So we're not actually moving to an as great Encryption function, but a block cipher instead of a stream cipher that still only encrypts to 64 bits Just as a side remark So it it doesn't it doesn't get better more than two orders of magnitude and given was most law of course The crackers will catch up that too So it seems that even when moving to a better encryption function fixing this problem is worthwhile Here's an actual GSM trace all the messages sent to the phone from the base station at the beginning of a transaction and You can see basically three different groups of messages there are The ones that are very short and then filled mostly with this to to be by it So this one this one this one and this false one there. They basically just say I acknowledge your message Please send the next one There are other messages that are still filled with with this padding bite because they're not full lengths But they carry entropy so they are not really predictable. They differ per call These two in this case and then our messages that are full These are control messages where the cell broadcasts its neighbors for instance But those are also sent in the clear So there's no point of encrypting them at all and if you do you give a tech surface to to Whoever wants to do the decryption Now those predictable messages the first and the third category Will go away as soon as operators implement two two different Software-level Mitigations the one was standardized a couple of years ago and is now available widely the other one was just standardized Based based on the critique on on GSM this past year, so it's still in the making at the operators So operators ask me a lot how effective these these measures could be in in defeating phone attacks and They're equally worried about hackers using These phones and their home computers as well as professional spy equipment. So at least some operators have a real draw towards Protecting their customers from spy equipment. There's a large market for GSM spy equipment It used to be the domain of law enforcement intelligence, but as prices go down and Sales managers get greedy of course this trickles down to other sales channels where I would imagine criminals now can easily get the hands-on on spy equipment So I did go to this to this spy conference the ISS to to see what what they have on offer and whether this measure would actually defeat them and To our all slug nobody in a professional spying on GSM world seems to be aware of this development and So meaning that at least the entire installed base of GSM spying equipment could be driven out of business Was just implementing these two ideas and then for a few years It would hopefully stay that way of course eventually that would find a way around it But that's exactly the time frame we need to deploy a 5 3 and to make phones well protected on on at least a block cipher Level So the way this will be rolled out is in stages as I said The measures that were deployed that were developed in 2008 are now available from all the major Equipment manufacturers being mostly Nokia Siemens and Ericsson in Europe so you can get software patches from them and upgrade your existing infrastructure to Randomize they call it the padding This will make GSM spy equipment work much less effectively There's still a tech surface Namely These very messages these control messages where there's no red to be to be randomized but the the success rate of Of these of this equipment will go down significantly Even more so when these additional messages are also randomized And that's up to really Nokia and and Ericsson now to develop test and deploy these patches to their customers Finally to fully Make this equipment stop the phone manufacturers not necessarily of this phone, but of more of more modern phones They also need to randomize the data that's sent in the other direction from the phone to the base station It's harder to intercept, but in some cases still interceptable Interestingly enough when we all know how quickly Phones evolve we've only observed a single phone that implements this improvement measure from 2008 so Soon enough once the network deployed the software patches it will the phone will become the weakest link in this security chain But then again it only takes a few years for all the phones to be replaced with with something new so there's hope that Not long from now GSM spy equipment will stop working we Wanted to to know how far down the the the road of improving GSM network operators already are today Basically checking our wish list from last year, which ever since has grown to some 21 items 21 security parameters that we think networks should set in certain ways to protect from attacks It turns out that That networks very greatly in security Configuration in fact it seems that that for most networks a few exceptions Parameters that are security relevant are more or less set randomly One being of course the the number of authenticated calls we talked about before which should be hundred percent But then as your as your network population and the number of calls they're making increases This number is often set set down to postpone network upgrades also this as an effect on call setup time which Network operators consider their their core quality indicator and do you care if it takes half a second longer to dial a number? I certainly don't But they they seem to think that's the most important thing their customers want from the network that half a second time safe There are networks, however that don't authenticate any call apparently and that just seems misconfiguration to me At least as long as your VLR HLR that's these these backend systems have capacity this should be Checked now, it's it looks even worse when when looking at the software updates So authentication existed when GSM was first deployed 20 years ago The newer software updates though the ones that now Nokia and Ericsson have on offer are only implemented in very few places and and even Blocking HLR queries you may remember To be as Engels talk from years ago where he criticized you could track users over the internet even Long-running vulnerabilities like that are only mitigate in the fewest of places so there's certainly a Lot of Claim by operators we implement to use technology, but at the same time the 2g network that's still exposing people to vulnerabilities It's kind of a left rotting at the 20 year old level We want to change that we want Each and every one of you plus whoever else is interested in GSM security to keep checking on your operator And to verify that your operator actually deploys security patches that are much needed We did collect for this survey data in in countries mostly surrounding Germany and Let me let me skip over this for a second and put them on an online map That map is far from complete actually try to to access that So here's a map GSM map org Publicly accessible this map is far from complete. So we want everybody's help in filling all the remaining spots on this map and to to make Network security comparable among different countries Make operators within one country and let me just click on Germany here You see how how widely operators differ We want customers to be able to compare different network security and create demand with their feet by Going to where the most security network is for them So this is an online tool for you to use and please to contribute data to all it takes to contribute data from your location is One of these phones and The software you can download under this link And then everything else is automatic takes a couple of minutes after you uploaded the traces But then whatever country you upload data from I'm most interested in these countries down here They spy so much on their citizens. I'm I'm interested in whether they actually protect them from from other countries spying on them Or not so if anybody is down here with one of these phones, please contribute data So That the security for each of these networks is ranked in three Categories so I was the buttons up here and let me was that actually go back to the to the presentation here These three categories and code protection against three different attacks basically the sum of the attacks presented here by different people Today's impersonation attack. How difficult is it to put? To put fraudulent charges on somebody's account to access their voicemail and so forth second attack intercept how difficult is it to to Listening on some of these phone calls or read their SMS and lastly tracking people both globally Through internet leaked information. Where is somebody as in what city as well as locally? tying together Transactions you observe based on the Tim C's So each of these has a number of parameters behind them And we do expect and this is the reference for for this year We do expect the best network the hundred percent network the one I would get a full green circle to Plement all the ideas we see out there. So we're not asking for anything impossible. We see networks that do it already and We would like a network that does all these good ideas at the same time some networks get close But nobody actually matches that so currently each network is vulnerable to these three threats to different degrees We will update the reference every year to keep chasing them and and keep Keep them in a security race that of course an operator will have to run as fast as the hackers do and To my knowledge next year operators will start deploying a 53 So by the end of next year you will have to have a 53 as an operator to again be close to a hundred percent So all the software is online to contribute to this Tutorial as well, so we hope to get to to to to keep To keep the networks busy in improving some already have we were surprised to see that by January this year One of the German networks that had already implemented half of our wish list from December So it must not take long if if a network really wants to improve Switching to to to the to the last of three acts here We so far discussed protections that come from the networks and A little bit from the phone Basically, whoever supplies us with equipment and service should take care of our security This still leaves some attack vectors one one network level. That's most concerning to me since At least from going to this ISS conference. I understand that that this seems to be the bestseller in the spy world and that is Fake base stations or imsi catcher attacks in which somebody Emulates your local network your voter phone or telecom network and then sets whatever security they want on this And of course, whatever your real network does good or bad at that point doesn't matter anymore so we also Want to create some traction towards defeating this threat and while we cannot completely Mitigated it's just in the design of GSM authentication is missing. We can make it much less likely to occur And with that, let me let me pass back to to Luca To explain how such an such equipment is working and how we could defeat it Yeah, probably, you know the concept of imsi catcher is basically a fake BTS and They are used for different purposes The basic one for example took to collect the identity of users in a certain area At the point one. So you just install a fake BTS with a high high power and all the mobiles See this BTS and they just try to do the location update the BTS the BTS Collects the identity and then rejects the location. So the mobile doesn't care about this. So you can easily collect IDs another way of using an imsi catcher is To of course make the mobile connect to the BTS and then ask the mobile to start a call That is actually not a call So you make the mobile enter a traffic channel and then the mobile waits for the connection establishment, but this connection establishment doesn't arrive and If you are in the nearby you can track the signal since the mobile may be sending at the maximum power So you can actually locate the the the mobile Or even more you can do is an active attack like a man in the middle you can use a fake BTS that allows the mobile to connect and to root the traffic like calls or SMS and Basically, they don't use encryption. So you have some mean to recognize it But normal phones doesn't doesn't care if you are transmitting without encryption and We are Going to analyze all the kind of treats we have in Imsi catchers and for example You can see the evidence the first the first type of Imsi catcher Sends location Rejects so we are going to see if the BTS is sending that Or for example, we monitor the power the transmission power Or for example We see if the siphoning is used Before after and so there are some means to to recognize it, but maybe we are not using all the the features we can and we we started that project and It's still a at the beginning and basic Osmo comes after with some patches to to recognize all these things I said and we can We can start the the demo and yeah, the name is catcher catcher, of course And can we switch here sure yeah So to rephrase that we want to enable Everybody with such a phone to collect evidence that there is Imsi catchers operating in their area Which you saw on the slide networks could have done a long time ago by collecting the evidence visible on their side However, none of them has done so My suspicion is that they just fear to interfere with law enforcement activity Of course Imsi catchers are used by law enforcement But not just by law enforcement and even when it seems that lawful intercept should should be executed on different ways Then then over the air through fake BTS with lots of casualties So while the networks don't do it We want to detect Imsi catchers and other privacy intruding attacks Can you increase the font size? Sorry font size up You don't need no not this one not this one okay, so while What why we didn't bring an Imsi catcher, of course That that would be difficult to operate with with so many people around We want to demo briefly the detection of another type of attack. Yeah, that is not in the slides It's the silent SMS used by low enforcement agencies to To make the mobile answer this SMS and to locate the mobile and a little bit of context on that and in Germany news broke some some two three weeks ago that a Single law enforcement agency here that sent a hundred fifty thousand silent SMS's was in a year To track people's location and the way this works is they have access to Transaction metadata that they're not allowed to look into transactions themselves, but sending a silent SMS to a phone Creates a line in that meta data database from which they can then deduce the location So this happened from a single agent the hundred fifty thousand times in one year So you can extrapolate how how often this really occurs in the real world And go ahead Yeah, what you need is actually the same mobile You know and a SIM card from one of the operators you want to monitor. So this is the software that Used to be a normal mobile software. So this connects to the With the BTS and Now the mobile is Connected I Want to show you from the talent part of the Osmo come what happens? So once the mobile is turned on it looks for the the cell and then is he it establishes a link channel and I'm Monitoring the time I wait Until I get some important data like The service I want then I monitor the algorithm that this is the normal one But it could be no cyphering for example, and I'm also monitor the IME ISV that is important for It's important for cracking actually, but yeah It's also some identity you you are Exposing to the to the network So this is just a transaction what I want to show you is This extra menu I created is really on progress so You have here a summary of what the mobile did so this is some something I transmitted something that BTS asked of me and For example, this is the power Measurement that says if the BTS asked me to transmit at maximum power or too much high power and in this case it's not it's normal BTS and Yeah, this is the log of previous and last algorithm Some this is not correct, but it's current MCC MNC and This is all normal stuff and you can see at the end. There is a flag that is indicating whether the BTS is Trusted not so trusted or you have to to turn off the mobile because you're you have been tracked So I'm going to to show you what happens if I send a silent SMS as Kastin was saying before They are not shown but normal phones Yeah, they're processed in the phone and even responded to but never shown to the user So nobody really understands why this feature exists on phones, but law enforcement likes it a lot Yeah, so this is the notification. This is my hidden number and And this is the same Log and you can see the flag now is yellow because it's not so good to receive a silent SMS and Then yeah, it's still on progress. So I hope somebody can contribute because we couldn't try it with a Commercial MCC catcher. We have just some equipment, but not a commercial one Yeah, so we implemented all the puzzle pieces to detect MCC catchers However, nobody wants to loan us one Saxon or buying yeah We did implement a long list of measures actually and now ask you as the community to continue this project or help us continue So these are all the all the pieces of evidence currently implemented in the software And this being just a derivative of Osmo-com, of course, everybody can continue this research Both through helping us understand how actual MCC catchers work We have good suspicions or also talk to people that have built them in the past. However, what we're lacking is actual testing so we envision people that that suspect they're being in a In an MCC catcher location or being tracked through silent SMS to protect sim card in Osmo-com phone and let this run for a couple of Hours collect evidence and then know whether they're being attacked or not Eventually, maybe we can even start the network of such phones that automatically report in the catch activity I would suspect them for instance close to major embassies in any capital Where you know they just harvest information from wherever they can and if you think about where the Bundestag is in Germany And what embassies are rounded they could easily attract all the phone phones from from our parliament, right? I'd like to create transparency around that whether that actually happens now that the network operators haven't done so and was that We we come to the end of this hopefully last iteration of of Criticizing GSM networks for being too insecure is from now on you can take up that task and Start creating demand You now have an attack scenario that really everybody should be should sympathize with that Of course, they don't want to look through their phone bill every month for premium SMS charges and so forth You have an online tool to compare different networks and to criticize the weak ones Still criticizing the secure ones. Nobody implements all the the good ideas If a way of filling this online tool was one of these phones to create More transparency in in reach all the corners of the world that we don't get to go to as well as Over time networks that do improve insecurity of course should Should be signaled as such through that tool and finally you have a software running on the Osmo comm to Self-defend yourself from attacks your your network is not really responsible for so with all of this Hopefully we can start an evolution in GSM security and make this 20-year-old technology Finally become secure. We have a historical chance of driving all this spy equipment out of business At least for a couple of years, so we get really good encryption. So please help us with this and thank you very much We have I think we've got about 10 15 minutes here for questions and apparently we have a lot of questions from the internet If you have a question to ask can you please line up between using the microphones in the aisles here and What I'll do is we'll start with some questions from the internet And then we'll move to questions from the room. Okay So there were quite a handful of questions on the IRC First of all, can you spoof phones on? What kind of spoof any cell phone or just cell phones if this booth phone was logged in a short time ago You can I can you guys keep it down, please because we are having a question and answer session here Please be polite and just be quiet Okay, again, I'm sorry Can you spoof and a cell phone or can you on the spoof phones which were locked in the short time ago? Well, yeah, you need to to be in the same location area That means some kilometer I mean, I was in Berlin some in meter and it was the same cell same cell location area. So Same city we say late same city you can spoof another user Spoofing spoofing works as long as the phone is where it was when you attacked it as in location area So location areas are really big cities usually have only a couple of them It still needs to be in the same location area and it must not have changed this key If somebody it does a lot of transaction and you only Correct an early one it may well be that it already moved on to another key, but other than that Most phones are affected Let me sort a bit sorry Where's the bottleneck in the provider companies that prevents the improvement in security is the made of the management Or it's also the technical department. Sorry, sorry Well Each of each of these countermeasures has has a different bottleneck Sometimes it seems just testing time to deploy a Nokia patch. Sometimes it's actually buying a new HLR VLR system Maybe for half a million that then Rams up the capacity of your authentication system to where you need it and then was an a 53 deployment the new The the new encryption function oftentimes a complete new GSM network is needed Swisscom The Swiss operator this week announced that they are actually Creating a whole new GSM network. So it does happen oftentimes to get the network ready for LTE So within this wave will see a lot of a 53 deployment But not in networks that just stick with with the old paid-down equipment Okay. Hi. Hi Jake. Great talk. That was really great. I know some places where there's some MC catchers If you'd like to come over to my house or to the bail mansion One way that you can catch MC catchers I've heard is that it's possible to When say US law enforcement comes to Europe to surveil people They forget to switch the country code and the mobile network operator So your phone asks if you want to roam And they've turned off all the other cell phone towers So you'll join their MC catcher and so if the phone is trying to roam it actually in places where it's not That's another vector for detecting it. Yeah Our our threshold was a little higher detecting MC catcher with stupid operators It's possible without much technology, but we want to go as far as detecting MC catchers That do encrypt so there are MC catchers that do real-time cracking of keys And then initiate transaction in both directions with encryption and they're pretty hard to catch But there's still a few things that they have to do to operate correctly that a normal network would not do And the list is online One one interesting thing here is that I've noticed that the MC catcher at my house Just the one One of them only seems to activate itself for my particular IMEI and So it's a little I mean come on. It's like not even hard to figure out who's doing that But an interesting problem here is that in detecting them. There's selective targeting of targets So is it possible for the Osmo-com phone to Pretend to be my Android's IMEI I'm asking that in the most legally ambiguous way possible sure that that's possible I don't think it's it's possible for the for the MC catcher to be perfectly selective So it has to get in touch with all the other phones to reject them first and this reject Of course is observable and very atypical for GSM And another vector is if you call 911 a lot of these will actually kick you off of the MC catcher and Allow you to associate with the tower nearby so that the 911 call won't go through the MC catcher So there'll be no trail that leads to law enforcement in looking at other law enforcement agencies that that's missing on the list Yeah, so don't forget when when in doubt call 911. Thank you Okay, you're next Hey, you mentioned that some phones support these handheld encryption improvements Would you like to tell us which? manufacturers are doing that and if there's anything that we as consumers can do to encourage more manufacturers to do that sure yeah so modern phones Pretty much all support a 53 cipher that only started some two years ago though So a lot of deployed phones don't understand a 53 There's one phone however that claims to be supporting a 53 and if you try to initiate a transaction with it it can't because it Was never implemented like some if else was was switched around now this phone This very one phone is responsible for at least two operators to hold back the a 53 trials because those Users of this phone would stop having servers. So there's a little bit of confusion The the manufacturer of that phone supposedly now pays for the patches so that Nokia and Ericsson can detect this phone and know It doesn't understand that it takes a few more months The second security improvement that phones desperately need even before a 53 deployment Is the the uplink randomization and the only phone where we have ever observed this is the latest blackberry bold 9900 I think the number is Every other phone even though this is a three-year-old idea does not implement that Now I would be surprised to find that the blackberry bold has a chipset that no other phone uses So at least Qualcomm or one of these chip manufacturers must have implemented it all the other phone companies just forgot to switch it on So US customers can demand that as a feature Not saying you should buy blackberry, but at least tell Apple that you also want that Okay, we have time for one more question from the internet, but this gentleman here first if you spoofed a Wicked James mobile phone is it also possible to intercept incoming phone calls for example by answering faster than the original phone? Yeah, the problem is right You have to be quicker than the normal user, but you can actually I tested it and Unfortunately Osmo commies a little slower So you don't have to be faster as in pressing the button faster the phone actually has to be faster and acknowledging the incoming call and Osmo con isn't faster than any phone right now Okay, um one more one last question from the internet Yep How much security does implementing a 5 3 actually give us and what about 3G? Well, this is a different different question because 3G is already present on all these phones. We impersonate well most of them anyway We can still spoof it on a 2g network. So adding a secure network Doesn't always help as long as you don't remove the insecure network a 5 3 the encryption cipher that's already used in in in 3g was a longer key size though potting that back to GSM of course greatly improved the resistance Against impersonation and intercept, but only for phones that support it These will be most newer phones, but there's a lot a lot of deployed base out there that that will never get a 5 3 anymore So protecting those also requires all the other measures even if we could have a 5 3 overnight But given that this this one phone now holds back the if I have three deployment Implementing all the other measures is worthwhile anyway Okay, it looks like you've successfully managed to batter the internet into submission and the room as well So can we have a big hand please for


Taking cooperation to the digital age, given rapid game-changing developments in technology, Africa and Europe must work together to advance and harvest the economic benefits of the digital economy, and at the same time prevent a counterproductive widening of the digital gap. Investments in digital technologies can make an important contribution to growth and development by fostering productivity gains from continuous innovation. Given our fast-growing populations in Africa, we are of course keen to work together to increase the job creation potentials of new technologies, rather than concentrating solely on jobs destined to disappear in the digital age. Faster growth, sustainable development, and job creation are also vital for reducing irregular migration from Africa to Europe. In our globalised world, people can see disparities in standards of living across regions quite easily. This means that there must be increased openings for entrepreneurship and jobs in home countries for those who would otherwise embark on risky dangerous journeys in search of opportunity. In Nigeria, we are taking urgent and practical steps to provide such opportunities for a rapidly increasing youth population. Our advisory group on technology and creativity has been working to build an ecosystem for funding, training, infrastructure, and intellectual property protection. Under our social investment programme, 75,000 young people have been trained in coding, software development, hardware maintenance, animation, and data management, and were set to train another 200,000 young men and women. Similarly, we have established eight technology hubs to support tech startups across our six geopolitical zones and the two major cities of Abuja and Lagos. We have encouraged partnerships to establish venture funds to support innovation and are now engaged in talks to establish a $500 million innovation fund with bilateral and multilateral partners. We will be deploying digital methods and tools on a larger scale to expand learning opportunities for young Nigerians as conventional education through BRICs and mortar institutions can no longer be viable, given the huge numbers and limited resources. Already 200,000 out of our 500,000 young graduates in our NPAR scheme have tablet devices which we use for on-the-job training and further skills acquisition. This experience will guide our efforts as we seek to expand digital literacy at earlier stages of education. Similarly, our education curriculum has been reworked to emphasise science, technology, engineering, arts, and mathematics. The arts have been included because of the growing recognition, of course, of the strengths of our country, especially in the arts, music, film, and literature. With regard to e-commerce, Nigeria has firms like Jumia and Konga, while Pesta, Kampaga are leading in enabling digital payments.  Financial technology has been used in our efforts to rapidly scale up financial inclusion. Working with our banks, telcos, and fintech companies, we've used digital tools and platforms to provide interest-free micro-loans to up to 1.3 million Nigerians, and another 300,000 receive conditional cash transfers by the same means. We hire, pay, and train online over 500,000 young men and women in the largest post-tetuary direct jobs programme in Africa. Through participation in these schemes, present and future beneficiaries will be brought into databases for unique biometric identification. I'm optimistic that our efforts will attract the strong support and active engagement of our partners in the European Union. Indeed, already we have some good examples of that in the African Digital Leaders' Training Program, which is a partnership between Ventures Platform of Nigeria and Enterprise Lithuania with funding from the European Union. This innovative programme will provide digital skills training for 50 young Nigerians in Lithuania while at the same time relieving temporary labour shortages in that country. A reintegration component is also built into the package. Also, the International Centre for Migration Policy Development is launching a pilot college of practical skills and start-up centre in Nigeria to train 1,000 Nigerian youth, including 300 women, per year in directly marketable skills. This is a collaboration with the Nigerian Private University, the Godfrey Okoya University, the Austrian Federal Economic Chamber, WIFI International, Modul University Vienna, University of Natural Resources and Life Sciences Vienna, and the Centre for Development Research in particular. We invite other EU member states to similarly partner with us to impart skills, raise resources, promote investment and provide the infrastructure to build a digital economy in Nigeria and indeed the rest of Africa. Excellencies, the conversations we have started here must continue formally and informally. We have a moment in the history of Europe-Africa relations that can yield tremendous mutual benefit. Let us seize this moment. Thank you very much.


This is called Bridges and Crossroads. WPA Bridge over the Neosho. I stood on it in full flood with my dad, the water just kissing the underside of the boards, river mones shivering up my legs. It stood until a flood licked out the footings. They replaced it, but when I dreamed the Neosho, the old bridge is there. They took the zinc out until they hit the daylight of Third Street. You could see the crack in the pavement. It looked like another pothole and there was sunlight in the mine. Sunlight just there with the dull ache of lead and the grim scowl of Jack. Those cotton mouths know some songs too. They know some fish songs. And once crossing Tar Creek Bridge, a grandma snake got hit by a pickup.  Taken by updrafts like smoke prayers near the water. She looked me in the heart and whispered just the one secret. What a lot of people don't know about the Ani and Wea people, my father's people, is that we pray at water. That's where we go to pray. And you see the theme I'm going with here. I decided that rather than going with misery, I'd talk about praying. And it's called Morning Song and it's usually done at dawn by Living Water. Grandma New Rivers. It's just a river, but the name trips me up. The bridge is the mythology of Red 66 and all of the family stories that run these shores. Stories running to the Missouri, to the Mississippi and to the Gulf Coast. It's just a river. But my dad fished it. We've seen buildings floating in the floodwater, seeing whole trees yearning southward. It's just a river. But my grandma chose it and she knew rivers because poems live dangerous lives. I can't write the vanished poem, the murdered poem she slips from under my pen off of the pages in my notebook and every planned word needs new words. Last scene alive, the murdered poem, the vanished poem was somewhere she shouldn't have been like walking or breathing or trying to see herself somewhere else. The vanished poem was caught on CCTV in Vancouver, Atlanta, Albuquerque, leaving work heading home. The murdered poem never got there. Because poems lives are dangerous. Because every poem's a potential headline along Highway 16. These poems run to Prince George or somewhere else. And if a poem steps off a cliff while avoiding the police and if it can't fly, then police can't find it. It takes family, community, and I still can't write her. Route 66 was the river we all lived with, knowing its habits and fauna, the sacred diners and cafes on its shores and the seasonal overflow, overflow. There's a mythology there that blurs between cultures. No Fred Harvey, but it replaced the railroad. Next food, second floor, the big teepee. And sometimes a hawk, not quite dead on the blacktop. The one that marked me with a clenching foot, a reflex between French toast scrambled eggs, cubed ham, and tangy coffee. When I still smoked cigarettes and grandpa had a bronze American leviathan, the whorehound drops, jerky moccasins gas, and the incandescent constellations of towns at night, each telling their very own stories, unknown to us. So many ghosts along this river that we share these pinpricks of similarity, these hauntings, this long man, such crime, such home place. You know what? I'm gonna have this be my last one. It's called Thieves. We who steal ourselves back from the songs, laws, and habits that claim us and everything about us. The long man, the wide hip, generous bays, protective as any mother. We who can still hear Lovejoy's press can hear it from under the water, the supervisory singing wolves. We who sing to other songs, who steal ourselves back, the kidnapped, hostage, unransomed, unranslable. We learn songs to pick locks, to absorb your laws and habits. We're coming for ourselves. We're on our way. Thank you so much for being here with us tonight. Thank you.


Basternautical Hygiene, Basternautical Hygiene evaluates, and mitigates, hazards and health risks to those working in low-gravity environments. The discipline of Astronautical Hygiene includes such topics as the use and maintenance of life support systems, the risks of the extraviricular activity, the risks of exposure to chemicals or radiation, the characterization of hazards, human factor issues, and the development of risk management strategies. Basternautical Hygiene works side-by-side with space medicine to ensure that astronauts are healthy and safe when working in space.


I welcome you in the course of leadership emotional intelligence and the CN making. This is module number 37 and we are going to talk about innovative action and mindfulness. When we talk about innovative action and mindfulness there are certain brain activities involved in it and those brain activities would be discussed under the discussion of behavior modification system. Never mind there are certain behavior modification systems which are operational and there are two most important dimensions we can talk about. The first one is talking about behavior inhibition system and this behavior inhibition system is basically focusing upon the fear side is basically focusing upon the avoidant perspective of the human self and this avoidant perspective would be talking about the fear, the disgust, it can be anxiety or it can be aversion. These are all the phenomena which a person tries to avoid and during that avoidance it is also possible that his mind or her mind is basically having the phenomena of amygdala hijack which will affect the working of our conscious mind. So behavior inhibition system is basically going to create the conditions, the constraints for our self which will affect our productivity and our creativity. This is the second dimension of behavior modification system is talking about behavior activation system commonly abbreviated as BAS. This is the approach side, this is the approach mode of the mind and in this approach mode we are focused upon enthusiasm, we are focused upon the sense of pride, we are focused upon the interest and we are focused upon the curiosity, jisme ke ek jaanne ke justu uti ye jisme ke hamari talab jisme ke hamari khwahish wo hamare liye positive reactions wo kreat karti hai aur ham mukamal koshish karte hain, har munkin koshish karte hain ke ham us approach mode ke tahit, ham us activation mode ke tahit us cheese ko adopt karne ki koshish wo zyada s zyada behter se behter trike se wo kar pahein. So hamara jo prefrontal cortex iske obviously activites bein ye donu aspect shamil hain. Baz ukaad ham khoof ki kaafiyet mein chale jaate hain aur baz ukaad ham khushi ki kaafiyet mein hota hain aur ye donu kaafiyet hamare faeslo hamari creativity innovations ko mutasir karne mein amal dakhal rekengi. Research se ye baad bhi sabit hui ke there is a correlation between creativity and mindfulness training aur ye baad sabit hui ke jis kadar zyada mindfulness training hogi utti hi creativity boost wo kar pahegi. Abis baad ko materialize karne ke liye there was a very interesting experiment conducted or also experiment mein different groups of people were giving were given two quizzes the two measures or different maze kender basic path was the same lekin ek maze mein the participants were facing the fear of an owl and they have to find the route for the mouse to escape or dosi taraf the other people were given the maze with a reward which is a cheese and they have to find out a happy mouse the path ok ab hua ye ke ab in donu activities mein unko jo majmui tor pa time laga that was about two minutes each ish mein time ka issue nahi tha lekin ek group of people were trying to focus upon the finding of the route in the case of in a situation of fear fear or dosi taraf to dosre log the they were trying to trigger the mind to find out the cheese which is a positive reward abis activity se guzar na ke baad jab un donu ke mind test kie gaye jab unko creativity exercises dee gayi to the astonishing results were coming up and the results were that the people with the BAS approach the positive side scored more on the creativity test why because gen logo ne fear ko face kiya tha unki creativity was suppressed by the condition of the fear which was triggered in their mind therefore jab hum approach mode ki baad karte hain to the approach modes of mind trigger creativity and innovation ab mindfulness training mein hum is baad ke koshish kareng gaye ke ab ko ammumun tor pa ammumi tor pa hum is taraf ujagar kareng ke ab apne approach mode ko use kareng ab apne positive thinking ko trigger kareng ta ke aap ka faisla bhehtar ho aur aap creativity and innovation ke saath taam wakar sakein agar hum is saari baad ko conclude kareng to dear students yad rakhyeega ke khoof aur khushi kiya donu ka fiyat haar wak tha hain lekin hume koshish yeh karne hain kiya hum life ki negativities kiupar fokus karne ki bhajaye jo positivity's hain usko zyada fokus mein zyada attention mein lekar aasakein and that is what we require in mindfulness training. Thank you.


What's up everyone it's your girl Kenzie here from Layton Sports Guards and I am ripping a personal here for Matt L We've got one box of 2021 Panini req 2122 Panini recon basketball hobby. All right, best of luck here Matt Thanks for hopping in primo rookie the 299 bronze rookie Kessler Edwards and rookie recon Evan Mobley Right in Grom hollow marketing and LeBron on the closing statements Got nets David Duke, Jr. On the red rookie auto to 99 David Duke, Jr. First auto up their frame up Kuzma hollow and rock the rim DeMar DeRosin Who's my grubba rookie red to 199 Halliburton and future legends Cole Anthony? Promo hollow Josh Hart and pink dream on green court Kisper rookie blue to 99 rookie DeVion Mitchell rock the rim Vince Carter Williams a second Aaron Gordon hollow future legends Desmond Bain GT Thor rookie hollow rookie Kate Cunningham nice hit there Matt and maneuvers John Morance Banton rookie bronze to 299 CJ McCollum and rookie recon Quentin Grimes Let's talk here for you Matt We've got rockets Jalen Green's true potential rookie auto boom Wow out of the last pack congrats on that one Matt heck, yeah Gina McDaniels hollow and James book night on the pink rookie We'll mag that green for you of course congrats again Matt. Thanks for hopping in we'll get this right out to you


Those who experience violence against women, domestic abuse and sexual violence are some of the most vulnerable in our society. They utilise a broad range of public services and it is crucial that staff employed by these are skilled to respond effectively to such issues. They also need expert assistance from specialist services who offer the highest standards of care. The national training framework on violence against women, domestic abuse and sexual violence has been developed in partnership with stakeholders and in consultation with survivors to offer training to everyone who needs it. It is made up of six groups and covers everyone from chief executives to specialist workers to those who may not even realise that people they work with are experiencing such violence and abuse. This film explains how the national training framework works. Group 1 includes everyone working within the public service and outlines the level of awareness of violence against women, domestic abuse and sexual violence that we all should have. It provides a basic understanding of what these issues are, how to recognise them and the simple things that anyone can do to help someone in need. This is important because survivors tell us that it can be really hard to confide their experiences to colleagues, friends and family, but how important it is that their work place feels safe and that they can continue to do their job. If, as colleagues, as friends, as family members, we understood a bit more about what it is like to experience violence and abuse, wouldn't we all do a bit more to help if we saw those signs amongst our peers? The e-learning the Welsh Government has designed to meet the requirements for Group 1 will help us all to do just that. Group 2 of the national training framework describes the group of professionals who will ask and act. Ask and act is a process of inquiry across the public service for violence against women, domestic abuse and sexual violence. This means that professionals are able to identify the signs of violence against women, domestic abuse and sexual violence, ask about these and offer help to access specialist help quickly. It is a vital part of early intervention and could prevent a victim being subjected to further abuse. So how does it work in practice? Let's consider a local authority homelessness department. A person comes into the office asking for help to be rehoused. They seem distressed and they ask if this can happen without their partner knowing about their application.  Being secretive about home life and seeming to be time-districted are signs that someone could be experiencing violence and abuse. The officer should be able to ask a person if they are experiencing abuse. If they are, the officer should be able to invoke internal processes to provide a safer service to them and access to specialist service for immediate support if they require it. This is Ask and Act and those in Group 2 will have access to national training programme which will scale up thousands of professionals to be able to respond. Group 3 of the framework are those who will be required to do more than Ask and Act. Those who either already have a responsibility within their organisation for providing a service to a client who is affected by violence and abuse or for supporting their colleagues in decision making around these issues. Any public service employee who is required by their organisation to act as a champion in relation to these issues will fall into Group 3 of the National Training Framework. Who could this include? Let's look at the role of a social worker who specialises in child protection. Their role is to ensure the safety and well-being of the children in their care and in doing so they need to work with whole families, mums, dads and extended family. Being able to ask and act is important for these professionals but it isn't enough for all of them. They will work with that family if violence and abuse is a factor and will need to consider what this means for the children. As such they or the colleagues who would benefit from training for Group 3 which will offer enhanced content such as working with the family as a whole, making holistic assessments and understanding perpetrator behaviour. Such training will help them to more effectively undertake their existing role to protect children affected by violence and abuse. Group 4 of the National Training Framework includes anyone practising as a specialist worker such as independent domestic violence advisers, those who run refugees or independent sexual violence advisers. Group 5 of the framework are those who manage specialist advocacy and support services for those experiencing violence against women, domestic abuse and sexual violence. It will support strong specialist service delivery, enhancing the services offered within your local area to support those affected by these issues. Group 6 of the framework are public service leaders who will build towards a culture and infrastructure which recognises the importance of violence against women, domestic abuse and sexual violence within all public service work. It does this by providing films like this one to keep you updated and in the future will include conferences and attendance at meetings and groups that are important to you. The National Training Framework also creates a violence against women, domestic abuse and sexual violence syllabus which will ensure all locally offered training is consistent and quality assured. This will form a basis for annual continuous professional development for both specialist and non-specialist professionals. It means that there will be a quality standard for the training on offer in your local area and greater consistency across Wales. The Welsh Government has launched a public consultation on the requirements we are considering making in relation to the National Training Framework under the Violence Against Women, Domestic Abuse and Sexual Violence Wales Act. Good training is only effective when put into practice. We ask you to consider the consultation and share your views with us about making it work. With your feedback and support the National Training Framework has the potential to transform the experience of thousands of victims of violence against women, domestic abuse and sexual violence.


Hi and welcome to the session. Let us discuss the following question. Question says, find the area of the shaded region in figure 12.22, where a circular arc of 6 cm has been drawn with a vertex O of an equilateral triangle OAB of site 12 cm as centre. This is the given figure 12.22. First of all, let us understand that area of sector is equal to theta upon 360 multiplied by pi r square, where theta is the angle of the sector in degrees and r is the radius of the circle. And also, area of equilateral triangle is equal to root 3 upon 4 multiplied by side square. Now we will use these formulas as our key idea to solve the given question. Let us now start with the solution. We are given that triangle OAB is the equilateral triangle and each of its side is equal to 12 cm. And we have to find area of the shaded region. Now clearly we can see area of the shaded region is equal to area of triangle OAB plus area of this sector. Now we know AB is equal to 12 cm or we can say side of equilateral triangle OAB is equal to 12 cm. We also know that area of equilateral triangle is equal to root 3 upon 4 multiplied by square of its site. Now area of equilateral triangle OAB is equal to root 3 upon 4 multiplied by square of 12 cm square. Now this is further equal to root 3 upon 4 multiplied by 12 multiplied by 12 cm square. Now we will cancel common factor 4 from numerator and denominator both and we get 36 root 3 cm square is equal to area of triangle OAB. We also know that all angles of equilateral triangle are equal and each angle is of measure 60 degrees. So we know angle AOB is equal to 60 degrees. Now clearly we can see remaining shaded region is a sector of angle 360 degrees minus 60 degrees. Now this is further equal to 300 degrees. So we get this angle is equal to 300 degrees. We also know that radius of the circle is equal to 6 cm. Now we will find area of sector it is equal to theta upon 360 multiplied by pi r square where theta is the angle of the sector and r is the radius of the circle. We know angle of the sector is equal to 300 degrees and radius of the circle is 6 cm. So we can find area of the given sector by substituting 300 for theta and 6 cm for r in the given formula. We get 300 upon 360 multiplied by 22 upon 7 multiplied by square of 6 cm square. We know value of pi is equal to 22 upon 7. Now this expression can be further written as 300 upon 360 multiplied by 22 upon 7 multiplied by 36 cm square. We know square of 6 is 36. Now 0 will get cancelled by 0 and 36 will cancel 36. And we get 660 upon 7 cm square is equal to area of the given sector. Now we know total area of shaded region is equal to area of triangle OAB plus area of sector of angle 300 degrees. Now substituting corresponding values of area of triangle OAB and area of sector of angle 300 degrees in this expression we get 36 root 3 plus 660 upon 7 cm square is equal to area of shaded region. So this is our required answer. This completes the session. Hope you understood the solution. Take care and keep smiling.


But I'm going to start with the first document, the high level summary. That's the one page summary that really goes over the main points in this bill because it is for a tax bill, it is quite long. Usually the bills I'm walking you through in your committee are much shorter than this. Many of these changes are conforming changes because of the breadth of what this bill does. It eliminates the property tax credit and the homestead tax. So most of the changes that you see at towards the end of the bill, it's sort of front loaded at the first few pages of the bill. The rest of the bill tends to be conforming changes. So as you've just discussed, the main major policy shift and tax policy shift in this bill is creating a new resident education tax. So the tax rate is the education spending of the taxpayer school district divided by the yield. So as Deb did point out and Senator Hardy emphasized this as well, this isn't changing the whole structure, it's changing the tax base. So the tax base would be federal adjusted gross income. So it's AGI of every Vermont resident that applies to both homeowners and renters. And that's an important point as we go through that renters would be subject to this tax. And in this bill, there is currently no credit that's proposed. There is a new definition of the yield, but it's not dramatically different. Under current statute, there's the yield for homeowners who pay based on property value and those who pay the majority who pay based on income. This eliminates those two has one yield and it's very similar to the existing yield language. It's just that it's the education tax rate. And so the yield is the amount of spending per equalized pupil that would result if the resident education tax rate was 1% and if the Ed fund stabilization reserves were maintained at their statutory rate, which is 5% of the prior year's appropriations. Can you share screen? Oh, absolutely. With us, I think it might be easier if we can all look at it rather than going back and forth here on the agenda. And I apologize, I don't know how I got into a Senate finance through the website that didn't have today's graphs or handouts on it.  So there are charts from Deb there. Okay. Yes. So I will share my screen. You will find these if you wanna follow along online under my name for S212. Let me give me just a moment. Great. So everyone should have the sort of high level one page summary now. So I'm under the first bullet point looking at the definition of the yield. So it is very similar to the existing statute. It's the amount that will be raised. In this case, it's the resident education tax rate at 1% under current statute for the homestead rate. It's $1. So it's very similar. To note, there was a question about how this would impact different tax years at different income levels. The bill does provide for reduction in the tax rate for lower income filers. And it's a progressive reduction. So for single filers who have adjusted gross income of $25,000 or less, the maximum reduction would be 85 or 80% of the tax rate. And for joint filers with AGI of $50,000 or less, they would get that maximum. And then it phases out for amounts of AGI above that. Tax payments are required under the bill either by quarterly wage withholding or through quarterly estimated tax payments. And then there would be an annual reconciliation when the individual files their income tax return. So that would be at the time of filing the income tax return. And the way that taxpayers would withhold would be based on the prior year statewide average rate for the education tax. And taxpayers would choose the rate at which they would withhold from their paycheck at 75% of the prior year's rate, 100% or 125%. All of the education tax revenues would be deposited into the education fund in the way that property tax revenues are currently. As I mentioned previously, this bill does eliminate both the homestead education property tax and the existing property tax credit. So many of the bill sections that you see are just conforming changes. So it's repealing a lot of references to the property tax credit as well as the homestead tax. The non homestead education property tax is still imposed under this proposal in S212. And I did try and explain part of what you were just discussing about how the property tax would apply when an individual has a homestead that's greater than two acres. So you would subtract, you'd essentially have an exemption for the homestead and the two acres around that dwelling. And then the anything above the two acres would be subject to the non homestead property tax. So in that case, you could have an individual take two different examples. You could have a homestead owner who has a property that's 1.75 acres. They would not be paying any property tax on that. They would just be paying the education tax on their income. An individual who has say a nine acre property, the first two acres surrounding their home, their homestead would be subtracted and the remaining seven acres would be subject to the non homestead tax. And then that individual would also be paying the resident education tax. Like it is today. Yeah. The way it is today. Yes, that's not a change. Okay, okay, thank you. Okay, let's keep going. And another important point is that this bill does continue to provide the existing render credit, which starting for filers right now is significantly different. That was reformed in 2020. So that has not been changed in any way. And that is one of the outstanding questions in this bill is how to handle renters. And that brings us to the final major change under this bill, which is creating a new education fund advisory committee. So it'd be an ongoing committee to monitor the entire education funding system that would be required to report and make annual recommendations back to the general assembly. They would take on the December 1st tax rate letter. The committee does include the commissioner of taxes the secretary of education. So they're currently involved with the December 1st letter. It would put them on this committee and the committee would be making the recommendation. The committee does have other members in addition to the commissioner of taxes and secretary of education, it has expert public members with expertise in education financing. Each of the bodies of the general assembly would appoint two of those individuals. And then there would be one public member appointed by the governor. The committee does need to report and I'll talk about this in just a moment, but they would need to report and their initial report back to the general assembly with a few key points of what has not been completely ironed out in this bill. One would obviously be the first recommended education tax rates and the yield. The committee would also need to propose a new structure for the renter credit program. And this is to address those renters who may be paying both on their income. So they'd be paying the resident education tax and then they may also be paying rent that includes the portion of the non-homestead property tax within their rent that their landlord would be charging them. And many of the renters that would have to declare and pay the new resident education tax would not be eligible for the existing renter credit, which won't go into great detail about all of those changes that are made in 2020, but that is based on income and family size. So this especially would, this first report would particularly need to focus on those renters who would be paying both taxes and not receiving a credit. Lastly, one of the areas that the bill did not go into great detail about or make some of the policy decisions about our penalties for late filings of the resident declaration, which is really the equivalent of the homes, the current homestead declaration, or someone does not file. So I will pause there. I'm going to stop sharing my screen. And I don't know if it makes more sense to look at each individual section of the bill or to go through some of the outstanding questions or to take questions. I open to what the committee would like to do. I do have a detailed section by section. Yeah, I think a detailed. Senator Hardy, do you have a question? But no, I actually have a comment. I just wanted to let everybody know that the Education Fund Advisory Committee portion of this bill was actually also one of the recommendations of the pupil waiting task force that we create that regardless of whether we do the income tax thing, the task force felt like it would be helpful overall to have this body overseeing and doing work in the interim on education finance issues, the weights, the taxes, the categorical aids, whatever it is. And that work is not being done now? Not regularly. There is a process for doing the December one memo, but that's kind of all there is. And so this would expand that to have more attention paid by people who understand the system into updating parts of the system, like I said, whether it's the weights, whether it's the rates, whether it's the penalties, whatever it is. So that was part of the task force recommendations as well. Okay. So committee, where would you like to go next, Senator Pearson? Well, I'm curious. Ms. Brighton said that JFO was, I don't know where to direct or ask Abby to go, but so I have a sort of separate question, which is JFO schedule, do we have a sense of when they're able to help us get those runs? Because I agree with you, Madam Chair, that's sort of starting to put meets on whether or not this can advance or our speed and all that. Okay. And I don't know. We all know we lost Mark, and Mark staffed most of the weighting study and was our 20 year, well, he staffed, I understood a lot of the property tax stuff that he was. He staffed it until he left. And so he did about half of it and then he left. And so we've lost our long memory there. And we are, I see Julia, we've got new folks that, there's Julia, you popped over to the other side, new folks that are working their way through this, but Deb, we know Deb hasn't had someone from JFO able to sit down and just kind of profile and just kind of proof out the runs. And so what I can do is perhaps Julia, you can ask Catherine to let us know what kind of a timeframe you think they can get that done in. Yeah, I'm happy to do that. I'll reach out to Catherine and have some offline discussions with Deb and our little Ed Finance team as we're all trying to get up to speed on this big proposal and get back to the committee. And our lead on the Ed Finance's home doing childcare so his wife can recover from COVID. But he is working during naps and in the evening. So maybe he can take a look at the runs during those times. He's just, at least for this week, we're hoping next week everything's back to normal. Maybe this is something he can do in his spare time. As all parents of young children know they have tons of. So do you wanna have Abby just walk us through a section by section? And then we've got, the last thing on the agenda is that overpayment of property tax, the barry bill that Abby has done, Abby, right, yes, has done a new drafting, taking in all the feedback from the auditor. And that is the last thing on our agenda, but that would put us a whole half hour ahead. I don't know that I can do that. But I'm looking at faces and I don't see anyone on Friday afternoon that's really ready to delve into this on an in-depth word for word basis. This isn't a new system. We've all been grappling with understanding the old system. Now we're grappling with this one. And the first question for me is, is this a simpler fairer system? And I think Deb has given us some charts. We can look at those. We can see how quickly we can get the runs in because that for me is where I see, well, all right, we've got these credits that are gonna go to people in this income bracket. I need to see how that works out. And then I think we need to give people time to look at it. I think we need to, once we have everything, make sure that the tax department comes in and talks to us. And we're dealing with property tax and we're gonna have to hear from the town clerks and see how, cause at one point they were really thrilled of the state to take over the collection. And then they figured out what it was going to cost them and they weren't as thrilled as having the state. So... Cost them meaning? Pardon? When you say what was gonna cost them? They get paid for processing the state education. They get so much per parcel. All right, I knew. The teacher is watching. And that would have to work out too, but I think we'd need to hear from them. Collections, who would earn the money from collecting delinquent taxes? That's the other question we're gonna wanna hear from the clerks on. Because this would essentially put the homestead property tax collection into the tax department. And it would be paid on an installment or annually, I guess. It could be done on an income deduction but that would take something from your employer. So there's some things to be worked out there. I personally have always said the reason we get so many complaints about the property tax and not about income or your credit card payments if you ever add up the interest that gets paid on credit cards is because you pay them off in monthly installments. If you ever had to pay your credit card or your credit card interest payments off once a year you'd probably scream and the same with your income tax. And so anything we can do to kind of spread that tax out will make it easier no matter what basis we charge it on. If you can make it more than, I think the most is four times a year. We might peel your dozen quarters but some towns still do it annually. Other towns do it twice a year and some of them give you a credit if you pay it all at once. A discount if you pay it, at least they used to. They may not anymore, but we are messing in the town clerk's territory and I do that judiciously. Senator Hardy. Yeah, I was just wondering, Abby, you have sort of three things that the overview you just went over than the bill itself, which is obviously the most detailed and then an interim one. Do you think it would be helpful to go through that interim one or is that just gonna be- That's what we're talking about. Yeah. Because you'd like, I can do the section by section rather than look, I mean, it's a 46 page bill. So I do go through every section and summarize what it's doing. So I think this section by section would probably be the most- Okay, why don't we do that? And then we've been through it. If we can do that in, again, fairly quickly, because I think we're gonna need more information and time to process it before we start getting into word smithing and tweaking. Okay. I will share my screen then in just a moment. I can't see you, so I hope you can see my screen. We can see your screen again. I can't see anybody either, so holler if you have a question. Okay, so this is the section by section for the bill as introduced. And the first section is really just a technical change. It's to eliminate the word property from the title of the chapter, so that it says education taxes instead of education property tax because it inserts this new resident education tax into that chapter. I've kept the bill as chronological in terms of the statute as much as possible, but there are some subdivision headings with the asterisk so that you can situate yourselves in the bill. I start with education taxes and then I move into the ed fund advisory committee, education fund renter credit, and then the end of the bill is a series of repeals. So in the very first real substantive section, it's section two, this is the section of statute that has all the property tax definitions in it. It makes one change that then creates a whole bunch of other changes throughout the bill, which is to strike the reference to tax for the equalized property grand list. It just removes the facts because it will no longer just be the property tax grand list. It will have both homestead and non-homestead properties in it. So that is one, when you're talking about municipal responsibilities, they will still be appraising, listing all properties and creating the grand list, both for homestead and non-homestead. So this does not change that process. This also importantly changes the definition of homestead and you had the perfect setup for this change, your discussion earlier about current use versus property tax and the property tax credit. The homestead definition as it is currently for determining a homestead property does not make any reference to the two acres, that two acre piece is for the property tax credit. So what the bill does is it repeals the property tax credit definition and puts it into the overarching definitions relating to homestead. So it would make a homestead at the dwelling and the two acres surrounding each dwelling. And it also pulls in some other language from the property tax credit, which is being repealed from that chapter and putting it in here about the treatment of cooperatives and mobile home park cooperatives. The definitions for education spending adjustment, dollar equivalent yield and income dollar equivalent yield. So that's the property and the income yields are all repealed and that's because there's no longer the property tax credit, it's now the resident education tax rate calculation. As I mentioned before, there is a new yield definition and this is language that was in the summary that we went over earlier. The yield means the amount of spending per equalized people that would result if this new resident education tax rate was 1% and if the ed fund reserves were maintained at their set story amount, which is 5%. So that's in the definition section. There are a few other changes if you're looking at the language, again, there are more conforming changes to remove references to homestead property tax or to the property tax credit. And then again, a lot of changes when it's talking about the grand list, anytime there was mention of property tax grand list, the word tax is being repealed. In section 5402, this is the rate section. So one clarifying change that was made in here is to the non-homesed tax rate. And that is just clarifying that the rate is $100 per equalized education property value. And also that that's unless otherwise set by the general assembly, that's no change to current law. It's just putting it all into the same section. This rate section has the important repeal of the homestead tax rate. It adds in language that's under, that's sorry, it repeals language relating to interim homestead tax rates for school districts when they haven't voted their budgets by June 30th, and then it adds that language into the new residential education rate. Also repealed is the current requirement for the commissioner of taxes to determine a homestead tax rate for union or unified union school districts. The language again is added in to the new resident education tax rate section. Some of this language might need a little bit of tweaking some of the technical parts of this don't all line up mathematically, but I won't go into that much detail here. There is one fee that's repealed. I mentioned that this bill doesn't really address a lot of the penalties and fees. However, this one fee that currently goes to towns to cover the cost of issuing a new property tax bill is repealed because that particular fee was for late property tax credit claims. So that's something that would need to be addressed by the new Ed fund advisory committee. What are the penalties? What are the appropriate penalties to charge for late or non-filed decorations? Where I think a lot of questions are going to come up and where there's probably still work to be done in ironing out a lot of your questions and a lot of the details for this new tax. A lot of those questions can really focus on this section four. That's the section that creates this new resident education tax. And this is the language that I just walked you through in the high level summary, but just a few main points. Again, the tax rate is still influenced. It's still determined by the education spending of the taxpayer school district. It's divided by the yield. Then that rate is applied to federal adjusted gross income. So it's each Vermont resident, both homeowners and renters. One thought, one sort of legal perspective, one additional change that you might wish to make is to adjust based on your discussions now is potentially moving the tax base to taxable income instead of federal adjusted gross income. That's a pretty big policy decision. This using federal adjusted gross income is not going to pull in any standard deductions, personal exemptions, any of those adjustments that happen for Vermont taxpayers income tax liability. So that's just one policy thing to keep in mind. As I mentioned, it creates a new yield. There is a reduction that phases out but for lower income earners, the tax rate is allowed to be reduced up to 80%. For individuals who have $25,000 or less if they're single filers or $50,000 of AGI or less. Again, as we mentioned, the structure for receiving the payments an individual can either have withholding from their wages or if they are self employed, for example, they would pay estimated tax payments like how they do for income tax. And then this will be followed up by an annual filing at the same time as filing the income tax return. Withholding would be at a elective rate. So the taxpayer like how with the W-4 an individual just tells their employer how much to withhold. This bill does require employers to withhold it at an amount that the taxpayer chooses. So it's either 75, 100% or 125% of the prior year statewide average tax rate. Again, all of these tax revenues go into the education fund. And then here as I was mentioning in the previous section a couple of technical or not technical seas are important for school districts that haven't voted their budgets by June 30th. There's some language in there about how to set that tax rate. And as well, there's language about setting a tax rate for taxpayers who are towns who are part of more than one school district. I'm going to just keep going in interest of time but if there are any questions, please do interrupt me. I just can't see anyone. So I'm just going by what I hear. In section six, again, we have some conforming changes. It's repealing references to the tax grand list, property tax grand list. It's now just the property grand list. This clarifies as part of the discussion that was had earlier that if a homestead is on a parcel two acres or less the entire parcel will be homestead property. So it will not be subject to the non-homestead property tax but for the portion of a property that is over two acres the non-homestead property tax only applies to that amount over two acres. The next two sections are again, repealing references to tax when referring to the grand list. There is an important change here. It just clarifies in section 5404A of Title 32 that section seven of the bill. Municipalities that have a TIF district will be collecting property taxes on non-homestead properties only. Section eight, again, repeals references to tax when referring to the grand list. And then there are some clarity that may need some more work about the types of values that the commissioner of taxes has to report two towns as well as what has to be provided on property tax bills. There's language put in a few years ago requiring an explanation of the homestead tax rate. This changes it so that the commissioner would need to provide language to towns for the new resident education tax. Section nine of the bill adds the common level of appraisal to the list of values that the director of PVRS report to the town clerks and to the secretary of education by certain dates each year. So these are some existing reports that just add other values that need to be reported. In section 10, the duties of municipalities are amended slightly. It clarifies again that the collection of the property tax is only for non-homestead tax. It also repeals a section relating to the homestead property tax overpayment offset where if an individual is overpaid that that can be used against an income tax liability. That language is added into the resident education tax sections. So it's just shifting. It's a lot of, as I said, conforming changes. So shifting a lot of provisions that currently exist to homestead property tax to this new resident education tax. Section 5410 in section 11 of the bill, it keeps the existing language around the homes of the declaration but renames it and applies it to the resident education tax. So it will now be called the resident declaration of domicile. What is a definite change in policy is that rather than just homestead owners declaring domicile, all Vermont residents, so that includes renters will be required to declare domicile for purposes of the education taxes. It does remove reference to the homestead tax for late filing penalties. And it clarifies what happens if an individual fails to declare domicile. Does not provide for a new penalty but it, which is something that the education fund advisory committee may need to consider. It does require the commissioner of taxes to determine the individual's tax liability under the resident education tax and bill that taxpayer. The education fund advisory committee. So I'm just gonna pause because that's all of, that's the bulk of the new tax and the new structure. The next few sections are about the committee. Okay, any questions at this point? Okay, keep going. It's gonna take a while before we have a grasp enough to ask questions. Sure, and I'm trying to just point out that we can probably grasp an advisory committee. Yeah, so this is a little simpler and really creating a new oversight, a more of a monitoring function after the tax structure commissions work, this would sort of continue that examining of the, from the big picture, but also really in the weeds about both overall recommendations annually, but also what the tax rate should be set at. So it shifts the commissioner of taxes, December 1st letter responsibilities to this committee instead of just the Department of Taxes. Granted under under current statute, the commissioner is required to consult with the secretary of administration and JFO, but this shifts it to the Ed Fund Advisory Committee. Also, as I mentioned, the committee is required to report in this language, it's honored before January 15th of next year to the money committees, education committees, ways of means in education and Senate finance and education in the Senate. It would be a recommendation for the first tax rates and the yield under the resident education tax. Any recommendations to restructure the existing renter credit program and then of course penalties and then any other recommendations that the committee thinks are important to make. The next few sections are a lot of cleanup in the what's currently the homestead property tax credit and renter credit chapter 151 of title 32. A lot of the changes are repealing reference to the property tax credit. One important note here is in section 16 of the bill, this did come up in your discussion today, I believe Senator Pierson, you mentioned what would happen if there were a transfer because the new resident education tax follows the income, that's the base. It wouldn't, in theory, follow the seller, but I mean, both individuals if there were already Vermont residents would be paying this. There is sort of an outstanding question of what the appropriate rate would be if the individuals either moving out of the state or moving to a different town with a different school district and a different tax rate. So that's a level of detail that the bill doesn't go into. It doesn't really address that currently. So most of these sections are just removing any reference to the property tax credit and any language stating that a certain section only applies to the renter credit. So it's really, this just becomes the renter credit chapter. The next section starting with section 22 of the bill relate to the education fund. So again, it's repealing references to the homestead tax rate, replacing that with resident education tax rate, removing references to tax from that equalized grand list. Another important point is that it clarifies that the stabilization reserve, which is the reserve that's a 5% of the prior year's appropriations from the Ed Fund. Any, that the Education Fund Advisory Committee will be reviewing that reserve annually. So it's giving them another sort of oversight role in the Ed Fund system. I'm skipping over some sections here. Section, because again, they're conforming changes, but in section 26 of the bill, there was a policy decision made there for the tax treatment of unorganized towns and gores. And it applies a 2% resident education tax rate to those towns. And it repeals any references to property tax credit. That is the bulk of the policy changes. The next few sections, I have listed out everything that's been repealed just in case there's any confusion there, there are veterans exemptions that are repealed because those are only applied to homesteads. So those were taken out because homesteads will no longer be subject to property tax. So there are a lot of repeals that are being made there. And then sections 28 to 32 of the bill are other cross references throughout title 32 to either the homestead declaration or the homestead tax or the property tax credit. Important dates in section 33 of the bill is that only really this effective date section and the Ed Fund Advisory Committee take effect on passage. All of the structural changes take effect in one year. So it would be July 1st, 2023 with the understanding that the Ed Fund Advisory Committee would be coming back with recommendations next session and that that would give the legislature time to make any changes before the property tax structure took effect July 1st, 2023. And that is the end of the section by section. Okay, any questions at this point? Okay, if not, I'm gonna suggest we take a five minute break before we come back with Abby rest your voice and get a glass of water or something and we'll see if we can't do that property tax over payment bill and then be on our way.