But now for Caleb, I'm going to hand it over to him for his comprehensive talk on mapping Wi-Fi networks and triggering on interesting traffic patterns. And without further ado, Caleb. Thank you. Hello. So, as she said, my name is Caleb. I work at Mandiant slash FireEye on the Instant Response R&D team. That's my day job. So, if the Mandiant consultants are like ninjas like Uma Thurman, I'm kind of the sword maker who makes their swords. I can't remember what that guy's name is in the movie. Anyone know? Thank you. That's right. So I like fuzzy things in life, like that dog, but also like fuzzy graphs and math that is fuzzy. I find I like when I have to kind of pull the signal out of the noise. And one of the things I like about that is because if you get into the real world, almost everything is fuzzy. So if you're looking at image recognition, text recognition, voice recognition, or going out and touching things in the physical world, like with SDR, you have to use mathematics a lot and kind of that fuzzy math. And I come from a programming background, and I think it's cool programming computers and stuff, but it's even more interesting when you can move things around in the physical world and kind of reach out and touch it, at least to myself. So kind of a precursor to this talk or something that led up to it, you know, I kind of got into IoT stuff before I knew it was called IoT. I did like a Raspberry Pi security system. And that was one thing that led me into this talk. And the other was, you know, wireless hacking is fun. I've been doing it different kinds for a while. I used to do the TCP, you know, layer three and four. And then I did a little bit with SDR at the lower layer. And then this talk is kind of on the layer two, the data link. And I kind of ignored this layer for a while because I thought it seemed kind of boring. You know, because the data you get at layer two, at the data link layer is in 802.11, it's roughly this. You know, you get the source map, the destination map, the SSID, the frame type, but then the rest of the data is encrypted. So it kind of seemed boring in the past, but then I started looking at it and you can infer a lot of other interesting data. If you're tracking over time and implying various things.  It's not in the frame. So I had this problem initially that led me to thinking about this stuff. I had a Canary IP camera and I have a Wink security system and they don't talk to each other. And I wanted the camera, if it's on motion, it was armed to trigger the sirens in my security system, but they didn't talk. So I had this problem and as a Pythonista, you know, if I had a fever and the only prescription was more Python, that's how I usually solve boring things that bore me. And the solution was this program I wrote called Tracker Jacker. It's open source. It is also PIP installable. And this is the tool that I used to solve that problem. So my thinking was, let me go to a video, I decided I had to record this because I didn't want to bring my own security system to DEF CON and do a live demo with it and then go back home and plug it into my house. So I videoed this, but basically the concept was, since it's an IP camera, if it detects motion, it's going to have to upload that to the cloud. So I can just look for a threshold of bytes. Like if I see more than half a megabyte in 10 seconds, assume that it's uploading a video, which would mean it's probably detected motion. And from there, I was able to call this script to then trigger my sirens. So this is kind of the proof of concept with that. So I'm going to just, I don't think we have good sound. So this is the siren, and then this is the camera that doesn't talk to each other. So basically, I move into the cameras field of view, and you'll see the tracker-jacker program print something.  So that was kind of my proof of concept and maybe pretty excited. But something about it also kind of freaked me out because I realized I didn't even have to be on the wireless network to detect that. I could just, because you're in monitor modes, you're not connected to the network. So conceivably, if I had a neighbor and they were doing this, or if it were me and I had a neighbor, I could probably see if they have any IP cameras, I could look at their MAC address. And from that ascertain, with the probability, maybe if it's Nest, it might be a camera. Well, you could see if that's detecting motion, even if you're not in the same house, even if you're not connected to that network. So that was kind of an interesting surprise. A little side note with that, I actually, I was testing this out with this camera. And I started noticing it was detecting motion where I was getting triggers even when it was unarmed. The camera was in home mode. And that was a little freaky because, in theory, if it's in home mode, it's not recording video, but it turned out it was. I didn't call them out though because they actually had a setting to disable that, but it seemed a little bit gray, kind of, to me. So I want to actually show you Tracker Jacker in the live. So it's running right here on my Ubuntu VM. And so this is performing, one of the, Tracker Jacker has two kind of parts. One is the mapping functionality. The other is this trigger functionality. So like triggering the security camera is the trigger functionality. But the mapping functionality is, it basically maps out, it scans every channel and it captures basically all the packets it can. And it builds the relationship map between every access point. So it lists everyone on every channel. And then it shows every, well, let me show you the data. So I've been scanning here at Recon Village. So it shows you every SSID and then under that each node in that network. So each BSSID. And then under each BSSID, you see all the devices connected to that. So it's kind of like in-map, but for the wireless radio waves. Because it'll build every relationship that it sees. And you get the vendor, if it's there, the signal strength, the bytes received, all that kind of stuff. So you can really get a good idea of what's on every network and are they active, you know. So that's kind of, you know, that was solving a problem that I saw. Because I didn't see a good way with many other tools to get that exhaustive list. At least in a nice format. Maybe in a GUI, but that was kind of a motivation. So a little bit real quick on how this works from a radio perspective. So a few basic things I probably most people know. Let me ask, how many of you are familiar with 802.11? Okay, yeah, okay, well let's go over briefly then. So you have these various channels, channel one, channel six, channel 11. And those simply correspond to radio frequencies, to predefined radio frequencies. And so you have your 2.4 gigahertz range channels. And you have your 5 gigahertz range channels. Obviously the radio, it's just radio. I recently was doing a lot of ham radio stuff and layer two stuff, or layer one stuff. And so coming back and looking at Wi-Fi, it was interesting to think of it as kind of just radio, you know. And ultimately a note about the monitor mode. So you may be familiar with promiscuous mode, where you could do this, if you're on a network, and you want to just say, give me all the traffic I see. But normally it filters out frames that are not for your MAC address. But with promiscuous mode, you can say, give me everything that you see. Monitor mode is a little different than that, and I wanted to clarify it. So monitor mode, you basically put your adapter into pretty much pure radio mode. And it receives frames from every network on that particular channel that it's on. And so it's not associated with any Wi-Fi network or anything like that. And it can receive from all of them. So another demo I wanted to show, I wanted to give an idea of the plug-in system a little bit. So I've got this pretty sweet plug-in system. And it's just very simple Python code. Let me make that bigger. So this is what a plug-in looks like. So you basically just have, let me ask this. How many people here know basic Python programming? OK, maybe 40%. So for those who know Python, the plug-in API is really nice. You write, you know, there's no inheritance or anything like that. There's just, you have your top-level class called Trigger, and you have an init method and a call method. And basically, all of the various metadata or data about every packet is called, is put into this function. So the device ID is like the mapped address. The vendor would be like Apple, you know, the interface that was on, the power level. And so you can take that in your Python code and just write all kinds of various plug-ins. So one example, OK, I'll start with this one. So again, these are kind of to respond to virtually any kind of traffic pattern you could think of. So you could respond to a threshold of bytes like I did for the camera one. But you could also say, if I see any device that's closer than negative 50 dBm in power, so within a certain range. And if you see that, then do something. Or you could focus on a particular MAC address. So anyway, one example plug-in is imagine that you want to de-auth attack. Let's say you really hate Apple and you want to de-auth every Apple in range. Well, that's traffic pattern. You know, you can look at it based on the, you know, because we do the lookup for the vendor based on the OUI. So we can look that up and say, OK, that's an Apple device. And so respond, you know. So let me demo that. So it's just, I don't know if there's any Apple devices within range, but oh, it looks like there is. So everyone it sees that it gets all the data on, it will de-auth. And we should see that up. There we are. De-authing someone. Probably. So we won't leave that running for very long. But so how many of you guys have tried to do a de-auth with Aircrack before? OK. So if you've done it, you know that you have to specify like the BSS ID, you know, the node that it's on, MAC address, all that kind of stuff. And so what if you de-auth someone? Well, it probably will jump over to another node. And then you'd have to do another scan, fill in the information, launch the attack again. So this does that kind of automatically because it's, you know, every time something pops up, it's going to just respond. So, you know, if you have it looking for a particular MAC address, it'll pop up anywhere and then tracker-jacker with, you know, de-auth it. So don't run that for very long. And if you do, maybe limit the power. So you can do this based on the power. So say only within some range. Actually, I think I did that for, so it probably didn't de-auth people outside of this room. But that's an example of, you know, having a traffic pattern and then being able to respond to it. Let's see. Oh, I was going to show you a different demo as well. So this one, this one's not very useful. It's kind of, it's more to demonstrate what the plug-in API is kind of capable of. So this is kind of just showing, you know, the top X devices and that in terms of closeness. So that's kind of what, like, Aircrack does. So it's not new interesting functionality. But I thought it was kind of cool because it kind of shows you can do, you can do quite a variety of different types of things with tracker-jacker, with the plug-ins, if it's based on traffic patterns. And let's see. Yeah, I'll demo one other demo. This one is, I want to demonstrate what a really simple, so this plug-in here. Count apples. So this, you know, it basically just says, every time I see an Apple computer, unique, that's unique, then print it out. So it's doing something kind of useful. You know, even for a really small plug-in, it's doing something kind of useful. And it's kind of a really simple example you could work from. Oh, actually I had modified this to show other people. I actually put a power range on that. So let me see. I actually want to see what it is if I get rid of that. Yeah, that's more, that's more like it. And this is actually a really short-range antenna. Like a, so I think I mentioned it, but the output file, you know, it's a YAML file. So it's kind of cool because it's both the database for tracker-jacker as well as the human-readable output, but it's also kind of the interop, A and interop, because, you know, you can easily write a program that parses YAML. Actually, let me see if I have that still. Have you guys seen the Marv was here, Wi-Fi? No. So this guy, I think it's like this running joke. Someone told me about it, but people like have this network and it says Marv was here, like a lot of variants of it. So I was programmed to filter Marv out because I was wanting to know how many SSIDs there were. So yeah, there was 50 Marv SSIDs. But I wanted to show that because, you know, this is just an example of what a strip would look like that could parse the YAML. Pretty, well, reasonably short. Okay, I also wanted to mention environment. So I have not run this on Windows. If you would like to see it on Windows, please submit a PR. It's got basic Mac OS support, but it's mostly Linux. So it does run, some of the basic stuff runs on Mac, but it's mostly been tested on Linux. So Kali, Ubuntu, Raspberry Pi. And then as far as adapters go, typically it's better to use an external adapter as most of you probably know for this kind of stuff. I really like the, like there's this one I have, the Panda PAU-09, and the O7 is nice too. But it's, you know, they're both small and they're both dual-band, and they both, they all, they work with Linux without configuration, and they support like injection and monitor mode, which is nice. And then as far as takeaways, you know, it's interesting to look at wireless again and realize, oh yeah, even though we have this concept of net, private networks and all of that, it's still, it's just radio ultimately. And there's only so much you can do with radio, to conceal radio waves. You know, they, the protocols have to be, are written in a way where they have to have some of that information public. There's not, you know, a good fix for that. It's also, a takeaway is it's really trivial to track you based on your Wi-Fi.  And I think there was a Snowden reveal about the government doing that. And I think it came to like recently, maybe stores are doing that to track people or something like that. But it really is not like a theoretical caveat. So very simple and really difficult to prevent.  I, you know, it's, it's just annoying because there's not really, there's not really something good to do about that. There's not a good fix. Also, as I said, you know, it's kind of cool. There's actually interesting information that we obtained even at Layer 2. We have this, or there's this new tool, Tracker Tracker, feel free to try it. Negative feedback is welcome as well as positive. And if you write any cool plugins, you know, give me a PR end. We'll add it in. And I think that's it. So thank you.


So as I was saying, I basically brief everybody what is dynamic instrumentation, and then how do you do it on mobile, and what does it has to do with mobile security, and search and search. So before I start, I would like to do a survey. I would like to know if anybody does any of this on the presentation. Maybe one. OK, that's often. Yeah, exactly. So basically, that's how I started as well. So I'm a security engineer, and basically, I was really into hacking games, and then attaching my PSP firmware. That's how I got into this eventually. The hacking is more interesting than the game. So part of the motivation for this dynamic instrumentation is basically to understand how a code source system works. I know that this is an open source talk, but sometimes we need to integrate our open source software with some closed source system, and they might not necessarily share the API or the documentation. So reverse engineer will come into place, and dynamic instrumentation is one of the tools that you can use. And also, if you want to set up, we analyze the office data binary in the context of malware, reversing, or whatever, this could be used both ways. All right, so when you talk about dynamic instrumentation, what is it? Instrumentation is basically monitoring a binary behavior, or basically adding extra additional instruction onto the binary. So nDynamic Instrumentation is basically doing that while the binary is being executed. It is also known as function hooking or sizzling. And basically, in one sentence, it's executing your own debug script inside another process. So to illustrate this better, basically, on your left is basically the instruction that you will see when you are running the application on the CPU. There is one, two, three, four. And if you do some instrumentation, you would be able to modify the application behavior by adding additional instruction before and after, and even removing certain instructions. So how can you use it? You can basically use it to access process memory, to override functions when some application is running. You can basically, yeah, there's a lot of stuff that you can do. You could basically change the course of the application instruction set and do whatever things that you wanted to do. So why do I care? Because to me, as a secret engineer, unfortunately, this is one of the qualifications. A lot of times, we have to reverse engineer stuff, and sometimes even malware as well. And dynamic instrumentation is a very efficient way to understand how a binary works. So this is the site that I had to call for a bunch of security students in NTU. And so this is something that most students is involved in doing wantably to research and malware reversing and even hacking as well. It's just some points that are why they should care. So enough of abstract concept. There are some tools that you could use to basically try out mobile instrumentation, like Frida, X-Pose, and C-Script. Does anybody have any experience with any of those? Maybe one or two? X-Pose, C-Script? So Frida is something that I use a lot right now. X-Pose is, I guess, is what everybody is familiar with. And also C-Script is basically a mobile instrumentation that's very popular on iOS, built by Saurik. And the tool that I use a lot is Frida. Have anyone heard of Frida? Oh, that's actually not the Mexican painter. OK, that as well. So one of the reasons why Frida was popularly used and also why our team or anybody that I know in security engineers using this a lot is because it basically supports a lot of different operating systems. And what it does very interestingly is that unlike attaching your debugger onto a process, Frida basically injects a JIT, a JavaScript engine, like Ducktape or even Google's V8. And basically, the debug script that you wrote can be JavaScript. And I know that recently they even support WebAssembly as well, so there's even more stuff that you could do. So back then, there's a lot of instrumentation framework that has very limited support, maybe on your Linux or some money on Windows or Intel X86 architecture. But in this case, Frida basically put a lot of initiative to create different bindings onto a different operating system. So in this example, basically the debugging, which is the process that we're trying to debug, Frida will inject a shed library onto the application. And the shed library will wait for the debugger to send instruction to it, basically to see what your debug script has to do. The communication channel is basically debuts over TCP. And I'll share a little bit more about this later. So Frida, there's a lot of ways to do it. In mobile security, there's two ways that it matters to us. One is embedded, and another one is injection. Injection is really useful if you have a rooted Android device. But in the case of iOS, you might not have a Joe Brocken device all the time, and it's getting harder and harder to get one. So basically what you could do is you could basically embed the Frida agent as part of the adelip onto the application, and then it will load. And this will work in a Joe environment. There are some restrictions, but for normal debugging or instrumentation, it will work. All right. There's a very detailed Frida API. Not that detailed, actually. There's still a lot of stuff that happens. But it gives you a good idea of what it can do. But basically, for normal mobile security instrumentation, there is two things that we care about. How do you instantiate an object? And also, how can you hook onto the function? The second one is basically using Frida's APIs to hook on the string builder function. So when string builder function is being called, I could basically use this function to pass whatever argument that is affecting and hook onto it. And over here, it's basically when string builder function is being called, it will just console lock the new string builder function. And the first one is for you to instantiate a Java object. And this could be useful, because sometimes some function that you are hooking requires an object. So to give you a quick example of a very, very common case that we would use in dynamic instrumentation is when you're running any application, I think some of the popular banking apps or whatever apps, they usually would check whether if the Android device is rooted, which is very common. And the highlighted ones are some of the patterns that they will look for to check, whether if the SU binary, a binary is on whatever path. And if it is, then you return true. And there's more other condition as well. So there's a multiple to check. To bypass it, basically, like the API that we showed before, you were able to hook onto the function. So over here, basically, I hook onto this function, sg.vantagepoint.a.c. The reason why it is this is because the APK that was reverse engineering, it has pro-gut, and it was optimized. And so you could see over here that when this function, so the first one is that when a first function was hit, it basically just returns zero. So it means that it's false. So in a way, we kind of hook the function and return false, no matter whether if the application discovered powers that. So it's a very basic way of doing dynamic instrumentation. And then there's some other alternative way to do dynamic instrumentation as well. Because for the method that we showed before, you have to customize your debug script every single time when you want to instrument, you want to bypass the root detection. So this method, basically, it will hook on some Android function, such as activity or exit cost. When the root detection has been detected, it will usually exit the application. So we basically hook on those activity and preventing it from exiting itself. So some application, they will have secrets, and they store it. And if you wanted to print out the secret, you could able to hook on some, you could able to hook on the function that we're using and print out the argument or maybe the result so that you could see the secret. So basically, this is a script that I have. So I have a, I think there was a missing slide. But basically, my friend and I, we created some hacking challenges for you to practice dynamic instrumentation. It's called OWAPS, Crack Me, Mobile Crack Me. So if you're interested, you can check out. I think I have some video here. We still have a lot of time. OK. I could basically just show you guys what it is. So on my right, it's basically an emulator that already has a feedout running. And then on my left, it's basically I'm trying to run the feedout script. So you can see that when I execute the application, my Crack Me that we created, it would tell me that there was root detector on the device. And so on the terminal, it basically modified the onclick function. So when I click on it, it will usually trigger a function to exit the application. But right now, I hope onto the function and preventing it from doing anything. So even if I do onclick, it doesn't do anything. And right now, basically, I'm demonstrating hoping a decryption function. So even though on the terminal, you didn't see anything, but at the debug script, I basically hope onto the decryption and print out the argument and also the return value of what I was able to do. So this event, but things like this can be, this is just a Crack Me. It's a challenge created by humans or humans. So it could be irrelevant to what we're doing. So for example, this is something that I just added this morning, so maybe there's some error. So recently, I was reading through malware as well, because I think that it's fun. It's also another challenge that was created by humans or humans. So we're following Android malware. There's this very popular app called Anubis. And Anubis, they made some changes recently. They basically have a loader, so that when you're doing static reverse engineering on the malware, you're then able to mark the actual page. The payload will be executed when you are running the application. And the victim to know that there is actually a new payload that is replacing the actual application, the files will be deleted immediately. The whole process cannot be on Android, so that they need to write the file now. For reverse engineer, obfuscated application doesn't mean the actual payload. So like I mentioned earlier, I want to write a debug script, customize it all the time. So on it, which is a Lipsy, which is a low-level Android Lipsy function. And I basically hook on this high-level function that they use. And yeah, so over here, you can see that I intercept it by just printing a console wrong. Bring the file, print out, and that's it. So it doesn't do anything. So do note that not the resolution, but just that the color of the emulator is very different, because this is one of the pattern that the new Anubis malware did. So to inform the victim that the phone has been compromised, they try to change the color of the whole device as well. Not the whole device. Yeah, but basically, you see that it's very different. So Flash Player is the malware that they're trying to fit. This is the malware. OK. So basically, I basically log in SSH into my Android emulator. And I try to watch the data directory of the application. And basically, try to see whether if there is any payload that was created. Do note that the watch function, it's a two-second frequency. So the delete function should be executed even faster than me. So if you notice, so do note the Flash Player application. Once the malware has been executed, the icon is no longer there. I think it's pretty interesting. So it does a lot of things. It will basically mess up with your accessibility so that on your device, the whole thing will be different. And yeah, you can see that Flash Player is no longer there. And even on the terminal as well, we would not able to see any meaningful payload, because once the payload was created, it will be removed by the way. And so right now what I did is basically I removed the Android malware. And then I reinstalled again. This is a bad idea. Yeah, exactly. So certain malware, they are really smart. They only package the native library into ARM, ARM Binary, and can support ARM architecture, but just that it will be really, really slow. And they will sort of encourage user or US engineer to do it on their real phone, which is a bad thing. But yeah. So right now I'm reinstalling the malware, not learning my lessons. You can see that Flash Player is there. So the difference this time is that I will be initializing the application with Frida to perform what Frida called an early instrumentation. So when the application was being loaded, it basically prevented from executing any instruction that I have in the app binary. And they tried to hook onto the function before the actual function was executed. And the function that we hooked this time is basically a low-level function. I'm going to start my Frida server. So when I resume it, you can see that there's a lot of unlinked function that was being triggered. And then the Frida will basically try to hook onto every single one of them and replace it with this error message between us. Then you can see that the malware will be executed. And right now I'll basically SSH into the emulator again. And you will be able to see some differences. So I'm not sure if you can see. The Java file here and also the next file is basically the payload that the binary executed. To give you an idea of when you download the malware and this dump payload, what is the difference? Basically it's something like this. So it's all gibberish. And then if you compare to the dump malware, you can start seeing that it is copying intent. And also they are registering, register, and do even more stuff. So this is the actual payload. And if anybody would try to reverse engineer this static application, not running the malware itself, they will not be able to see anything. This is an example. And over here you can see that they basically use a lot of Java reflection to confuse the reverse engineer. And over here, most of the functions and stuff, you will be able to follow them. And you could start seeing even more Android-native. So this is just a small example. Frida has been an open source project since the start. And it came a long way. And if anybody wanted to get into dynamic instrumentation, I would recommend you guys to try it. So some recommendation for application developer. This means a different thing for you. If you're creating a game, anybody could be able to modify the app logic or what. It's very important for you to understand as an app developer or whoever, to consider what portion of the logic should be on the client side and what portion of the logic should be on the server side. Even in grab as well, it's a very hard thing because sometimes the developer wanted something to be optimized further. So they wanted the logic to be on client side, which is something that we always try to check with them. OK, this instrumentation thing happens. And the environment, it belongs to the hacker or whoever. So you have no control with that. All right, I think that's it. I mean, reversing mobile application is illegal. So do not do it. There is some practical use cases as well. There was this guy who built an iOS application. And he tried to reverse engineer it over app and all other applications. And coupled all the deep links that all other application registered in his application. So you could able to automate certain flow so that every 9 o'clock you order a grab car or Uber car from Lifelong Learning Institute with the airport. So he reverse engineer it and he built an application out of it and Apple eventually acquired it. I can't remember the name. So this is all my contact emails, if anything you could ask me. And yeah, not surprised grab is hiring. We're hiring software engineers, security guys, and also drivers as well if you can drive. Any questions? If anyone have any questions? OK. So it was this guy called Oli. I think he's from Norway. And then it was partially sponsored by this company called Now Secure.


I welcome members to the 21st meeting in 2015 of the Delegated Powers and Law Reform Committee. As always, I ask members to switch off mobile phones, please. Gender item 1 is a decision on taking business in private. It's proposed that we take item 8 in private. This will allow the committee to discuss its approach to the delegated powers provisions in the Inquiries into Deaths Scotland bill at stage 1 with a view to agreeing the contents of a report to the Justice Committee. Does the committee agree to take item 8 in private, please? Thank you. Item 2 is instrument subject to a prefermative procedure, and no points have been raised by our legal advisers on the Public Records Scotland Act 2011 Authorities Amendments Order 2015 draft, nor on the advice and assistance by a way of representation. Scotland amendment number 3, Regulations 2015 draft. Does the committee have any comments or is the committee content with those instruments, please? Thank you. Gender item 3, instrument subject to negative procedure. The Common Agricultural Policy Direct Payments, etc. Scotland amendment regulations 2015, SSI 2015 215. This instrument was laid before Parliament on 28 May 2015, and regulations 1 to 3 came into force on 1 June, meaning that the requirement to leave a minimum of 28 days between laying and coming into force has not been complied with. Does the committee therefore agree to draw this instrument to the attention of the Parliament under reporting ground? Jay, as there has been a failure to observe the requirements for section 282 of the Interpretation and Legislative Reform Scotland Act 2010. John. I would just like to say, and perhaps this is not necessarily the right point to see it, but I accept the Government's explanation as to why it is taking so long, and I would have to declare an interest in this, which is why I accept the Government's explanation, because I know the hoops they had to go through to make this happen. Those comments. Indeed. As a matter of process, however, the instrument was made on 26 May, and laid on 28 May, creating a two-day gap between the making of the instrument and the laying of it. The Scottish Government has accepted that in relation to the 28-day rule, which was breached, of course, it would have been an advantage if arrangements had been made to put in place to lay the instrument forthwith, as after it was made on the 28th rather than two days later. To write to the Government indicating that where a 28-day rule is breached, it will be expected that wherever possible, an instrument is laid before Parliament expeditiously after it has been made. Thank you. No points have been raised by our legal advisers on the education student support miscellaneous amendments Scotland regulations 2015, SSI 2015, 212, the Old Scotland Sheriff Court, Sheriff Personal Injury Court Order 2015, SSI 2015, 213. The Scheduled Monument Consent Procedure Scotland Regulations 2015, SSI 2015, 229. The Town and Country Planning Appeals Scotland Amendment Regulations 2015, SSI 2015, 233. The Town and Country Planning General Permitted Development Scotland Amendment Order 2015, SSI 2015, 235. The Town and Country Planning Determination of Appeals by Appointed Persons, Prescribed Classes Scotland Amendment Regulations 2015, SSI 2015, 236. The Town and Country Planning Historic Environment Scotland Amendment Regulations 2015, SSI 2015, 237. The Historic Environment Scotland First Planning Period Order 2015, SSI 2015, 238. The Historic Environment Scotland Act 2014, Saving Transitional and Consequential Provisions Order 2015, SSI 2015, 239. The Planning, Listy Buildings and Conservation Areas Urgent Works to Crown Land Scotland Regulations 2015, SSI 2015, 240. The Listy Buildings Notification and Publications Scotland Regulations 2015, SSI 2015, 241. Is the committee content with those instruments, please? The Dender Item 4, Instruments Not Subject to any Parliamentary Procedure, the Legal Writings, Counterparts and Delivery Scotland Act 2015, Commencement Order 2015, SSI 2015, 242. Given the committee's consideration of the Legal Writings, Counterparts and Delivery Scotland Bill, Members will be pleased to note that this instrument commences the remaining parts of the Legal Writings, Counterparts and Delivery Scotland Act 2015, which are currently not in force on 1 July 2015. No points have been raised on this order or on the remaining instrument, which is the Vulnerable Witnesses Scotland Act 2004, Commencement Number 8 Order 2015, SSI 2015, 244. Is the committee content with these instruments, please? The committee is extremely pleased to see the delivery of the not-in-substantial work that we did on the legal writings and, of course, content to see it pass into effect. I don't write on number 5. I support what Stuart Stevenson has said, and this is the first piece of legislation passed by this committee. I think that it is very much to be welcomed that we managed, hopefully, to achieve it successfully. Indeed. Thank you. With that, let us turn to agenda item 5, which is the Community Empowerment Scotland Bill, and this item of business is consideration of the early delegated powers provisions in this bill as modified by stage 3 amendments. Stage 3 consideration of the bill is due to take place tomorrow. The committee should therefore agree any conclusions today. There are proposed stage 3 amendments in five areas that may be of particular interest to the committee. The first group of amendments of relevance to the committee concerned part 1 of the bill from the national outcomes. In its stage 1 report, the committee was concerned that there was to be no role for parliament in scrutinising these outcomes. The bill was amended at stage 2 to the effect that the national outcomes were to be prescribed in regulations and subject to parliamentary scrutiny through a superaffirmative procedure. Revision was also made at stage 2 for the Scottish Parliament to be consulted in accordance with rule 17.5 of standing orders of the Parliament on draft national outcomes for a 40-day period. Amendments 27 and 34 propose to remove the requirement for the national outcomes to be set out in regulations. Scottish Government is not, however, proposing to remove the requirement for consultation with the Parliament in advance of the outcomes being determined. That would allow the lead committee and the Parliament as a whole to consider the report on the draft national outcomes. Do members have any comments on draft national outcomes? I think that it's very much welcome to be welcome that the Government has responded to this committee's concerns in relation to the bill that was originally laid. I think that the proposals that are now before the Parliament for passing or rejecting tomorrow are ones that I think we are likely to feel should be passed. I would certainly personally wish the amendments that are being made tomorrow be on voyage and welcome the fact that they reflect our previous consideration. Thank you. Right. John. Welcome as well the national outcome amendments in as much as this is what was sought and Parliament now has the ability to have an input and that's therefore to be welcome. Amendments 42 and 43 replace section 24A of the bill which was asserted at stage 2 and provide a power to make provision in regulations for reviews and appeals in relation to decision notices and participation requests under part 3. The power would, among other things, allow Scottish ministers to determine to whom appeals may be made as well as the time limits which would apply in relation to such appeals. That power is subject to the negative procedure. Do you remember so many comments on those appeals procedures? No, thank you. Amendment 4 provides for a regulation making power to specify smaller areas or localities which community planning areas may be divided into for the purposes of outcome comparison. That power is subject to the negative procedure. Do you remember so many comments on that one, Stuart? I think I very much welcome the fact that this flexibility is built in. Many of the councils that cover large territorial areas Highland is an obvious one and Aberdeenshire would be another. In their internal operations have an area-based management series of area committees which reflect the fact that localities are often rather smaller than the council area. Having that flexibility is a good process that we should welcome. The drafting of the amendment that is brought forward at amendment 4 will look as if it meets the appropriate needs. Amendment 174 to 176 empowers Scottish ministers to make regulations facilitating support or involvement in the decisions of football clubs and supporting ownership of football clubs, while subsequent amendments remove the current part 5B regarding supporters' trust's right to buy Scottish professional football league clubs. The new power is subject to the affirmative procedure and various parties must be consulted before regulations are made. Do you remember so many comments, John? Thanks, convener. I think that this is a step probably in the right direction because I think that there was a danger here that there was a rush into legislation. It seems to me that there are quite wide powers now given to ministers. We are talking now about all football clubs and not just the 42 SPFL clubs. I do accept that there is a lot of consultation to be gone through before anything actually happened. I think that that seems positive and the fact that it is the affirmative procedure is positive as well. Thank you. Members may wish to note that, following last week's meeting, I have lodged amendments on behalf of the committee to deal with the specific concern that committee had in relation to the construction of a number of the delegated powers in part 5B of the bill as inserted at stage 2. The removal of part 5B would address many of the committee's concerns expressed previously on the delegated powers in this part, including its concerns about the construction of those powers. Finally, amendment 103 removes the regulation making power in section 69A of the bill regarding the size of allotments. Last week, the committee called on the Scottish Government to clarify how this power was to interact with the requirements as to where allotment size set out in section 68 of the bill. Do you remember any comments, John? Yes, thanks, convener. It is certainly positive that there is more clarity because that was the main thing that we were concerned about. Local authorities would forcibly reduce the size of allotments. I think that the fact that we have more clarity in this and it appears that it would be only if people asked for a smaller allotment that that is a positive direction as well. Thank you. I welcome the fact that the committee did bring forward five amendments in the name of the committee. Slightly unusual procedure for a committee to be taking but I am equally pleased to see that the Government has responded and addressed the points that would otherwise have been covered by amendments and, in particular, that the detail as to how they would bring forward the matters that would be in secondary legislation addressing the issues that we were looking at is spelt out at substantial length and might useful be a model for how such things are dealt with in future. Thank you. Do you members have any other comments on the community empowerment bill which will obviously exercise us at length tomorrow afternoon? Thank you. That then moves us on to agenda item 6 which is the Air Weapons and Licensing Scotland bill. This item of business is consideration of the delegated powers provisions in the bill as amended at stage 2. The committee's conclusions will form in advance of the stage 3 debate which is scheduled for Thursday 25 June. The committee should again therefore agree its conclusions today. Members will have noted that the Scottish Government has provided a supplementary delegated powers memorandum and will have seen the briefing paper. There is one delegated power in particular which the committee may wish to comment on. Section 66C inserts a new section 37A into the Civic Government Scotland Act 1982. The new section 37A provides a new regulation making power which enables the ministers to make provisions specifying circumstances in which the entire metal-dealing licensing and regulation regime in sections 28 to 37 of the 1982 act including amendments of the new provisions and the new provisions are not to apply. This extends also to the power to to supply the new and amended provisions in the bill on metal dealer licensing. The power is therefore widely drawn. Given the scope of the power does the committee therefore agree to call on the Scottish Government to consider amending the bill at stage 3 so that the power in section 66C inserting new section 37A of the 1982 act is subject to the affirmative procedure rather than the negative procedure. Does the committee agree to report that it is content with the other provisions in the bill which have been amended at stage 2 or substantially altered provisions conferring powers to make subordinate legislation and other delegated powers? I would just also like to put on the record how welcome the fact is that the amendment to the commencement powers in section 78 of the bill and that in terms of licenses and personal licenses that will be implemented the day after Royal Ascent is given quite a number of my constituents affected by this and I therefore welcome this amendment to the previous legislation which was much needed. Can I actually agree as well because this will make a big difference to people that at the moment can't actually reapply for that license holder certificate? Indeed. Thank you. Turning now to agenda item 7 the Health Scotland Bill purpose of this item is to consider the delegated powers provisions in the bill as amended at stage 2 and stage 3 debate for this bill will take place on Wednesday 24 June committee should therefore agree its conclusions today so they can be captured in a report prior to the debate. Members will again have noted that the Scottish Government has provided a supplementary delegated powers memorandum and will have seen the briefing paper. It's proposed that members may wish to find delegated powers acceptable. Does the committee agree to report that it is content with the provisions in the bill which have been amended at stage 2 to insert or substantially alter provisions conferring powers to make subordinate legislation and other delegated powers? We do. Thank you. That completes item 7 and I then move the committee into private. Thank you very much.


What we're doing today is talking about Hepatitis C, a disease that has the potential to cause debilitating illness and can lead to the need for liver transplants in some cases and in fact can be fatal. Treatment for Hepatitis C, these treatments are continuously advancing and with recent new drugs we can now cure many people suffering with this illness. That's why I'm really pleased today to announce that we've provided $5 million to the St. Paul's Foundation to support the BC Center for Excellence in HIV AIDS research into Hepatitis C. I think that the data that we're going to gather over the next couple of years working together with our colleagues throughout the system is going to give us unique insights on how to move the treatment prevention strategy to viral hepatitis in a way that is sustainable and ultimately contributing to the sustainability of our healthcare. What I'm very impressed with today is that the BC government has shown leadership there in fact making significant investment in research but more importantly this will allow us to offer Hepatitis C treatment to some of the most marginalized and vulnerable Hepatitis C patients in our community. A lot of us will I quit smoking because I'm you know I continue to stay clean because I don't have Hep C you know I've gone out and actually got a job and show up every day on time. These are things I didn't do when I was carrying that weight in my mind of having Hep C. Anyway um yeah life's different and no thankfully there is there is a cure today. Thanks.


From the Silicon Angle Media Office in Boston, Massachusetts, it's The Cube. This is The Cube. I'm Paul Gillan. There is a cloud computing giant, a unicorn company based in Norwalk, Connecticut, and it employs 750 people. It's one of the leaders in cloud backup and business continuity. Now getting into the network market, chances are you've never heard of it. It's called DATTO Incorporated, and the fact you haven't heard of it is actually by design. It's a unique characteristic of DATTO's marketing strategy, its channel strategy, and it's a company that's growing like a weed right now, so we want to hear a little bit more about, learn more about DATTO. Matt Richards is joining me today. He's the Vice President of Product Marketing at DATTO. Matt, thanks for joining us. Thrilled to be here. Thanks for having us. Tell us about the business model. How have the company, you've been around for 10 years, how did the company get started, and what do you do differently? Easy story to tell, actually. 10 years ago our founder, Austin McCourt, who tells the story about starting the company because he was afraid he couldn't get a job, and he built out of that a business, a very successful channel-focused business on business continuity and disaster recovery. And the special sauce for DATTO is really the channel. The managed service provider is our path for delivering all of our products out to end customers. We built a series of business continuity devices, and I brought them with me just to show. Those devices offer full-blown local backup and business continuity in case you lose a server or you might lose a drive on a workstation. You can always jump over to these devices with a virtualized backup or push it all the way up to the cloud in case, for example, your office is under water and you need to continue work. Now, a lot of people go into a coma when they think of backup, but you guys do something that's quite different. Technologically, your special sauce isn't just your channel strategy, it's also technology bringing the market. How does this work that's different from other backup devices? So this device is based on something we call inverse chain technology. So when we take a backup, instead of taking a single backup and then a series of incrementals, we take that first single backup, and then the second backup we take is actually a fully formed, is a fully formed backup image. So instead of doing a backup chain where when it's time to boot that backup chain, you have to reconstruct it over time, and then you have to take the initial image and apply each of the backup images. Instead, what we have is a fully constructed image that we can boot immediately right on the device or in the cloud. So that's built on what we call inverse chain technology, which is built over the top of ZFS. So essentially, if my server goes down, I can reboot or I can fail over to your device and continue to run my operation off of your device and even to your cloud service, I understand. That's precisely it. So the idea here is that if you lose a server, we can be booted within six seconds, get you up and running locally. And if that perhaps isn't available, for example, the office is under water, we can boot you in the cloud again within those same six seconds and have a virtual instance of whatever server or workload you need to protect in the cloud. Of course, that's the disaster side. Not everything is quite so terrible. Sometimes you just accidentally deleted a file. So we have other mechanisms on the local device and also in the cloud where you can do simple file restores as well. Just to find that folder you accidentally deleted the other night. Now, that has been quite a growth story. Tell me about the scope of your operations right now and how quickly you have grown. Well, this has been a big year for us. We just added, yesterday, our ninth office already in 2017. So we have nine offices around the world and nine data centers, over 750 employees at this point. We're headquartered in Norwalk, Connecticut, but we have offices in Monroe, Connecticut, Boston, Rochester, New York, Portland, and then in the UK, Singapore, Australia. And you've built data centers in many of these places as well. Also data centers. It turns out, of course, like so many, we have data residency and governance requirements that require data to stay in region. So yes, exactly, both for latency reasons, for those disaster scenarios, but also for data residency requirements. We have data centers built in region. And unlike many cloud companies, I understand you don't use the Amazon cloud or you use very little of the Amazon cloud. You essentially have built out your own private captive infrastructure. Essentially, yes. For data, part of it was initially, of course, to get started working with the Amazon cloud, of course. But we very quickly started building on our own cloud. And we have a build facility for all of our devices, too. So we build, since we're already building thousands of devices out of our own build facilities, building our own servers, is not additionally difficult. And we already have the skills and high quality build capabilities. So we leverage those for our own data centers. And we've built them out all over the world. Another thing that's unique about Datto is your distribution strategy. You are solely focused on channel partners. You don't sell directly to end customers. And that's part of your DNA, I understand. Is that right? Absolutely true. One of the things we often hear on the company, and it's really instilled in the culture, is partner first. Do what's right for the partner. In some cases, some of our practices, our business practices, are really geared towards doing what's right. Return policies. If you need replacement parts, we're going to send out the parts first. And then we're going to take the old parts back. As opposed to some folks who, for the business reasons, want to get it back, check it, make sure it doesn't work, and then send you the replacement part.  That's lost business for them. That's a lost relationship for you. So we built our company on the assumption that your relationship with your customer is the most important thing. And however we can help, we're going to help. So what do you bring to the game that's different from a technology perspective that is particularly appealing to the MSP channel? And that gets into a lot of our cloud management capabilities. So each and every one of our devices, and this is our smallest all-flash business continuity and disaster recovery device we released last year. So part of what makes that so special, and what's unique to them is the cloud management capability, we call it our data cloud partner portal. And all of our partners log in. They access the portal, and then they can manage these devices. And we have interesting features in there, being able to manage, being able to access the store, all of the content you might need from a marketing perspective. We have all of the pricing materials, all of our marketing collateral, and also training, all available through the portal. It's one place for an MSP to go that binds all of our product line together. And it makes working with data that much easier. You need a support ticket, or if you have an issue, go to the portal. Need to know a little bit more about the product. Go to the portal. You need to buy replacement parts. Go to the portal. And big news this week for Datto, the acquisition of OpenMesh, a networking company, really buying you a big footprint in the Wi-Fi access point and the networking business. And also, with a very similar distribution strategy to your own, what does OpenMesh bring to the game? So OpenMesh is a fantastic company out of Portland, Oregon, became a Datto company announced just yesterday. And OpenMesh, and I have in front of me just the access point from them, they bring a line of access points and switches. So when we look at the market for networking, driven through MSPs to small and medium businesses, it looks a lot like the market for business continuity and disaster recovery did 10 years ago. And when we started down that journey, it was mixed management panels, integration, chaos, a combination of disks, tape, USB, or no backup at all for small and medium businesses. And an MSP managing that was comparatively difficult. Well, the parallel for networking is that's exactly what networking looks like today. We have multiple management panels. It's 2017, and yet we have systems deployed that can't be managed from the cloud. For an MSP, a truck roll is a disaster. A truck roll means lost money, it means lost time. So being able to manage all of those networking devices from the cloud is a really big deal. So when we met OpenMesh, it was pretty early on, very clear that this was a connection that we needed to make more significant than just a partnership. So this quickly moved to acquisition. And what we released yesterday was the data networking line. So we have a whole new line of switches and access points and our data networking appliance. So if you're an MSP, you can pick up this Edge Router UTM firewall, and you can pick up a switch, and you can pick up the access points and essentially, as an MSP, you can sell out a complete line of data networking products out to your customers. So are you going up against Cisco and Baraki now? We do tend to see them in the market, but this comes back to what the design points are, right? It's about being simple, efficient, cost-effective. It's about 24 by 7, 365 support. It's about doing the right thing for the MSP, and our line is designed specifically for MSPs. A lot of other products and features, a lot of other products in the market, they weren't really designed for MSPs. They were down marketed from enterprise designs. And you can tell, if you look at the portal, command line interface, I mean, it's 2017, and we're command line interfacing in over through the cloud. Like that doesn't, that's just two modes that don't work well together. Yeah, I understand with OpenMesh, you've also bought yourself into a large distribution network that has very little overlap with your own. How big is it? So they do have today, 90,000 deployed networks with over 300,000 deployed access points, and they have been in business for 10 years. So when data was just starting, OpenMesh was just starting. So this is proven technology, proven business, proven distribution channels. And for us, when we looked at what data brings and what we've learned in the market, and we looked at also the existing channel for OpenMesh, these are complementary channels that don't actually overlap right now. So there are also opportunities for our customers and our partners to be able to pick up data networking and some of the OpenMesh products under the data brand and still leave the OpenMesh business intact. And it's going to be running as a business unit following exactly the same practices it follows today. Getting back to your core business continuity services, I understand that you have kind of an unusual way of demonstrating to audiences the resiliency of your products. You call them disaster demos, what are they? Oh, the disaster demo. That's one of the most enjoyed aspects of our roadshows. We put on several hundred roadshows a year on various events and we bring with us what's called a disaster demo kit. And over the years, let's see, we've created some thermite and we lit them on fire. We have, well, we attempted to cut them with chainsaws. We've gone after them with shotguns. We've dropped them in liquid nitrogen. That one was fascinating because the machine stops working in a very interesting way and its ability to flip zeros and ones because when it gets too cold it can no longer do that and it's a fascinating to watch it fail. And the whole point is taking a PC and destroying it, taking a workstation that you're working and showing and destroying it. We of course like to do that in creative ways. Generally with the approval of the fire department, apparently not always, especially in other countries from time to time. But then we drop, after we drop the workstation in and we destroy it and we bring up an image on something like this, then we'll drop this in and destroy it and demonstrate that our cloud can also pick up just where this device or your original server left off in the first place. So pretty powerful demos, but also a lot of fun in a room for a bit of creativity. I also understand that you do something unique with the ransomware epidemic that a lot of companies are struggling with right now. You actually, there's actually a feature of your products that is uniquely tuned for ransomware. Well, there is. Just released a couple of months ago in our flagship product, the Cirrus line. And these are small in a one terabyte to 120 terabytes for you rack version. So we have the little ones which I brought with me and then the large ones. In every one of those, we scan every single backup image as we'll take a backup image on the device and we'll push the deltas from the workstation or from the server to the device and we'll construct a backup image and then we'll test that image, every single one. And what we're doing is we're looking for the signs of ransomware and what that means is, is there are the files that ransomware attacks? Are those files still there? If you lost all of a sudden all of your doc files and JPEG files within a few hours, like that's likely ransomware. People don't tend to behave that way and delete every file. It's not a certain thing, but generally that's one of those indicators. There's some MFT table magic and also a test for entropy because encrypted files appear random. So therefore more random than a file with structured text, therefore we can also do that test too. So there's a number of tests we'll pull to check and see if ransomware is infected and if we do we notify the partner because again, that partner can then reach out and proactively tell the customer that they may have a ransomware problem and help them fix it immediately. And that's much better than the fire alarm essentially going off at the customer calling in a panic about how they have a ransomware attack to an MSP. Helps them build a stronger relationship. Now you don't sell direct to customer. So if someone's watching this interview and wants to buy a Datto products, how do they do so? So Datto products, there's information of course at Datto.com always available. The alternative is to, there's a little request a demo. So go to Datto.com and click request a demo. Then from there, we will connect you with our team who will connect you with a managed service provider in your area that offers Datto product. We also encourage folks, MSPs in the audience are otherwise too to join us at our roadshows. We do them all around the country. Chances are there's one coming to your area this year and we'd be happy to have you there too and talk through more of this. But if you're going to get Datto, you're going to get an MSP along for the ride. Going to get an MSP along for the ride. It's core to the business. You've raised a hundred million dollars. What's next? What are you going to be doing this year? So that's, this year is a fascinating year. We're spending a lot of this year. We've grown very fast and we have a fantastic MSP channel. And a lot of what we're doing this year is about hardening the products. It's about improving the capabilities of the products, improving the responsiveness of our support organization. For example, we've had an award-winning support team, but we can always do better. So this year is a lot about hardening our existing product line. We have over 50%, actually, I think it's closer to 75% of our company that actually is either in support or engineering. And that's about engineering and developing these products. So this year is a lot about hardening, improving the experience for partners and improving user experiences. I'm going mobile in some cases and also bringing our new data networking line to market. And for us, this product line is a global opportunity for us and it's a big one. So we're also spending, when not working on the core, product lines, the continuity product lines or back up a five product line in the cloud, we're also working on integrating OpenMesh products deeper into our product portfolio. Again, all back to single cloud managed product line available from Datto, push through MSPs. Well, it's been a great growth story. The ability to diversify your business, the way you've stuck to your knitting with your distribution strategy. Good story for Datto, good story, I'm sure for the state of Connecticut and continued success. Well, thank you very much. I'm looking forward to this year and honestly can't do it without our partners and our partner network. So if any of them are out there, thank you for your help. We made 2016 was a phenomenal year and 2017 looks to be even better, so. Datto.com, D-A-T-T-O. Thanks for watching, I'm Paul Gillin, this is theCUBE.


Minun tietysti tänään on taustattomisesta kehittämisestä järjestelmistä. Tämä on tärkeää, että Toni, joka on täällä, kysyy minulle, ottaa yksinkertaisuuteen ja yksinkertaisuuteen ja myös yksinkertaisuuteen ja yksinkertaisuuteen. Mennään yksinkertaisuuteen yksinkertaisuuteen. Joten minun jälkeen tänään on tämän takaisin. Miten vaikeudet ja selviöta perustumisesta kehittämisestä näytä virueen jekin saya, joka on yritys umpliäekonomisoituja vuodesta tai vuodesta. Tässä on umpliäekonominen yksinkertaisuuteen. Isä pyrkää routinegoikeusin järjestelmistä on suurin järjesteliäkin, ja monet small positive analysis on empirical work, serious econometric work on trying to estimate the causal impact of changes in, for example, taxes, tax policies on economic behavior, things like labor supply taxable income and savings. And then the idea is that how combining this background we here at VIDA could come up with a research proposal that would serve the purposes of getting useful policy relevant knowledge from regarding developing countries. So do I outline to my presentation now is that I'm going to first very briefly just remind you on what is this modern public economics approach to tax analysis. And I have a few slides about the current stance of tax revenues in developing countries utilizing the great data sets that was presented by the ICTD colleagues here. And after that I'm going to speak about the VIDA tax research. And unfortunately I'm now speaking more about our plans rather than actual results. So it's a scary thought that the talk is video and then somebody can keep me accountable for what I said after a couple of years to see if he actually delivered on anything we promised to do. So yeah, yeah, yeah. So if I'm not delivering it, stone is fall. That's obviously the answer. So let me start from the modern public economics approach to tax analysis. So also called as optimal tax analysis. So here the starting point is that the basic goal of the government is to collect revenues to finance public goods. And this should be done in a way that minimizes the tax distortions the tax system creates. And also at the same time the tax and the social protection system should achieve whatever the distribution goals of the government has. So in principle this gives rise to the basic efficiency equity trade off. And we need to have a balance between first of all minimizing the distortions and then achieving the distributional goals because achieving some of the distributional goals could actually entail tax systems that creates distortions on for example things like employment. One feature which I would like to emphasize regarding this modern analysis of taxis is that we don't make any artificial distinction between taxis and transfers. So if you like we can also see part of the expenditure status taxis and transfers being negative taxis. So the in essence the optimal tax models when optimal redistribution is analyzed covers both. Obviously also taxis have a corrective role but I skip that. Now on the empirical work on the impacts of taxation. Much of the current research actually emphasizes a notion called elasticity of taxable income or ETI which is defined as a percentage change in the taxable income TI whenever the one minus to marginal tax rate or the retention rate increases by one percent. So the benefit of this approach is that unlike some of the more traditional work it captures also other potential margins of responses. How the taxpayers might respond to changes in taxes. They can relate to increases in effort or also issues like avoidance animation. They are all captured by this elasticity. For the developed countries for the industrialized countries in a sense what are deemed as acceptable estimates of the ETI combines typically two things. One is the use of this large taxpayer register data and the second one is some sort of an economic tax policy reform. It generates variation across taxpayers which is fairly exogenous. So economists talk about credible identification strategies in these cases. Now when we go to taxis in developing countries this is the next small bit of my talk. This is an updated figure based which also appeared in the working paper you referred to but this is based now on the government revenue database which was released this year. And this is the revenues so this includes a total tax revenues including social security contributions for these country groups. And you can see that while there is clearly an increase even in the low income countries in the tax take the main thing is that they are still very much lacking behind in terms of the taxes out of the GDP on the current rich countries. But the point is that when we go back far enough in history countries which are currently rich also collected very little in terms of tax revenues. So this is a figure which I borrowed from a handbook article by Wesleyan Persson on this. And then you can see that the taxes share of GDP around the level where this tax ratio is nowadays in the developing countries. So a couple of observations based on this. So perhaps the main question in taxis and development is to how do countries go from raising approximately 10 percent of their revenues in taxes to something like 35-40 percent. So in other words how do they obtain more tax capacity. So to me because I'm trained in this optimal tax tradition this is an interesting contrast. In the poor countries we speak about that they should tax more. In the rich countries like Scandinavia some people think that we are taxing too much. And we are very worried about the distortions taxes create. So this begs the question that where is the tipping point. So when do the countries start to actually tax in a sense too much depending on at least some of us opinions. The second observation I would like to point out that how should countries design the tax and transfer policies as a system when they move. When they start to actually go from the 10 percent towards the 40 percent. I skip the remark on the field experiments because that was already covered in a mixed off for example. I now go to the part where I say a few words about our current research agenda regarding taxis and social protection. So there we have four main themes. The first is motivated by this by this need and desire to see the tax and social protection system as an entity. And one tool to actually do this is to build what are called tax benefit micro simulation models. I come back to them in a minute what they are. The second thing what we try to do is motivated by the fact that we currently as was pointed out by me already for here. We currently know too little on the actual impacts of taxes on economic behavior in developing countries. And then we try to use tax authorities register data for providing more evidence on these things. Then one issue is obviously improving the data access also macro tax variables. So we are committed to maintaining and conducting research using the ICT government revenue database. And we also have a political economy angle. This is the last bullet point here. We have a research program looking at some of the political hurdles countries may have when they build up the tax capacity and social protection system. There's a forthcoming symposium on these on political economy aspects to be held early next year. In this talk I'm going to focus on yes thank you for the for two issues. One is the tax benefit micro simulation models and the second one is the is the using register data to provide estimates basically on the ETI hopefully. I should mention that we also aim to conduct more theory work on on on on on designing cash transfer systems on the normative analysis that in the Merleys tradition. And also we would like to hopefully carry out some also work on the international tax aspects providing evidence on the extent of income shifting depending on on how much countries actually actually tax the multinational. So it is just trying to uncover this elasticity of income shifting. Okay so with a bit of you finish minutes I have I would like to say something about tax benefit micro simulation model building plans that we have. So so these models are combined to things so they build on a representative household level data on income and expenditures and then they also have a detailed coding of the tax and benefit legislation in the country. The word simulation refers to the fact that the user can can design alternative type of policies and then simulate the impacts on on on income distribution. The overall government revenues and for things like focusing incentives partial income tax rates or participation tax rates. The point is that these models are in everyday use in developed countries. And also I mean researchers find them useful because if you want to know the marginal tax rate we don't have any any other alternative than calculate these using my micro simulation models. And obviously these are essential for the developing countries once they try to build once they try to go from scattered isolated social protection programs to actual systems. Because then you need to also have an idea on the system wide impact of the policies plus an idea how to finance all those and attacks benefit micro simulation model is a tool to understand. Yet very few countries actually developing countries have access to such tools. So what we try to do is to is in a joint undertaking with the EuroMod team at the University of Essex and an institute called SASPRI which is a Cape Town based institute is to develop these models for a set of developing countries. Why EuroMod? Well EuroMod is both a model a micro simulation model for the for the European countries but it's also a statistical software for building micro simulation models and it improves and it's also creating comparability of policies across countries. One final point in two minutes so and this is about the use of revenue administration data in for tax research. We actually have very little published work on the impacts of taxes using credible identification strategies. The only paper I mean some were going on obviously by ICT the researchers on this but the only published papers are two papers on Pakistan. But it's clear that I mean Pakistan is not necessarily a relevant case for all developing countries so we need to know much more. So there we would like to do something similar what we currently are doing in the South African case and in also also other countries not only in Africa but also elsewhere. And it's a great opportunity for somebody like me to work to work using the South African data. So I'm at the moment I'm involved in a research project together with the person from the South African Treasury and two researchers to my fellow researchers from Finland. We are utilizing this South African register data to try to estimate the responsiveness of the corporate income tax base on the corporate tax system. And the tax rates they have in the South African case. So the idea is to is to is to utilize the fact that the in South Africa the small business income tax is linearly progressive. So that creates king points and the firms have an incentive to locate just below the king points. And because Kari is a ruthless mediator here I can say I would have these wonderful slides but I need to skip them so you can only blame Kari. So so but there's some wonderful work being conducted on on these and it's hopefully give then policy relevant evidence on the extent of elasticity of the corporate income tax base to tax rates. In in the South African context. So the conclusion is that the we are happy to participate in the field experiments and I think more of those should be done. But in a sense I would also step one. I would also take one step back and go to the world's these more traditional topics of building tax benefit micro simulation models and try to estimate the in a sense the the the impacts of the existing tax system on tax behavior behavior tax payer behavior and I stop there.


At Audiology Associates of Prestonsburg, you can live your life the way you want and find the freedom of better hearing. With 40 years of being in the hearing care industry, you'll experience patient care that is specific to you with exceptional follow-up care that ensures your hearing and balance needs are being met. Audiology Associates at 1428 Northlake Drive in Prestonsburg. The 42nd annual Jenny Wiley Festival is in full swing in downtown Prestonsburg with food, crafts, and live music for all to enjoy. Many people in Floyd and surrounding counties are stopping in to check out the fun and exciting vendors and carnival rides. Prestonsburg director of tourism Samantha Johnson tells us more about the festival and its significance. So we are at the 42nd annual Jenny Wiley Festival here in downtown Prestonsburg and it has just been amazing so far. Weather is absolutely stunning today. It has been, fortunately, all three days so far. So we're hoping for that to continue through into Saturday. But it's amazing. Food is absolutely delicious this year. The handmade crafters are awesome. We also have several artisans set up inside that you can actually watch them create at the same time. So it's just such a great collection of not only the celebration of such a great pioneer woman, but really just Appalachian artistry all the way throughout and just coming together and enjoying time within community. The theme of Jenny Wiley Festival is community and togetherness in Prestonsburg. The festival has only continued to grow in size with each year. So Jenny Wiley Festival is the longest consecutively running festival in all of Kentucky and so we're thankful that it continues going on and we have such an incredible committee here in Prestonsburg that come Monday they'll be planning the 43rd annual festival and they've just absolutely outdone themselves from the musical talent, the grand marshal, the parade, the events, the marketplace. We've just got a great committee that continues working so hard to make it phenomenal year after year and they've nailed it again this year. Reporting from out on top news, I'm Nick Collum.


So with the presence of Saudi Arabia being more and more pronounced in tennis these days with the ATP next-gen finals going to Saudi Arabia and of course the WTA finals almost being hosted in that region we're gonna actually have a massive exhibition between Elkhaz and Djokovic at the end of the year in that December period when we've got all those exhibition events and it's going to be in Saudi Arabia let's go have a look at what it's going to be. So as reported by the tennis letter Carlos Elkhaz, Novak Djokovic, and Irina Sabalenka will play in Saudi Arabia's Riyadh season cup exhibition. It will take place on the 26th and 27th of December so that's going to be a huge event and of course last year it was at the start of December that this event was held and it was called the Dariah Tennis Cup. Taylor Fritz ended up winning the whole thing for a million dollars so there's a lot of money going into exhibition events in December. In the Middle East we all know about the Saudi fund and it looks like Elkhaz and Djokovic are going to take a little bit for themselves to end the season and head into the new season in 2024. So there it is, interesting topic of conversation of course there's been some I guess some controversies while going to play in Saudi Arabia over the last couple of years but looks like Djokovic and Elkhaz are going to play and they could face a little backlash they're probably going to have to answer a lot of questions about the human rights situation over there but also Jabir and Sabalenka are going to play an exhibition as well so that's going to be a lot of fun but let me know down in the comments below. Do you actually watch these exhibitions in December or do you just switch off tennis in the end of the year because of course November is when the proper season ends and the start of January or the end of December for some cases is when the actual tournaments start back for the points and the rankings and all that stuff everything in between is all just a bit of fun but they're going to be playing an exhibition Djokovic versus Elkhaz in Saudi Arabia at the end of the season.