Are you seeing us here? Okay, we're good. All right, guys, we have Ellie Burstyn here to talk to us today about Hacker's Guide to Side Channels. And with that, I'd like to turn it over to you to have any sort of first question or first answers and we'll start taking questions on the Discord channel. So thank you for joining us and any sort of open remarks or anything? Thank you for watching the talk. Would I have loved to do it in person? Kind of miss the Discord ambience but I hope we try to have a good chat asking if you want to try to do my best once again. And again, thank you so much for watching the talk. Yeah, great. So I guess I'll start off. We, so I think you, you did a good job in the talk talking about the sort of why of machine learning and why the model predicted what, or why the machine learning decided the way it decided, if that makes sense, and why the model predicted what it predicted in order to understand how a defender would react to that. I don't know if you want to elaborate on that talk. I've never sort of thought of machine learning. You think of usually machine learning, judging it on the, what the outcome of it is, not what led to that outcome and what defense to build from it. So I don't know if you want to comment on that thought or if it even makes sense when I just asked. No, he does, he does, he does. I think we have a lot of secret tools for debugging. I think if you want to debug a C++ program, we have debugger. We have Python debugger, C++ debugger. Most of the things we can debug because we have a way to introspect where the bug is triggered by the system, the entire stack is developed around error and handling. The problem with how the crypto is, you run a crypto algorithm on the hardware and you have no idea why information is taken. You have a leak, you know that the machine learning observationally is finding the correct key or the correct attack point and you're like, okay, I developed this kind of implementation and we do have to go have a cryptographic chip, so that's the thing we're very concerned about and everyone who's doing crypto chip is interested in that question of, okay, you have a leak, but then what? And prior to machine learning, we didn't have a technique or we just had a tool where you can ask why? Why do you predict what you do, right? Try to, this is kind of like a crazy thing about the machine learning thing. We do things which we can't do otherwise. It's not ideal because, you know, we also were machine learning in the live box, that's completely true, but the only thing we have, which is like, okay, can you please tell me why? The why is that it's a bit easy, but it's like why? And then we thought, okay, since we moved from sectional attack using, you know, statistical estimate, machine learning, and we talked about last year at DEFCON, it's what we were. Can we go once a person tries to also ask them whether they want it? And then you can do that. And as I said, it's very, very brutal. You have to be super, super precise, and we make it work for one implementation. And you know, it's a tool, so obviously we're going to choose the best case. Truth of the matter is, you know, you have to really be super precise, which is CPU instruction precise. So it's not super robust just yet, but you can do that. And I think that the only tool in the world we can do that. That's why KELD is one of its kind. It's the first generation of it. You know, five years from now we'll be laughing at it, right? Okay, that's the worst way for the way to do it. I'm pretty sure. But it was a two crazy years of brainstorming and trying eight years until we come up with an idea of doing it. It come out of necessity. It come out from our project team inside Google. I was like, okay guys, you make better attacks, which was not the goal, but the goal of our project is to make a better world, like the most secure world, creepiest and current for all of us. I don't have to be so quiet. And then we really want to have like a tool for it in the guarantee of life and around the world of like, okay, the tool you can use is the tool that gives the bugger of hardware crypto in such that it exists so that the person is gone. So that's where it comes from. And without measuring, it doesn't work. But without deputations, it doesn't work. And without the community, it doesn't work. We use a lot of the first technology behind the scene, like Uniquart. And we have pretty much talked today about Uniquart as well. A lot of people are using Uniquart, which is a CPU emulator, which is based with the community. So we are sending us to their giant, which is bringing some of the very interesting to a time that's really there, that's what it is. Great. So actually just jumping off what you said, are people actually using this to help identify side channels yet, or have you been approached by women? Yeah, so that's exactly the absolute thing to be clear. We had a lot of debate actually internally because it truly is super out of the press. I would say the initial success, like complete success was probably one or two weeks old. We knew it was somewhat working, but we didn't get it to work as clearly as it should talk like until maybe 24 hours before I recorded the talk to be clear. And this is literally, but we saw that there's quite a bit of, we really want to contribute, we really want to be part of the community. Usually we're not really good at, I don't think things ahead of what we do, but this year we saw that we wanted to really show you the cutting edge of what we were working on as a way to participate and to be part of the community. So no, it's not there yet. The research is not there yet. I'm sure the question is going to come so I want to answer. Yes, it's going to be public next week. I'm shaking up the guitar to tell you how new it is, but we went for here's something new exciting that we work on. You guys might get a kick out of looking at it and be inspired and that's what we go for. So the talk sometime I'm a bit of it. Sorry about that too. I tried to record the door closed in California, in fact, 28 degrees in the room when I tried to record. So I was trying a little bit. I project also from my English, but yes, we really tried to do it. This is the tape mode tool, which is like we do show you pretty good. Like it's a true, you know, very old death counts period. But like this is new, we're here to change them. So that's what it was. No, it's not good. Absolutely not. But anyway, I'm copy of the word. That's great. So the example we're using, we're mostly around power, if I understood the presentation right. And you mentioned other side channels, heat emissions, timing, et cetera. I mean, you see these techniques would apply to all those or was there wasn't anything unique to the instrumentation you used, right? No, I don't see there's anything special to it. I never use, I said I don't know if they want to use heat. I would be super curious if someone knows about a heat attack, timing attack, it would be super, super interesting. I've never seen one like in crypto. They might exist, I don't know, but we thought about, yeah, I think it's one of the big deal. We wanted to do this here to be clear and extend all what we do from power to EM as well. The truth of the matter is we cannot go to the office especially doing remote work in our team as many of us are doing in the community and we don't have access to our equipment, right? So honestly, we can really do with power because that's what is plugged in into our lab. And the only thing we can access remotely to do is for EM, you have to literally have an EM table and you have to be on top of the chip and there is no doable in the future. So we love to do EM, it's just not good to happen today. I think the next big target is that you would do maybe timing, timing might work too. Probably, I think there is a few people coming out this year from other group on machine learning and timing attacks for erasic ability. Erasic ability, so I think it will work, they show that you can use machine learning for that. So as I said, machine learning is easier way going to take over such an attack for hardware in the next two, three years and when it's going to do it, we just happen to be the first few groups who are doing it. I also think it's nice to see the German group as well who's doing some of it. Some vendors are taking some of the research and bringing it to products. I think that's where it's going to go. But I think most of the people are on the power train for now. Maybe it'll be the timing attack that is coming this year. I guess the EM is the next. E-type of money. Yeah, I was wondering that too, it's kind of as you're saying you built your model I guess using mostly an emulator. How is that scaled into hardware, right? Other hardware, like it's kind of the research you've done, it's that one sample. Or do you think that you need to build your machine learning models for different types of processors or setups, right? Does that make sense? Yeah, so for the attack side, we know it works. I mean, I hope it's not a unique one paper, but since last year we've been working. So as three years, we have collected a massive set of data set that we really hope to publish. We're not going to give it data at that point. Let's see, I said very soon, and it didn't happen this year. Well, the next year we have, but yes, we have that for multiple data sets and for hardware that works. For the emulation side, the other side, which is not the machine learning side, the dynamic analysis is where we need to be cyclopsized. We don't even have a normal one. And the thing is Intel is trying to put out the question because they have a predictive pipeline. So we don't even know, like, depending on how the interpretive pipeline will work or the flush pipeline will work, the number of instructions is completely on the deterministic, or at least to the point where in our probe right, we're not able to do it just yet. So if your CPU is too complicated, let me see if we can. We use certain instructions should work, I guess, but as I said, we don't even have the device now because it's like, oh, it's between, I don't know what the range is, it's two to 12 cycles. So we have to together make an estimated guess. So it works for our mostly embedded stuff, smaller parts, more power would work too. But yes, the emulation side of it is hard because if you're off, if you're not investing in this core right, if you're finding the attack, then if you're off for the cycle for the emulation, you end up, I don't know, like six to 15, 100 cycles left or right, and then you're on the wrong line of code, right? The line of code, as I said, is true for instruction.  And similarly, there is that point charge, the end of the, you can just let that end of the implementation, not the first round, but the end, and then again, then at that point, every error is compounded, right? So the further you're on the trace, on the right side, the more you're going to, to have a chance of messing it up. So yes, we choose easy case, which is like very well defined, which is a very small set of instruction well-defined, well-documented on an EEC, not vectorized, because that's the easy case. Harder case would be like more features of ensuring, I think, if you bring the committee on, so I said to help us improve the analyzer or add more target is probably to a board, which is going to be trustee, reverse engineering, this is how it's written. That's for people who like hardware. It's fun to do, it's just, that's going to be quite worth it, to be clear. Yeah, so, I mean, the attacks themselves are pretty hard. So it goes to show that the, the defensive analysis would be just as hard, right?  There are defenses which might exist, like doubling the bus for power supply or attack, that's not going to be permitted in hardware, it's too expensive or too costly or too big. So everything is your number two, such an attack to an extent. So the question is, how hard can we make it by the arm? Really cool set of work done mostly by French, the French, on the mass KS, which is kind of like the way you make it harder. You also make it smaller, slower. So the question is how slow can be hardware encryption, right? The question is, how many milliseconds can you tolerate? So the reason why I mentioned that is, if you use security keys, right, we call it security keys, they use NFC, and the problem with NFC and NFC is super fast and super low power. So now in those settings, making a super resilient implementation is going to be challenging. As I've been said, be careful, this is a very careful, this is not AF as we show, but even for that, you can actually tell if you want to aid, aid to care, also if you never have a session like that, and then you just decide, well, I don't have a lot of time, I don't have a lot of time, and then more competition to harden my thing, that's become kind of impossible. So there will always be a trade-off, right? And as long as there is a trade-off, there is a vulnerability, so, you know, tie-less channel attack is probably the most powerful attack you can do against people these days because this is the one where we know it would be so interesting. I don't see it as a console goal, but, yeah. It's awesome. Yeah, and I'll say, I really appreciate your talk to how you went through the different steps. Like it was very informative and instructive, like even just mentioning explainers, like you did a very good job of explaining everything and really showing the world examples.  Like I guess, how did you get into the side-channel attack space? Like what drew you to that? Was it the encryption aspect to try to defeat that, or was it like, how did your research end up on side-channel attacks? Oh, wow. That's a hard question. I think it's a question. I think what happened is, before, I always did cryptocurrencies and then, people might or might not remember it, but a few years back, we had not the first creation on show one. And we did the talk at that time. It took us a while. It took us a while to do it. Breaking show one in collaboration with Mark Steven, the CDB UI, took three years. Most people don't realize at some time when we do talk, it's like, oh, that's what's nice, it took three years of effort for us and I think it matters in almost 10 years. So if you get out of breaking show one, I mean, putting in practice is what broke up by one, but like, providing the first collision and then, as I said, in 2015, we do the first collision. We showed these two to us, which are like the set show on the world, the breakage show on which was our goal. Interestingly enough, the backstory is a reason why we decided to do it is not to do a talk, but because we really want to help people realize they need to go away from it. At the time, Microsoft X-Guard did not forget it, and Firefox was kind of like lagging and it had immediate effect that both of them did not forget it. So it was like, what would you ever go into this crazy amount of money and amount of energy to literally compute all this? The answer was, because at that time, we wanted to show it to the world, it was the world, it was not theoretical and we should treat it seriously again, but it was important to get this is always in the context of our research in Google, it's really, we try to use it up next door where people come out to do some project and try to figure out if you can have the world. And then we finish up and we're like, okay, what else? And then, so you're also searching, it's almost a hangover, because for today, we can focus on one thing and then we go to the next piece of crypto and then we're like, okay, what to do with it. And then we start to talk with the product team and at that time something called the Titan chip publicly is developed by Google, Google-owned crypto chip. And the crypto chip, we talked to the hardware engineer and we told us, well, no. So it is crazy idea, we come up with one paper from the French agency, which is the French control agency specialized in crypto. They have this very good trust work on machine learning and crypto, you should check it out. And I was told enough is the idea. The internal team was very interested into having more results with such good expertise. And then we realized that they thought it was very interesting is to play well into what Google do, which is machine learning has a time that's here. It plays well into core and some other research that we should do, it plays well with, it's what we said to Google. Honestly, we got from our project team the right to do it was completely serendipitous and I've been seeing research more like talking to people or that's like something like that kind of really cool. You want to talk, you get inspired by other people, you build on other people, you work for ideas and we all keep it to push each other. So I think that's what it was. I think that was this idea of come from other people, and take credit like that. We made a lot of wonderful people from ledger, from Chief Wistar, you know, Cody and I know Chief Wistar is always a staff member of the committee, he's just from the committee, he also have a lot of time to help us keep his pointer early days and so that's for you. So we're glad that now we can contribute that. Great, so we have a question from the audience. Apart from approving the emulation, what do you see as the next step in this field of side channel detection? Detection, that's a great question. I think there are, I think it goes hand to hand with better attack. Again, we can only explain what we can attack. I think we have a few working streams on public key and a few working stream on other algorithm. I think that would be interesting to do. We're always looking for people who are willing to work with us because it's a very, very big, it's very, very, I wouldn't say difficult, but it's a lot of crime to create the data and to do the machine learning and that sort of things. And so if people are interested, they could have the right way. We're always up for it because it's a little bit like, figure out what to do is hard. Last year, when I come, I go, it's so hard to do an AF model this year after a year of refining the machine learning model and our process, we can basically do it in 10 minutes. So we went for five hours to 15 minutes by getting, we'll just mechanically better at it. I think it's going to be the same for the other algorithm. So I really feel that. I think we're also going to feel, I hope people didn't create it for it. I don't know, I would imagine you can do that. I get like some people mention cache line as an idea. I found that quite interesting. There is a holy grail of Intel HGX, right? I mean, Enclave is also using Hutter. It is crazy hard to attach because it's literally back into the intensive year, right? However, no one knows if machine learning can do it. Some people we talk to say, yes, it's probably doable. I don't know. I never do it. We don't have necessarily the time to do it by ourselves. We're happy to contribute, but that's something which is interesting in life of research. I think Enclave is a big deal.  Everything which is timing sounds a little bad. I would not be surprised if someone even covered a crazy idea on how to do it or become worried transactions or even what would be another stress. SQL injection. You know, we have a lot of blank SQL injection. Maybe we can get more out of the timing. We can make more out of the timing that we think we can. It's unclear. I mean, most of them should have been fixed, but yeah. That's love, room, love, creativity. Depend on people's taste. I'm sure. So you mentioned the papers coming out. Do you have an estimate on when you're gonna be done with that? I'm not going to jinx it, but I'm not going to do that. Last year I said it's going to be soon. The draft is still on my desk and for the schedule paper, I'm going to be completely honest. I told you we rushed to do it for DevCon. We really wanted to show you building Edge. Literally, the paper is not written. The next step for us is really to show, to put everything on GitHub. I'll post it on Twitter, hopefully next week. Nothing on the wood. And then we're going to want people to play with it. We're rather providing complete stuff to people to play because last year we did the reverse, which showed we're going to hold, hold, hold and give everything at once and then work out. So this year, switching strategy. I'm going to easily, imperfectly early and then the paper will come later. Completely what? But yes, the AS, data sets, we promised last year are still there, we just haven't get the chance to release them.  Not there yet. Where are the other ones are? Not there yet. They're going to get there where they can. And then make no promises because I don't know what I can keep on out. So try to be a little bit more, we have a stick, this here, the match here. We want to be to the point people. I was going to ask the same thing. So it's definitely on folks minds. We do have a question from the chat. So, you know, are you aware of any side channel attacks that are found in the wild, right? Where attackers are using them? Or is this more of where we're thinking about how to defend against these attacks before we see them active? Oh, side channel everywhere. Side channel everywhere. They're like the most prevalent form of attack for hardware. Let me try to figure out which one I can tell you which one is pretty interesting. So again, it's not to single out, to put one company like this company is bad because I'm pretty sure there's put all of them. So I start with one of my favorite company which I really like, Ledger. Three years ago, they had a way to much of a timing attack on the entity curve. That's what the example I gave at the beginning of the talk. And they were able to recover out of the ledger, treasure, the bitcoin property, right? So that's pretty big deal. So there was timing attack on many game console. I see we're streaming on Twitter and we're going to give too much detail, but so many, many security, many, many game console are protected by crypto. Then there was timing attack to recover some of those secret keys. That was earlier generation, I got not talking about 5 or 4 or Xbox one, taking per generation, but there was timing attack who were used to recover crypto keys. There was many of them. There was an AS-1 a very long time ago used by, I believe it was Dampenstein on remote AS. There was one on catch line attacks on CPUs. There are so many of them everywhere. Session attack are so powerful. The most powerful form of S-Qualjection is blind-sphere injection, where you, sorry, Session attack, blind-sphere injection is when you have a S-Qualjection, but you consider the output then you trigger. You do it one character at a time and you just look at the server which one or not. That's the form of Session attack. There are everywhere. It's not, it's a super, super practical attack and usually people are really annoyed and say it's not a real attack because it's a non-technique. It's not a non-technique. It's a non-technique. It just happens that it works super, super efficient on many, many things. Yep, that is, and you have it on off-off-sphere, so like physical stuff like electronic locks and things like that. Oh, I forgot. One night I said I need to have something more. I thought that was the most important one. I'm sorry. I'm so sorry. Spectre and Meldon. Right, Spectre and Meldon. There you go. The thing which completely destroys your CPU. There are a form of Session attack. So here you go. As I said, some of the most powerful attack, concrete attack we saw in the last few years, our Session attack because they are so hard to do, but I said so hard to pull off, to defend the game. That's, yeah. Yeah, I think I read something about those. They were kind of big, right? Yeah, I think it's a chassis. I think it's a chassis. I suppose there's a wire that's you can like outline that. It would be good to just read up if you get that interesting. I think it's a Chouette. Gotta go. Thank you. Yep. Yeah, so we got a couple of minutes left. If we have any more questions, let's get them in here. Otherwise, we're gonna thank Ellie and let you guys get back to the con. So. Yeah, one last one for me. So folks, oh wait, we actually do have one more. Yeah, so someone who's mainly folks in Infosec, you know, what kind of background do you think people, you know, kind of lend themselves to going towards looking at side channel attacks and thinking about what kind of the research you're doing with all of the, you know, being able to detect that in different ways? What's in the background? It's nice, it's very nice. We have some people who come from radio, you know, like the first initial, for those who don't know the first initial size and attack was actually in the 1940s or something like that where they had that writer and the guy was having an oscilloscope and then he still bliped on the oscilloscope and realized that there was something and then the Russian put a user to spy on two people by looking at vibration. So that's super old stuff. So that's the radio guys. The radio guys know a lot about those electromagnetic things and spy crowds there. So those spy crowds come from that. We have people who do size channel attacks who come from hardware, hardware people, you know, who like to do CPU and look into Meldon specters, catch lines. So those guys also do such an attack in a different way. And we have cryptographers, you know, people who are more like a former crypto background like me who are more into that. So it's really depend on your user. And you have people who do web security with like, yeah, so then timing attack and such an attack means more expert injection. So I think everyone kind of like touch it by the band. It's fairly easy to get into it. I think there is this kind of like apprehension. Sometimes I, one of the first time I read a paper about it, I couldn't get the best paper to read as an intro. It felt like it's very bizarre to me. And I didn't really understand what it was going for. And I was like a little bit like, it's like, I don't know, like three to four months you can kind of like get used to it. Well, how is my side of it? I think it's a very powerful mindset. I think it's a very fun experience to do. If you're interested in such an attack, specifically on hardware, and you want to start without machine learning, you know, like more simple stuff like that, this is called cheap whisper, which is a thing that is like very affordable and even if you don't need the whole thing, you can just run out of, it gets interesting, has super cool tutorial. I think coding from cheap whisper has put a tremendous amount of Jupiter, Python code. You can get to it, you can play with it, understand how it works, and you're going to break, recover an ASP. And then you'll be super happy. You know, you have this super intense satisfaction that you go to work, not necessarily understand everything, but it's going to start to make sense of. As I said, it's for everyone who is interested in kind of like testing one way or another and all have fun. And you know, like you want to break into a lock. Maybe there's a timing attack. There wasn't super petitions that some of the, you know, like super high security locks, you know, the caban, one where you have rotation and things might have timing attack. There are super, there's maybe there, there are, I said, almost all aspects. So yeah, for me it's for everyone. I said. I just, I love that you went to radio first and then like math and crypt came later. So that's good, right? It's not a deep mathematical background, right? To be clear, it's like, it's literally observing a signal and say, if I do A signal look like this, if I do B signal look like this, and if I can see differences, then I can construct something. And of course you can do more and more complicated stuff to do more high processors. And then that becomes complicated at some point. But the basic stuff is really like, I look at something, it's a very experimental, very hacking thing. It's thought to work. That's really what I was saying. It's thought to work. For people who like to tinker with stuff.  That's the best way. If you are a different person, you are the right audience for the solution attack because it's all about doing. And then math is here to help you and maybe to push it further, but that's not the core of it. The core of it is matter, things. Like the world is made of stuff which do not be as the way people want. And have it as a secret hidden property you like to uncover. That's what session attack is. I hope I said it and I get you excited to try it. I hope so. No, great. Well, so we're at the top of the hour and we appreciate the generosity with your time and answering these questions. And pretty excited to look at the follow-on work coming out of this. And thank you for everything you've done. And we'll see you next year, right? Yeah, yeah, so next year. I hope actually next year is this year talk. So I'm not going to tell you what is the surprise, but as I said, I post on Twitter when the GitHub is up. So I'm at Eli, on Twitter, and then if you want to put it up, just write that on mine as well, as I said in the talk. I post it on the chat if I can't post it in Christ. I'm going to get back. No, no, you can and I just did. So good. Okay, perfect. There's our and then I promise I put the code as early as I can so you get kind of it. And thank you so much for watching the talk. Hopefully next year we all in person. And as usual, I'm always happy to answer any questions, just if you're with the DM or on this call, whatever you guys want. And I try to my best to answer the question. Thank you so much, guys. I hope you have a nice death call. And there's a lot of other cool talk to watch. I'm super excited personally to watch a few more. So thank you so much.


Testing one, two, there we go. OK. Well, welcome back, everybody. Hopefully, you all are refreshed and snacked and ready for the final push. I'm Brian Bellendorf. I'll be your emcee for this kind of closing session. We'll have some closing comments from Crowb later. We're going to do this in two parts. The first is I'm going to have a fireside chat with Jamie Thomas here from IBM. And then after that, we'll have a panel with a set of really great guests. But I certainly encourage all of you who are sitting out in the bleachers and the far off kind of corners. Feel free to come in closer. We don't bite. And being closer in, we don't have stuff to present or anything like that. Feel free to come in and make it feel like we're talking to a nice full room. Thank you all for sticking it out. So it is my pleasure to introduce to you Jamie Thomas. Jamie is the chair of the Open SSF Governing Board. She also oversees all of enterprise security for IBM. And she has been a part of this project since we pressed the reboot button in September, sorry, and got things underway. And I thought it'd be really fun to help the audience get to know more both about you and your work at IBM and kind of the interests that led you to this point. And frankly, the corporate world, so to speak, thinks about what we're doing and to what we should be doing as we go through this. So thank you for being here. I'm glad to be here. Great. So let's start by giving to know you better. Could you share more about kind of your journey inside IBM to the role that you have or tell us more about the role and kind of what led you to this moment in time? Yeah, sure. And one of my favorite topics, of course, is women and STEM, which we all know there's not enough of. So thanks to all of you that are here. But I try to encourage ladies that there's a lot of opportunity in this field, and it's really fascinating. But I joined as a computer science programmer in IBM before we had really we were just starting our software business and ended up being a $20 billion business in the end. You know, it grew a little bit. And along the way, I worked on application development projects, was part of the Eclipse decision to donate the original software to the Eclipse Foundation and start the Eclipse Foundation. I did a lot of work with our support of Linux in the early days when we decided fundamentally that we would embrace Linux, that we would support Linux as a key operating system. And obviously, those were the days where we were also embracing Java quite a bit. So Java is a key middleware component, if you will, for our middleware business. And I spent most of my career in software. Then somehow I got asked to go by our current CEO now. He's the CEO of IBM to go to the hardware division and stimulate software in hardware. Of course, hardware does not run without software last time we checked. And we were working on OpenStack technologies, Linux, again, a lot of the software-defined technologies. And through that path, I ended up owning, which is what I own today. And in addition to enterprise security, all of the IBM processor development and the systems development that support our high-end systems, Z-Power and quantum computing systems, in addition to my night job as enterprise security if things were not exciting enough. But those topics all kind of fit together if you think about it. Yeah, I mean, certainly quantum and AI and even processors, there are security ramifications throughout all of that. What would you say, though, is kind of different about cybersecurity in 2022, compared to five years ago, 10 years ago, and especially kind of in the domain that we're focused on? Well, I would say, first of all, and in my journey to get into enterprise security was really through the lens of product security. Whether that was software product security or hardware product security, if any of you are here from hardware background, Spectre Meltdown was pretty exciting. And that was also the precursor to, you know, the software supply chain attacks, like solar winds and things like that. And I think what's different now is that you do have to have, for an enterprise like IBM, you do have to have an effective melding of cyber operations with product security. I mean, they go hand in hand given the role that we play. They're both very important. And the level of sophistication of these software supply chain attacks, I think, was eye-opening. I'm sure that many of you all here, and first of all, thanks for being here and devoting yourselves to software security, because without you we're not gonna make a difference. But solar winds was fairly interesting from a number of dimensions, right? We've studied it, you know, we took it apart. We've got a PhD in solar winds. And I would say that we took away a lot of learnings from that that we started to implement even before Log4j hit. And Log4j was just more prevalent, right? Because it was a very prevalently used component. And therefore it affected, not only was it a cyber attack, right? Because for any of those of you that do cyber operations, you can see, at some point early on, we had instrumented, like day one, our tools to detect Log4j attacks. And we could see exactly how many we were getting every day and from where they were coming, literally. You know, which country of origin, that kind of thing. But these were very different attacks. And of course, Log4j was very prevalent in the software stack. And so patching that much software in a reasonable amount of time and meeting the expectations of all the customers, fairly challenging. So I think that then became a catalyst for all of us, though, in the industry to say, how do we be more proactive about this? How do we help open source, prevent these kind of things in the future? But more importantly, be prepared should they happen again in the future, right? Because Log4j, I don't know about you all, but it took up a little bit of our holiday season as did SolarWinds the previous year. So, yeah. And what about the degree of interest that we're seeing from government in cybersecurity topics these days and open source cybersecurity? Is this new and different? Or have they kind of always been paying attention? Thanks for bringing that up. Of course, it is new. I mean, the government's always been interested, but I would say the level of interest, of course, was heightened. Because I think it really started to heighten with SolarWinds and then Log4j was like the icing on the cake, right? And what it said is that we as an industry need to cooperate more fully to conquer this challenge. Without that cross industry collaboration, we weren't going to make as much progress and that included cooperation with the government as well. And so I think that's been the beauty of OpenSSF is we now have this industry collaborative for technology organizations as well as commercial organizations. We have a lot of financial firms that are also involved in the community. And I think that's gonna allow us to work with the government. And, of course, we had the two meetings that you highlighted earlier in the presentation. We've come out of those meetings, I think, with some very concrete actions that we can take. We also can see that other countries around the world will also want to do similar things. And we in IBM are being asked to participate on other government boards of a similar nature in other countries. Yeah, no, I mean, so in 2009, when I worked at the White House in the Office of Science and Tech Policy, I don't think there was anybody else in the executive branch, either a pointee or a career who had been a developer or who had engaged with the open source community previously. And to them, software was like something other people did, right? Something that the private sector did. You write an RFP and then you get responses. And there was kind of an arms length, kind of almost willful ignorance about software in general, but open source in particular. Now, in 2022, that seems very different. I mean, we have people like Alan, who's... Alan, too. Is one of many people that I've met in the last year who kind of demonstrate the difference in this. I've just before our meeting as well in the 12th, on the 11th, I testified to this House panel, the House Committee on Science and Technology who are also looking into this. It's not just the White House and executive branch. And to find that there were Congress people who were themselves programmers or who knew, had like operational experience with AI programming and the like, was pretty refreshing. And you could tell because their followup questions were knowledgeable. There wasn't just that they were well prepped by their staff, it was. Although one was still surprised when I mentioned I'd rather use open source code that had had bugs discovered in it. And fixed, of course, right? Because it was, I think it was a Congressman Pearlmutter who said, you'd rather use software that had bugs in it. And I was like, bugs that had been found in fixes, that means people cared about it, right? That means there's contributors. There's contributors, but there's also people scrutinizing it. So... I think it's great that there's been this dialogue, right? And understanding and a lot of really solid collaboration from the National Security Council, CISA, the NIST folks that have been in the meetings. I think that as a community, we all have our different points of view. IBM's a little bit unique in that we have lived for 111 years in the technology industry, which is hard to do. And so we have a lot of legacy out there, which others may not have, that gives us a different point of view from that aspect. But there's a number of technology companies and they bring their strengths, their skills, their point of view of the table, likewise the commercial clients. And I think that's what makes it unique. It's been a unique dialogue. Yeah. Well, I think also we've progressed from open source being seen as like the thing to build websites with and do this kind of almost, I don't wanna say frivolous, but something that was optional, perhaps until recently, right? And now is really about critical infrastructure. If it's about the software running in grids and power stations and the like. Absolutely, open source is more than critical. I think we've all taken, we've all made it critical. And the folks in this room have made it successful, made it critical and we're all dependent on it. So given how critical it is now, and given David's presentation on cybersecurity education, I mean, this is something that you see as a very, very serious thing worthy of investment. Do you mind talking some more about that? Well, absolutely. So we believe, and just this morning I got a report. Every day I get a multi-page cybersecurity report in terms of just what happened in the last week. And that's along with regular cyber reports of the day. And of course, sadly, the Russia report that I get. But 750,000 open cyber jobs in the United States, cybersecurity jobs. So how are we ever going to start to meet the need of that if we don't really expand the aperture of education? So IBM has done a number of things to reach out to different communities, right? That includes the historically black colleges and universities. We've selected 20 and we've announced six so far that we're creating specialized portals for cyber education. And we'd really like to partner with the Linux Foundation for some of the education that David spoke about, right? It's really exciting. How do we get that into that community, into that university and college sector? So the one that I like the most, of course, because I'm from North Carolina, is North Carolina A&T. But there's Southern University, Xavier out of Louisiana, Morgan State, Clark Atlanta University, a number of others that are participating. And I think this is important. We also have a program to reach veterans. There's 250,000 individuals that come out of the armed forces. So how do we work with veterans affairs to reach that community? And then how do we reach those with neurodiversity? All of us have relatives or friends that have neurodiversity challenges, dyslexia, or perhaps autism and other things. Very important to expand. And I've got members on my team that are neurodiversity folks that are executives and have done amazing things. So I really feel excited about that. And so I think we have to expand the reach. I have so many organizations that come to IBM and they say we can't hire a single person. We cannot afford to hire anyone with security skills. So we don't even know where to go. We don't even know where to start. There's an opportunity for all of us to create those skills and to leverage the education you all are doing. In fact, we saw your announcement already today. We wanna leverage that education for IBM internal to compliment our cyber training. So we track cyber training to the death. We are trying to make sure that people don't do those silly things that David talked about. That's why you have automated tools, cyber tools that detect the crazy behavior that does happen every day. Because you can't train everybody, but you try to, right? But along with that, this developer training, I think, is gonna be really important for going forward. The other thing we really feel is that contribution to open source is something we have to do. We have over 5,000 contributors between what IBM has and what Red Hat has, because Red Hat is an IBM company, albeit they're separate. And we also believe that log4j, we went back and we looked at our most utilized open source projects. And we did an assessment of contributors on those projects. And we realized we had to contribute to the most utilized projects, as well as to the cool projects, the new projects that everybody flocks to, right? And so we are balancing our contribution and we're rewarding people who go and contribute to those projects with monetary recognition. That's great, that's great. So you're chair of the Openness of Governing Board. And for those of you who don't know how the typical Linux Foundation governance model works, obviously all the actual substance of what we do is built in the public, built voluntarily, sometimes we're able to provide some seed funding for things here to help get them started. But really we want the application of things happening publicly and being driven bottoms up organically based on the phrase from the West Wing television show, so history is made by those who show up, has always been one of my guiding lights. But what the Governing Board does is oversee a budget, right? We're able to raise some funds, we're now at enough membership to be able to afford some staff, be able to make some investments and things. And it's through that kind of oversight on the budget and us as staff, you could tell us we're not doing a good job and swap us out, that you have some influence over the strategy and direction for the overall community. But it's really to help support the community. And we have on our Governing Board, I don't want to say, it's not every large company, but it's a lot of the large companies that matter in the software, the developer tools space, increasingly financial services firms and the like. As your servant, I work for you, right? I have opinions that I might hold to myself, but it sometimes feels like helping that group come to an agreement can be a challenge, right? Or look at kind of common direction. So as chair, what are some thoughts that you have on bringing that community around a common vision and working together towards supporting the community? Well, I think whenever you have a group of stakeholders like that, it will be impossible to agree on everything, right? But what I have seen is relative agreement on these top priority items. I thought the meeting that we had in DC helped me understand why some of them were more important to others than they were to me. So I took away that level of understanding. Well, I might not care about this, but others in the room did, right? And I think what we're doing is participating in those that we think we can have the most impact to. And frankly, it's like every other large firm, there's a lot of things that are pulling on people's time. So Jeff Borek, who's here from my team, I actually meet with the team since SolarWinds, I meet every week with the team on software supply chain actions. Because for a company as large as we are, there's something to talk about every week. And the importance to us is making sure we've got participation in these work groups and we're really at the table that we're gonna help the work group and we're gonna help ourselves, right? Because that's how we get the execution done. And I would say before this new governing body, we probably weren't, you know, we were perhaps not as at the table as much as we needed to be. We also, of course, collaborate with Red Hat, who are very involved in six store and things like that to make sure we're dividing conquer as it makes appropriate, right? Makes sense. But I think that that's the value that we can get together as this community. We, you've talked in this meeting about a lot of the important actions, right? Which is the automation of best practices for the open source projects to make sure the developers can take advantage and be responsible for security, but also have productivity. Because we keenly recognize the productivity that open source has brought to the world. But how do we do that and we still have security? The only good thing that came out of Log4J is an enormous amount of awareness of how important security is to everybody. My team that does cybersecurity, they believe that fundamentally until there's a big incident, you just don't get enough attention. So they believe that Log4J was the calling card, right? That said, we have to do something dramatically different as a community. And I think it's been a catalyst, perhaps an unfortunate catalyst, but a catalyst. And I think we can go from there and take advantage of that, the situation and improve things going forward. It's gonna be so important to us because the world runs on software. It's sometimes obscure what software you're running underneath the hood. I agree that the end client should not have to worry about that. Those of us that provide the software to them and support it, it's our obligation to take the burden of security and making sure that the software is designed with security in mind. And you can do different things, you can implement the things we've talked about, you can consume open source that you know has been managed well and curated. And obviously you can implement things in your product lines that support security. Well, one thing that's been really heartening for me to see has been the participation from the financial services industry in OpenSSF, not just showing up and joining as a member, but also making code contributions and participating strategically. We'll talk a little bit about this on the next panel. But what are some other industries? This is kind of a wild card, sorry, I didn't like prep you on this. What are some other industries? And I'll give you the two in my mind after I hear yours, but are there other industries that you think might be next in line as kind of end user industries as folks who should be paying attention to these issues, potentially having their staffs get involved and following what we're doing and perhaps even contributing? Well, clearly I'm really glad that the financial services teams are engaged because during log for Jay, I think I spent five hours a day talking with financial services organizations. Right. Literally, it was because regulated industries are typically the most concerned about these things. But that's a statement in and of itself. Why do you have to be regulated to necessarily be worried about this? But next I would say on the list was healthcare. So healthcare organizations through my lens, the most affected organizations around the world typically are hospitals for ransomware. And you saw this a lot during COVID-19 where a lot of healthcare organizations were being attacked, right? So healthcare insurers of healthcare, another big important area for us. And then the area that is most of a target that needs to step up to the plate probably more fully are those that are running embedded systems, whether those are in manufacturing or critical infrastructure like our grids and things like that. And that's where you have to take extra precautions because I own manufacturing because I own hardware. And so what you find in manufacturing environments are these hardened devices that have very old software in them. And when you have a case like that, when it's inside this $200,000, whatever it is, right? You have to take different steps and protocols to make sure you protect yourself until that is upgraded, right? You're not gonna just throw out equipment of that value tomorrow, but it is really critical, I think, that those organizations step up to the plate, right? Yeah, consumer electronics, embedded industrial, all those makes a ton of sense. The only other industry in my mind was the insurance industry, because all those companies that write in cybersecurity breach insurance policies, getting them to nudge their clients to use more secure alternatives and the like could be a way to help encourage investment in the right kind of thing. Well, certainly they started to increase the premiums, right? Because I think it was the pipeline, with the colonial pipeline situation. And I'm in North Carolina and all I can say is my cyber team sent me a note that day, pipelines have been attacked, we all went out and got gasoline. Now, people said, well, you're part of the problem. You went and got gas when you didn't need it. I said, well, I was here for the last hurricane that shut down that pipeline and I sat in line for seven hours. I don't have the time to do that right now. So this pipeline is gonna be down for seven days and I've got my gas and I made my choice, but that's how long it was down, right? Because that's the average length of time that those typically take. That's an example of one of those situations, right? That was very critical. My last question will be, what or do you think is the most important thing for us as a community to figure out how to do by the end of this year, to get accomplished, even if it's something we haven't yet talked about, even if it's kind of a wild card, just like one important thing for us to get out there and succeed at doing. Well, I don't know if it's gonna, I don't know if we could say that one thing is going to make or break the year, but certainly making a lot of headway in the education aspect because we're not gonna do this without thousands of developers who feel that they're being recognized and that security is important and that it's fun to be a part of security, right? I actually, in a strange way, have a lot of fun with cyber attacks. I mean, that probably is something odd, but you learn a lot from these things, right? And I think that's really imperative that we marshal the army of thousands of contributors that can make a difference and then that army will help us do many of the other things that we've been speaking about today. Well, my dad was a cobalt programmer at IBM when I was growing up and he would take me into the computer lab in the basement at Glendale's office and he would give me a green screen, a terminal to it. I don't know what he was thinking because I knew how to write basic and there was this one address I could poke and cause him to have to come out of his office and press reboot buttons on the mainframe. So I understand that... Reboots aren't good on the mainframe. That's not a good thing. No, no they're not. So I understand that why this kind of vulnerability thing and cyber texting could be a little bit interesting. It certainly was to eight year old me. So thank you very much, Jamie. This was a really enlightening talk. Thank you and thanks again to all of you that are here and taking your time for this important topic. Thanks and thanks Brian for everything you're doing. Great, thank you. Thank you. Thank you. I can never tell if he was doing this or this.


Hello everyone this is Ahmed Dan of AhmedDan.com. Today I'll have another episode of double-edge razor video and I'll be opening and reviewing q-save razor. If this is your first time or if you visit thank you for your support on this channel. I'm always trying new and different ideas. If you're into thinking outside the box you may want to subscribe this channel. If you're looking for more men's grooming videos there'll be links in the description box below. So this is q-save men's short handle classic double-edge lighter travel razor that's the full name of it and this is a short handle only a three and a half inch or nine centimeter and I wanted to review a q-save product so this is my first q-save razor and I'm hoping to review more in the future. So this is a very inexpensive razor it's only $13 Canadian so basically you cannot go wrong buying this razor. So this is going to be a two-part review. The first part I'm just going to you know do the unboxing and we'll take a look at the razor and the second part is going to be I'll actually shave with the razor and then which I'll attach it to the video. So the box came like this this is made of paper but it looks very nice and fancy and we have just some like you know time to enjoy shaving and q-save. Not much information about the razor so let's take out of the box and see what we have here. So this is how it looks and looks like they included a brochure or instruction guide. Let me just take a look here and then I see that there's actually a some blades here I'll just leave it here for now and then here we have the actual razor so just take it out and there's nothing else inside the box is empty actually I'm sorry there's something else here so they included a brush to clean the razor which is very nice I'll just leave this here so that's all and the box is empty so I'll just leave it here so here we have just you know looks like this is actually their instructions on how to use razor and then there's more products showcasing on this flap or piece of paper so it looks like they have shaving bowl shaving brush and other types of razor and I'd like to purchase some more in the future so I'll just you know put it in here and here they included some blades and let me see how many in here I'm expecting more than one but we'll take a look okay so it looks like you know five pieces which is actually very good I didn't expect them to give five pieces of blades so that's a nice thing so I'll just put it here and then here we have the brush and here we have the razor so as you can see that you know this is a very short handle razor and let me just detach it so this is a three-piece razor so you have all three pieces separate and this is the top and this is the middle portion and this is the handle so that thing one thing I can tell you right away that you know these two pieces are very light so I think that's where they're cutting the cost almost it has no weight this one has slight weight so once you attach them then this is a closed comb razor and looks like there's not going to be too much blade exposure so once we put the blade we'll see you know how it looks and next part of the video is going to be you know I'm going to put a blade in the razor and then you know I'll shave in the in my washroom hello everyone so I'm going to start shaving with the Q shape double-edged safety razor this is the short handle and I'm going to put the blade in so the first thing I'm seeing about the blade that this is the q-shaped blade and they even didn't bother to put any you know branding on the actual blade and it kind of looks cheap so you know we're going to see how it is so I'll just put the blade in here so this is a three-piece razor you have to be very careful when you install blade so just put it in here and put it like this and put it like this okay so this is the razor after putting the blade so the first thing it looks like to me that this is going to be an aggressive razor I see a lot of blade exposure so you can see that you know the blade is kind of kind of like you know coming out a lot and I try to tightening up but it still looks like there's a good level of exposure so let's see how it goes and I'm going to you know with my face and then we'll start applying the shaving cream so today I'm going to be using the porasto you know shave cream and I have my omega s brush no animal synthetic and I'll just you know apply some shaving cream on the bowl and we'll just you know start lathering up so this is my cheap IKEA shaving bowl I have a review of this on this channel and you can see that you know it generates very good leather so it looks like the amount of water and the cream is just you know in compliance so it's giving a very nice leather so I'll just put the you know lather on face plastic barbershop smell so double it shaving is when you actually can take your time and enjoy a little bit of solitude because you cannot rush into it you have to enjoy the every moment I have generous amount of leather so just leave it here I'll just wipe my face just you know wipe little bit of here and I'll just remove some from here for the visibility but that's some leather going inside my nose so let me just clear that up so that should be good enough so I'm just going to you know wash the wash the razor a little bit and so far looks good so and we'll start shaving from this side so definitely not the mild razor I'm very careful first a little bit aggressive but we'll see I'm hoping not to have any you know cuts and nicks but let's see how far we can go they provided five blades I can tell that it's not gliding smoothly so let's try this part here and wash the razor a little bit I have slight cut here but it's still not bad okay I think I want to apply just you know a little bit leather here you know let's try this part above lips okay so I'm not gonna do a second pass with this so what happens this is I feel very aggressive razor and I was able to not cut anywhere just slightly a little bit cut here but you know definitely I do not recommend this to anyone starting out with the safety double-edged razor and even if you're you know a pro in shaving you have to be very careful it's not it doesn't glide as smoothly and the blade is also seems to be very you know low quality this is a very you know a cheap razor only $13 Canadian but I do have other cheap razors review on this channel but I have a feeling that this is this has to be you know one of the worst ones I feel that you know this is really rough and not balanced so you got to be careful and if you're new definitely not recommended before buying this as planning I was planning to get more razors by Q-shape they have other razors but you know I'm gonna have to say that you know I changed my mind after shaving with this definitely I'm not gonna most likely I'm not gonna try any other of their products but you know maybe in the future I'll but as of now you know this is my opinion that you know I'm not gonna try anything by Q-shape and even they didn't bother to put any like you know branding on the actual blade which I showed you before so overall it was not a good experience and definitely I'm not happy with the product but you know I was kind of lucky that I didn't cut myself a lot but definitely you know the feeling was there that I was going to cut myself any moment so that was the review and this is not a paid or affiliated review all my reviews are non-affiliated and best and honest thank you for watching this video there will be more videos coming up so I'll see you shortly thank you


Mae gwaith i ddweud ymwyngoedd ymwneud ymwneud yr ystudydd 6177 i gyr directlyio George Adam i saith'r Rhyf ymwyngoedd yma o'r Cysyllty Ffwrddolau Llywodraeth Llywodraethu o'r myddol ymhyngor. Gwaith ymwyngor ymwneud ymwyngoedd Ieithfawr Mrymysigol, wrth i'r ryfyn ymddynt â'r syniadau yn gweithio. Rwyf i ei Liangllianniad o'r cyhoedd hynny â'r cyhoedd a'r amwyngor. I move the motion just to say a few words initially with regards to this bill itself. Presiding Officer, it is imperative that this legislation is treated as urgently so that it can ensure that the important protections are in place for people who rent their home before cost rises impact their finances by the end of October this year. We are dealing with a difficult issue as things have moved on, and it's important that this place actually does something to support those in our communities that need that support. I would like to leave it at that stage at this stage, Presiding Officer, and propose that we take this as the emergency legislation. I move that we do not support the suspension of standing orders. The Scottish Government has insisted on enforcing an emergency legislation timetable with regard to the cost of living tenant protection Scotland bill. This has now meant that MSPs only saw the content of the bill late last night, leaving little time ahead of the committee meeting this morning and before being expected to debate and also vote on the general principles today. Prior to the introduction of Covid-19 emergency legislation, consultation was indeed undertaken with sectors that will be directly impacted. That has now not been the case in relation to this bill. The Scottish housing market is complex and unintended consequences are going to be clear from this bill. The decision by SNP Green Ministers has been made without any consultation with the sector representative bodies and has resulted in much frantic activity since the announcement was made by the First Minister to assess the negative impacts of the bill. I hope that Parliament will consider that we need an opportunity to properly look at this bill and look at the impact. The process that this bill has been introduced to Parliament under is unacceptable and flawed, and it has looked to bypass any in-depth scrutiny that Parliament can provide and organisations and businesses that will be impacted are highlighting to us all. I therefore ask members and ministers if they will provide the opportunity for MSPs to have the same opportunity as the emergency Covid legislation to look at this bill in more in-depth detail. I urge members today to vote against the suspension of standing orders. As I said earlier, it is imperative that we have this legislation. It is treated as urgently because of the impacts that people's finances could have at the end of October 2022. I find what Mr Briggs has stated is the fact that we cannot win in this scenario. Last week, one of his colleagues accused us of sharing the bill with the sector, and now they are saying that we are not actually talking to anyone whatsoever. We cannot have it both ways. I find it quite strange that they would use that tactic. Call me a cynic, Presiding Officer, but I do not believe that they believe in the legislation to start with, and I think that that is the fundamental difference between us. As I can go on to some of the detail here, as households in the rented sector, especially those in lower incomes—no, I think that you should listen about people in lower incomes, Mr Simpson—generally pay more for their income on housing costs than owner occupiers. They have higher rates of income poverty and child poverty. Economic analysis suggests that additional measures are necessary to protect renters. The measures in the bill are intended to offer protection to tenants in recognition of the particular issues that will affect people who rent their homes as a result of the cost of living crisis, incidentally created by the Tory Government. Given the urgency of the situation, we consider the provision that needs to come into force before winter, given the rise in fuel costs and the significant impact that we will have on households in rented sectors. Our announcement, one month ahead of bringing emergency measures to Parliament, ensures that our intentions are well known and allowing time for people to adjust their behaviour. The proposed changes are needed urgently, Presiding Officer, to ensure that we protect tenants from the disproportionate wealth and financial stress that the cost of living crisis has put on them. Any delay could have a terrible impact on our communities, and that would be devastating for the many households throughout Scotland. The point of order for you is the chair. Whether or not the Scottish Parliament has provided all members across the Parliament that this legislation is indeed ECHR protocol 1, article 1 compliant, and also there are rumours that there is likely to now face a legal challenge because of this legislation. So I wondered if the Scottish Government, given that we have previously also seen poor legislation face a legal challenge, where ministers have let Parliament know on that as well? Thank you, Mr Briggs. I can confirm that I have published my statement to the effect that the bill is within the legislative competence of this Parliament. I was just wondering if it would be possible to check to see if everyone can get on to blue jeans, because I am getting notification from some of our team that they are not able to get on. Thank you, Ms Dunbar. I will confirm that that is indeed the case. The question is that motion 6177, in the name of George Adam, on the cost of living 10 in protection Scotland bill, emergency bill be agreed, are we all agreed? The Parliament is not agreed, therefore we will move to vote and there will be a short suspension to allow members to access the digital voting system. The question is that motion 6177, in the name of George Adam, on the cost of living 10 in protection Scotland bill, emergency bill be agreed, and members should cast their votes now. The vote is closed. Point of order, Jenny Gilruth. I can connect to the platform and I would have voted yes. Thank you. We will ensure that it is recorded. The result of the vote on motion 6177, in the name of George Adam, is yes, 86, no, 28. There were no abstentions. The motion is therefore agreed. The next item of business is topical questions in order to get in as many members as possible. Short answer sink questions and responses would be appreciated. At question number one, I will allow a moment.


12-year-old girl died in go-kart crash, investigation underway after shooting in Dodge County, a new visitor center planned for Sheboygan. These stories and more coming up on Community News Review. This is Community News Review, service WSES-TV News Contact, divided by WHVL. Hello, I'm Maddie Fister and this is Community News Review for Monday, October 29th, 2018. A go-kart crash on Saturday has killed a 12-year-old girl. She has been identified as Madison Plugger of Spencer. The accident happened on private land in Marionette County in the town of Grover, and Sheriff Jerry Sov says the victim was visiting her grandmother and other family members. An accident report says the go-kart crashed into a parked pickup truck around 3 o'clock p.m., and Plugger was taken to a hospital in Oconto and died from internal injuries. The crash is still under investigation. Madison is charged with breaking into the home of a missing 13-year-old girl and stealing articles of her clothing. Kyle Janky, 32, is charged with burglary and bail jumping. On the morning of October 27th, he is accused of entering the Kloss family home in Barron, going into the room of Jamie Kloss and stealing underwear, a tank top, and a dress. He was seen on a motion-activated trail camera on the property, and police say that he was questioned later that day and confessed. Stolen items were found in his possession, and he had been released from jail just three months ago in another burglary case. Janky is charged with burglary and bail jumping, and bond was set at $5,000. Janky worked at the Jenny O. Turkey store, where Jamie's murdered parents also worked, and they did not know each other. Sheriff Chris Fitzgerald says Janky is not a suspect in the homicides or the disappearance, and the burglary happened 12 days after. Eight sex offenders on the community supervision are accused of violating Halloween-specific restrictions. Sex offenders are not allowed to hand out candy, dress in costumes, put out decorations, or interact with children during Halloween-trigger-treating. In many cases, their terms of release call for them to remain indoors with their lights off for Halloween. The Wisconsin Department of Correction says 200 random home visits were done over the weekend during trigger-treating times. There are more than 5,600 registered sex offenders in Milwaukee area, and a similar check last year led to 12 arrests. Authorities are identifying a man shot to death inside of a State Street parking ramp. 21-year-old Steven Villegas was shot to death early Sunday morning, just as the annual Halloween celebration Freak Fest was ending. He was not a UW student. No one is in custody, and the motive is still unclear, although police believe the shooting and the victim had some earlier interaction with each other. Police say that the shot was fired around 2 o'clock a.m. at the State Street Campus Garage on North Francis Street, and Villegas was shot in the chest and died while being transported to the hospital. Surveillance camera footage is being reviewed to help identify the suspect, and police say that the suspect would have been inside the parking ramp, and they're hoping someone comes forward with a tip that leads to an arrest. Anyone with information should call<PHONE_NUMBER>. In Beaver Dam, an investigation is underway after an officer involved shooting wounded a man Friday night. Police were called to a domestic disturbance and reacted to a situation involving a firearm. A 35-year-old man was shot in the lower part of his body and then taken to the hospital with non-life-threatening injuries. A police officer who has been with the police department for 17 years has been placed on administrative leave. And finally, Visit Sheboygan Inc., the tourism entity for the Sheboygan Area Tourist Zone and Windway Captain Corporation are set to begin a development project for a new visitor center and office complex on South 8th Street. Plans include exhibits and retail space in the visitor center as well as a future freshwater exhibit on the Sheboygan River. The complex also includes new office space for Visit Sheboygan Inc. and the Windway Captain Corporation. Groundbreaking for this development is expected by the end of the year with completion of the project for fall of 2019. The new visitor center will house a viewing area for a new Lake Michigan shipwreck documentary to be produced over the next year as well as an NOAA Design Science on a Sphere or SOS exhibit. And the sphere will be the focal centerpiece of the visitor center's storefront. Passerby will have a view of the six-foot suspended globe which will glow through the main window on South 8th Street, explained Chad Pellcheck. Director of Planning for the City of Sheboygan and Chairman of the Visit Sheboygan Board of Directors. The SOS exhibit is a spherical screen that protects data online and sets transforming it into an animated planet. SOS has the capability to visually display hundreds of sets of data including seismatic activity across the planet, platonic shift over time, the shrinking of rainforests, population mass across the globe, wind and weather patterns that cover the Earth, ocean currents, the asteroid belts and solar system and hundreds of other information and entertaining Earth and space programs. As part of the visitor center project Visit Sheboygan also plans to install a science on the barge in 2019 to be open by fall of 2020. The science on the barge is a self-contained ecosystem of the Lake Michigan land and waterscape built on a floating barge permanently docked on the Sheboygan River next to the visitor center. Patrons will have the opportunity to participate in hands-on STEM projects and programs and tour the barge which will include fresh water, aquaponics and plant life. The visitor center will also house learning space for other interactive programs in partnership with the Sailing Education Association of Sheboygan or SEAS, including sailing educational and practical skills such as navigation and knot tying. It certainly makes visiting the area a more interesting place to experience while promoting waterfront activity and engagement. Visit Sheboygan Inc. the official tourism entity for the Sheboygan Area Tourism Zone, including the city of Sheboygan, the town of Sheboygan and the town of Wilson, is funded by a room tax dollars collected from overnight visits to lodging facilities located within the zone. Currently the zone economy captures an estimated 40% of the county's 223,700,000 annual visitor spending. And that is our report for Monday. Join me again on Wednesday for another recap of our local news and information on Community News Review. .