Good morning, and welcome to the third meeting of 2022 of the Equalities, Human Rights and Civil Justice Committee. We have no apologies for this morning's meeting. Our first agenda item is to follow up session on budget scrutiny, and I refer members to papers 1 and 2, and I welcome our witnesses. Emma Cosgrove, Knowledge Exchange Fellow at the Fraser of Allander Institute. Dr Angela O'Hagan, Chair of the Scottish Government Equality Budget Advisory Group, and Chris Bart, Associate Director for Scotland of the Joseph Rowntree Foundation. Thank you all for agreeing to give evidence today, and you're all very, very welcome to today's meeting. Please remind witnesses that, if they wish to come in on any question, just to indicate that by typing R in the chat box, and I'll bring you in if time is available. First of all, I invite each of our witnesses to make a short opening statement, starting with Emma Cosgrove, please. Good morning. Just to correct the record, it's Emma Congreave, rather than Cosgrove. It's a common mistake. I apologise, and I can actually see that. Good morning. Thanks for inviting me back today. For just a couple of points, I'll keep it very short. Since we last spoke, we've had the next iteration of the Scottish budget. In terms of looking at some of the issues that that budget raises of the Interest and Committee, I would say that we are still seeing progress being made in terms of the attention of policy makers and analysts looking at budget spend and looking at where those budget spend should or could have an impact on those with protected characteristics and income inequality. I think that we are further along than we were a few years ago, where it could be quite difficult to even find numbers related to budget spend that could link the statements and the equality budget statements. We definitely welcome that there has been progress there in terms of that transparency. However, there is still some way to go. It is still very clear, I think, from reading the budget documents that the commentary and the analysis that looks at some of the impacts on protected characteristics and income inequality is coming after the decisions that have been made, and potentially after the spending allocations have been finalised. It is rare to see examples of that type of analysis where you are looking to find areas where most spend is required in order to tackle inequality. Is rare to find that then aligned to a level of budget spend with a follow-through analysis of the impact that that would be expected to have on the areas of concern. It is still a bit of an after-the-event type analysis and clearly in order to better meet targets and improve lives, you would want it to switch focus so that it is a very clear pathway between analysis of need and the money that is being allocated through the budget. That is not just about the budget process, that is about the whole of the policymaking process and the improvements that need to be made. The second area where we would still like to see more progress is adding up of the spend that is allocated or thought to be related to some of the issues on equality and income inequality. At the moment, there are a lot of figures in there, 1 million here, 10 million there, 50 million here, but there is nowhere where you get a sense that it is a tality of that. Even in different portfolios, to what extent are some of the millions or whatever being represented there? What does that look like as a proportion of the overall portfolio spend? We are missing a lot of context there that actually helps you to understand how significant some of the spend is in the budget that is being allocated to different areas. Those are two areas in which we would like to see improvements, but clearly those improvements will take time and we are making some progress, but there is still a way to go. Thank you very much Emma, and can I ask Angela Ogan, please? Good morning, convener and colleagues, thank you very much. I would agree with much of what Emma has said. I think that we can see some really significant improvements, particularly in the equality and fairer Scotland budget statement. Presentationally, it is much more accessible. It brings forward many simple points, but they are very important in terms of conveying information about the budget and the direction of travel. Including infographics on the budget is an important step. Equally, an important inclusion is the specific rights, specific human rights that are engaged in the different portfolio spends. That is very important as part of the collective action that is needed to build knowledge and understanding on human rights. We have a long way to go there, but we have high ambitions in that regard, but we need to be collectively working to build knowledge and understanding there. The annex attached to the equality and fairer Scotland budget statement is a tremendous resource. At 134 pages, it will be treated as a resource rather than a ready-reconner, but it provides that ready-reconner for parliamentarians, for those of us with an interest outside government, to go to look for some of the specificity that Emma has highlighted. Across the portfolios, again, there is a long way to go, but this is the second iteration of the approach, which hopefully is gaining some traction within the portfolios. Likewise, the framing around the 10 risks that helps to concentrate analysis around key interventions and the spending allocated. Obviously, there are lots more that could be done, but there are some of the key improvements. There is always a but. Significant improvement is still necessary on the issues that Emma has raised, but overall, again and again, I come back to the conceptual approach that policy makers, that parliamentarians need to take in tackling and advancing equality and securing the realisation of rights. That has to be the starting point for analysis, and from that, the links to spend and the links to outcome evaluation will flow. The final point that I want to say by way of introduction is to welcome the positive reception of the e-bag report and our recommendations to government. I am looking forward to seeing the actions that the Scottish Government commits to, along with how the e-bag recommendations and the processes that we are trying to push and support will link with the other exercises that are in government on fiscal transparency within the next decade, the open government activity on open budgeting, and I will say more about the busy year that there is for financial scrutiny with the various reviews of the fiscal framework and the resource spending review, all key opportunities to see some significant improvements. Thank you very much, Angela. I will keep it brief and associate myself with both Angela and Emma's comments that I would agree with. It was just to note that, since we last spoke with you, a lot of different things have happened. Our poverty in Scotland report followed the hot and the heels of our last session, which showed where we thought child poverty was going. We obviously had the budget in just this week. We have had an important bit of work done by Emma and our colleagues at the Fraser Valander on the poverty line, so an action that could be taken to meet the child poverty targets. Just this morning, the poverty and inequality commission have published their advice to the Scottish Government on the tackling child poverty delivery plan. The conclusion of all of those things is fairly consistent that there is a lot more to be done if we are going to meet our ambitions on reducing child poverty. While some of the elements of the budget are more accessible in the ways that Angela has described, it is really hard to draw a conclusion from the budgets as to its impact on child poverty. In our particular areas of concern, I am much more happy to discuss some questions with the members, but I will leave it at that for now. That is great. Thanks to all of you. I wonder if I can now go to questions from committee members. Again, remind folk from the panel that, if you want to come in, please press R. Committee members will indicate which members they initially want a response from, but if you feel that you particularly want to add as well, then please put R in the chat and we will try to bring it in. We have got about an hour for this part of the session. Can I go to Maggie Chapman, please? Good morning to the panel. Thank you for being morning and for your opening remarks. It is good to hear that the recognition of just being part—I suppose—a process that there have been improvements, but there is still considerable work to do, especially in particular areas. I would like to explore a couple of those in my initial question, if that is okay. I am struck by what you have already said about the adding up issue, not necessarily understanding exactly how allocations in the equalities and human rights space connect to each other or add up. I am interested in how that relates to our structural equality analysis and our understanding of where the issues are, and maybe it is that kind of cart before horse thing that you were talking about. I am wondering maybe, Emma, if I could start with you, could you say a little bit more about where we should be looking at the moment for that kind of structural equality analysis and what it is that we need to do to build on that for future budgets, given that we know that this budget probably does not meet all of our ambitions, particularly if we take a specific lens of that, the intersectional gender budgeting frame of that. We are interested in your thoughts. I am happy to answer that. We did speak a lot at the last session about data limitations. I will not go over that in answer to the question, but clearly we are not in a perfect world where we have all the data that we would like in order to be able to understand some of the scale of the issues that need to be addressed, but certainly we have enough data to know where there are issues that need to be resolved, hence we have things like the NPF that shows where the Government is aiming in terms of policy priorities. I can talk about that a little bit, but it might make sense to talk about child poverty. Chris mentioned that we put out a report this week, which tried to look at some of the big levers that are available to the Scottish Government and looked at how you could break those down in terms of policy, such as child care employability and social security, and how you could break those down to understand how many people do we think that that policy is going to affect and what do we think the impact is going to be on household incomes as a result. Those two steps were the key parts. Some of this you have to make assumptions, but you would expect policy makers to be thinking through those steps as they make their policy. When you look at adding those up, you add them all up to household incomes, and then what you can do is look at what that means. When you add that look for all households that get more money, you can then look at what that does to poverty and how far that takes you towards the poverty targets. It is a model, so it is not perfect. People may disagree on the assumptions, but where possible you base it on evidence that you have from evaluations, for example, which is what we did in our model. You can start to see that this policy is going to cost this much. We think that it will affect this many people. This is the effect on incomes broadly, and that is what it will do for child poverty. That is the type of adding up that we mean. Of course, when you have got intersexual issues, gender is the key part of that, because a lot of the child poverty measures will improve income score for women. You have to think about how you separate those things out. You have to be very transparent about the fact that things will overlap. In some cases, you may want to be clear who the primary beneficiary is intended to be and go through a process where you add those things up so that you can see the purposeful intent of policy. It is possible to do that in a systematic way that I have talked about. Is it any possible to do for things around income because of the surveys that exist on household incomes and the types of models that are available? That is an example of what I mean there. Something that could be done on the back of budget type analysis is that, if there was more information that was talked about, we know how much is spent on policy lines. Following that through a little bit further, the numbers that we want are how many people are expected to impact and what to expect that impact to be. You can start doing something that adds those things up to look at the scale of the impact. Thank you very much, Emma. That is really, really helpful. I know that Chris Wharton wants to come in in the chat as well. Chris, over to you. To take a specific example, if you look at the equality statement, buses in particular seem to be a cure for many things. There are hundreds of millions of pounds to be invested in them. It is noted throughout that women tend to use buses more, people on low incomes tend to use buses more, stable people can benefit from free bus travel, etc. However, it seems to be trying to do things for all people. There is very little insight into what specific impact it is going to have for those people. We know that the travel patterns at the moment for women and men might be different. How is bus travel adjusting to that? If disabled people have access to free travel, but is it the travel that they can actually use? Is it available? Is it accessible? Those are the sorts of information that you just cannot see from that. We have blank lines that say that women use buses and that we are spending lots of money on it, but that is not telling us anything. Thanks, Chris. That is helpful. There is a gap between the statement and the annex, and the level 4 data, and there is something missing in between all that. Angela, I wonder if I could bring you in. You talked about the need for collective action. I am really interested in how we break down some of the departmental silos. We have got to this point because the departmental budgets have been, for understandable reasons, so fiercely protected and not the connections between them or the overlaps between them seem very clearly. I wonder if you could pick up on that as it relates to the broader question. Indeed. That is something that we have been talking about for a very long time, improving the relationship between different portfolios, and that is absolutely central to the recommendations from eBag. There are a number of ways to approach breaking down some of that siloed thinking. I think that we have seen some improvements, but we have focused on sharing information, building knowledge and competence in equality and human rights analysis, and understanding human rights and what that means and what equality analysis looks like. I am not just talking about the way that equality impact assessment is currently conducted. That is quite often not equality analysis. The culture around policy making and public finance decision making and some of the hierarchies and separations between functions that may continue to exist and which do inhibit a more collaborative way of working. The feedback about eBag from policy makers within Government has been very positive because it brings together finance, strategy and performance, analytical services division and the equality and human rights directorate, as well as our external members. It holds a very unique place there. However, there is a big job to do in Government and in Parliament as well in terms of the kind of scrutiny. It goes to my opening point. The collective action needs to be from a common understanding and commitment to identifying the structural inequalities that you have talked about, understanding what causes and reproduces them and addressing those causes. Yes, we need good data, but an intersectional approach to eliminating existing inequalities, advancing equality and realising rights is not just about counting people, it is about understanding how racialised discrimination and marginalisation compounds and is compounded by class and income inequality, produces and reproduces health inequalities and is cut through by gender. We need to improve the understanding and knowledge around that of policy makers and others. The National Advisory Council on Women and Girls made a recommendation that there should be a statutory footing for intersectional gender budgeting. That is a very welcome reminder to Government, but it is already implicit, it is already there, the requirement for that in the Public Sex Equality Duty and the Equality Act 2010. What is missing is the practice. There is opportunity there to address some of that collective action through the review of the Public Sex Equality Duty, as well as the different reforms to the budget of public finance processes that are going to happen this year. Alexander Stewart, you have talked about the pressures of transparency and the journey that we are on in trying to ensure that there is delivery of equality in human rights budgeting processes. However, in the coming circumstances, there are still challenges and major pressures that are affecting and will affect the delivery of equalities in human rights budgeting in the coming years. We also have the added difficulty of the pandemic and the effects of that and how it may unwind some of the priorities that were set and how that is managed for the future. It would be quite useful to get a flavour, maybe, from a member first and then Angela Stewart, about what they see as the challenges that we face in ensuring that by allocating funds and supporting the way forward it may be derailed or it may be not back or it may even be knocked off course because of the priorities that may now face us in the next few years as to how we can manage and unwind all of that. Thanks very much. I am happy to come in there. I think that it is a really important point that you are raising because there will be big challenges for understanding what is happening in Scotland across the board in terms of everything that was thrown up in the air is partly still up in the air. We are yet to understand where those pieces are going to fall. The statisticians are an absolute nightmare because when you have unexpected events, not only does it make the data very hard to interpret in terms of understanding trends like a year-on-year change in some data, could it be because of the pandemic or is it because the quality of the data that was able to be collected during the pandemic fell considerably? It is going to be difficult to interpret what is happening or what has happened since 2020 onwards. It is probably not going to be for a few years until that is understood. That obviously puts policy makers in a very difficult position in terms of trying to interpret and to know what has been knocked off course and what needs to be the focus. It is going to be a few years when we have to take a broader approach to trying to understand what is happening, rather than relying on what we do on some of the key statistics that say that the household below average income is the key statistical source for a lot of data on incomes. That is going to be very difficult to interpret over the next few years. That means that things like the child poverty targets might become very difficult to understand whether we are on course towards them. It is going to be very difficult to understand the impact of some of the working from home schools closing and the long-term impacts that we will have on women's earnings in the labour market. For example, it may have been that promotions were missed and priorities had to be changed. All of those things will take years to understand. For policy makers, we know what a lot of the challenges are in terms of the labour market and what sectors have suffered the most and where there are skill shortages. There are opportunities there for where we can think about re-skilling different parts of the population. A lot of the low-page jobs where there has been a lot of upheaval are those that we would be thinking about through inequalities in humans rights perspective. Those things are known. What we really need to be thinking about is where should the priorities be for the Government? I am trying to help them to understand what is likely to have got better and what do we not know and see what the priorities should be. We cannot fix everything before we know what all the problems are. I am not sure that the priorities of the Government will have changed through the pandemic. A lot of things have got worse for a lot of people, but they are the same people who were struggling before the pandemic. If you are thinking about it on that basis, it is steadfast. We need to carry on. The national performance framework still stands, but there needs to be that flexibility to realise what has changed and where things might need to be ramped up in response to the cost of living crisis that is now coming down the line. It is a difficult place to be as a policymaker, and we have to realise that. The priorities that existed before the pandemic are not the same ones that would exist afterwards. You talked about your opening statement about how it affected individuals and organisations across the peace. How do you see the priorities changing and having to be adapted to encourage that process to ensure that people are not lost or fall through the net? The pandemic has revealed that, as well as exacerbating it, it has revealed the existing inequalities. The pandemic has made them worse. Some policy choices have made those things worse. Existing isolation, health inequalities, etc. have made the effects of the pandemic worse. If anything, we need gender budgeting, equalities and human rights budgeting, as our cornerstone approach, much more so than ever. It is not a case of, well, we need to set that aside while we focus on other things. It is a process, it is an approach to policymaking that will help to reveal the kinds of dynamics in the data, the dynamics and the outcomes that Emma was talking about. There is a role for improved parliamentary scrutiny and using the different points in the budget process throughout the cycle for that back-and-forward look at allocations and outcomes. Focusing on the policy outcomes there rather than the politics of the budget, but focusing on the policy outcomes from fending allocations and policy priorities and taking decisions and supporting decisions to reorientate fending and policy priorities where necessary. The other thing that I wanted to say is about using the human rights standards, using human rights as a framework. Are basic rights to food, to security, to housing, to health, to education being realised? Is that floor in place? Is that minimum core there and how to build on that minimum core? Has there been regression, that unwinding that you talked about in your question? Are things being rolled back? Well, we cannot roll back. We have a legal duty to avoid that, as well as other political and moral imperatives. Is the policy discriminatory or having unequal or different outcomes? Will we know that through or should we know? We should know those things through improved data and the kinds of analysis that Emma has talked about. The final thing is the two points on the national performance framework, which has huge potential, but we need to be seeing more specific and dynamic actions more clearly linked to bending outcomes through the NPF. The final point that I wanted to make was about the social renewal advisory board. It is a set of calls to action that gives a set of very specific recommendations that are directly linked to pre-existing inequalities and the conditions produced through the pandemic, but actions that can be pinpointed and scrutinised as we move to the next stages out of the pandemic are linked to the national strategy for economic transformation that is coming down the line, linked to other strategies and making those linkages across those big set pieces much clearer. Those of us who push for this transparency externally for parliamentarians to be pushing for those links across those big set piece strategies will be made much more transparent and will be made more transparent through the budget reporting. It is just to highlight and underline the point that both Angela and Emma have made about the pandemic really highlighting and exacerbating existing inequalities. It has created new problems for people, but what it has shown us is how the immune system of our economy and public services work and who it works to protect. We have seen people on middle and higher incomes able to save more money while those on low incomes are piling up debt. We have seen people in more deprived communities twice as likely to die from Covid and those in minority ethnic communities significantly more likely to die from Covid. We have seen those shielding have their inability to travel, to go to work, to socialise with their friends, exacerbated in a way in which it would have existed prior to the pandemic but now has become crushing. The impacts of the pandemic should be a warning to us. The immune system of our country to shocks like this does not protect the very people that your committee is striving to improve the lives of. I thank the panel for the extensive answers so far. I will probably ask a question that you touched on in the last two answer sessions. The committee has started exploring what a human rights-based approach to budgeting could mean and the recommendations to integrate intersectional gender analysis into the Scottish budget process have been clear. What is that practically going to look like? We know that investment in particular areas can have unintended consequences, good and bad. Along with the practicalities of what that investment looks like, what outcomes are we looking to see from that? I will come in with my second question just now. How much of that is mitigation? We have at the moment risen food costs, energy costs and rents, and we know that that will disproportionately affect women even more. Is there anything that we can do to ensure that we are making the most of the money for long-term vision? We have the pandemic but we also have the EU exit that has compounded a lot of those issues. What I am trying to say is that when we have the money, we are trying to get those particular outcomes from the investment in those areas. What is that practically looking like and what exactly can we do to ensure that it is getting to the people who need it the most and that it is going to help and support them long-term? I will start with Dr Hegan. I had a feeling you were coming in there. Thank you very much. What a huge question. A human rights-based approach, as I say, if we work to minimum core and as the very basics of what should be happening and if we are not already doing that, then there is a clear starting point in those areas if that is not happening. If policy does not have a clear objective in terms of making sure that people have a decent income, if access to safe and secure housing, safe and secure space, freedom from violence and access to food—we are dealing with those basics. Nearly 24 per cent of children in Scotland are living in poor households. How can that be tolerated? It is about expressing policy priorities that recognise the current state of play and what causes those inequalities and driving resources to address them. Going back to the social renewal advisory board, part of how the public sector works together and works in concert with the community sector and the voluntary sector is absolutely key to that. There is a big how, as well as the thoughts that we need to be working on. Yes, there are unintended consequences of policies, but if the better that we get collectively at the upfront analysis, that starting point that seeks to identify what is currently happening and why, the better we should be at making much more targeted interventions. How much of it is mitigation? That links to Emma's points about shifting priorities. The cost of living squeeze and council tax decisions around tax policy in general are all held in that very fine balance between the different variables and how they interact. We always come back to the starting point about what are the transformations that public policy and public finance seek to achieve. That gives a guiding through that. Very quickly, the recent publication in Italy of the Italian Government's gender budgeting approach thinks that it is a really interesting approach and does some very useful things. There is a good framework. It has a range of useful categories that we could learn from, including revenue and tax policy analysis, as well as time use and care, labour market policy, legislation, policy and government employment. It categorised spending along those three criteria, gender inequalities, addressing gender inequalities, gender sensitive expenditure and neutral expenditure. That is quite a useful way to try and structure some of our thinking. To link it to a couple of points from earlier and then I will stop, but the OECD has recommended over many years that the approach to equality analysis in the budget process should happen in three stages. Ex ante, the policy formulation and appraisal, the concurrent, the scrutiny of policy as it is being implemented and exposed, what happened as a result of those policy decisions. That is something that we tried to build into the budget review way back in 2016, and there is still room for significant improvement there in that process within the budget cycle and in the parliamentary scrutiny. I think that the key thing here is that all the points that Emma and Angela have made about the importance of getting the right data is absolutely key. It will be the only thing that allows us to shift course if we start to get things wrong. However, as shown by the pandemic, we also cannot wait for perfection. The bus example that I gave earlier to Maggie is a really good example. We are throwing a big chunk of money at an issue, but we are mitigating a cost. We are saying that transport can be expensive, so we will make that free. That is fine, and that mitigates that cost. Structurally, we have a transport system that is set up, focused on urban areas, focused on traditional commuting, and we know that that discriminates against women in particular or carers or all of these things. How do you make the decisions to drive a different outcome of people being able to travel between caring spaces and work, rather than just directly to work? How do we know whether or not that is working and having the outcomes that we want to see?  It is important that, in those areas, we cannot expect things to happen from general policy by osmosis to have magical impacts on groups if we do not target them to do that. That targeting and then knowing whether or not works is really important. On the question on gender, on the international gender analysis, I thought that it might be worth reminding the committee that there has been some work done on the Scotland's gender equality index. That has been produced by some analysts in the Scottish Government. That is the place where we would see analysis for the issue that we could start with. That goes through a number of different areas, some of which Angela Constance mentioned in terms of time use, issues around power and looking into areas around violence against women. It looks at a whole stretch of different types of indicators that are important. It shows how Scotland is doing on those indicators. That could be a really good starting point for a visa budget analysis that goes in the case of things that are important. That is where Scotland is on some of them. How do the decisions in the budget align to them, or even better, before the budget happens? What kind of things could make a difference there? What kind of numbers are we talking about? What is that pathway through to the impact? Using those tools, there is a lot of data that already exists. A lot of good work goes into looking at some of the issues and trying to help to break them down. It is that bit of missing that connects that to actual policy making and budget allocations. That is one example of what it would look like. That could be a place to start. That leads on to thinking about some of the issues around the longer term. We know a lot of the issues for women, particularly mothers, around care and care for children and for older relatives. The infrastructure in childcare and the national care system, is that the type of long-term structural changes that could be shifting those things over the long term and helping the short term? I will leave it at that. Can we go to Pam Duncan Glancy now, please? Thank you, convener, and thank you to the panel for joining us this morning and for all your evidence. I have been struck by a lot of what you have said. In particular, I have to say that the immune system response in the economy has struck a chord this morning. Thank you for that and for the submission that you have given in writing. I have a few questions if the convener will indulge and the panel will indulge me. The first one is to touch on where Emma has just highlighted. That is around care. The Scottish Women's Budget group described action on care in the budget as an opportunity missed. I have to say that I would agree with that. I wonder if Dr O'Hagan, you can perhaps tell us a little bit about your views on that in terms of paid care, your expectations and your view on the wage floor of £10.50 per hour, how that will impact on women's inequality and on unpaid carers. We know that unpaid carers have faced a significant increase in the number of hours that they are providing care. We know that has an impact on their ability to work in the workplace and not least on their personal circumstances. Last year, the Government, as you will know, introduced a bill to double the carers allowance supplement in December and an uplift it introduced during the pandemic to recognise that additional responsibility. At the time that the Government said that it included the provision in the bill for it to be doubled again this year in regulations, the draft budget does not include that. Therefore, it came to know whether the panel has any concerns about that and whether they expect the impact on the ability of carers to realise and enjoy their rights if that was not, for example, to be doubled. I have a couple of other areas that I will come back to that are probably enough to go on, which is there. Pam, if you can, we will go to the other members and hopefully come back to you if you have a different area as well. Thank you very much for those questions. Pam, the Scottish Women's Budget Group response did say that it was an opportunity missed and that the £10.50 wage floor was a good starting point, but it had to be seen as a starting point. It is only a first step in recognising or shifting the dial a little bit on valuing care and the provision of care. However, I still have some deep-seated concerns about how care is conceptualised and how care is being approached within economic policymaking. I think that there is a disjuncture between seeing care and social care in a health context and not in an economic context. The care economy is at the heart of our economy. It follows on from Chris's analogy around the immune system. Unpaid care supports any so-called productive economy. Unless we recognise that and unless that care is valued in a monetary sense as well as conceptually and politically, then economic strategies are not going to deliver transformative economic policy outcomes. That means investing in care as part of our infrastructure, investing in quality services that are not subject to postcode lottery but still give the flexibility for the person in receipt of care services as well as unpaid carers. Unpaid carers are consistently ignored and overlooked, and the carers' lobby is very clear and very strong on that. It links to Maggie's earlier point about consistency across policy portfolios and that care is not just in the domain of social care, but care should be front and centre in a whole range of policies, including, as Chris has said, in transport and recognising care journeys and so on. Again, it comes back to the starting point for policy. Thinking about carers allowing supplement or additional payments to carers, the starting point should not be a formulaic and rather mendacious—not in intent necessarily, but in execution approach—that wants to know the exact numbers of hours that carers provide and how that is distributed between different people that they care for. That absolutely is the wrong starting point for policymaking around supporting people whose income is severely curtailed because of the care that they provide to one and multiple people. If the policy decision-making process is to give effect to those political commitments around being, as stated in the programme for government, a caring nation, a land of opportunity and an economy that works for all and people living better, that has to start with valuing and investing in care. I think that I see that possibly Chris and others are looking to come in, if that's okay, convener, and then I'll have one short follow-up still on the theme of human rights and inequality. I'll go first, let's take a course. With the issues around and the absence of a lot on that in the last budget, I think that that was something that we also reflected on. It's something that we expect to now be more of a focus in the next six months, I think, as the Government brings forward new proposals on the national care service and how that then goes into the bill process. We will be expecting that analysis that we hope to see in the budget will start to come through in the next few months. Particularly, there will be a financial memorandum that will be very detailed in terms of the impact. It's certainly something that we're looking at independently in terms of understanding what the proposals for future improvements will be and what that will correspond to in terms of the cost. We expect then that that will follow through to future budgets in terms of that will be reflected in allocations and there will be a clear read across between the proposals, the bill, and then future budgets. That doesn't always happen. It's not always that kind of read across that we'd like to see. That will be a really, hopefully, an example of where we can in real time see that happening. If it's not happening, that's the time where we can raise the questions as to why it's not. I do understand that there wasn't a lot in the budget but, in a way, because of the way the process is moving and the consultation and the proposals we're hoping to get into, that should still be to come, hopefully. I'll stop there. I'll add to Angela's point on care, which I think I would firmly associate myself with. If you think about the impacts of a pandemic, who could have suffered more than unpaid carers or low-income single parents, for example? The impact of the pandemic has been absolutely crushing. The immune system is that those people have been the immune system for so many people but yet have received so little support to do so. That's morally wrong but, for the reasons that Angela has set out, she completely misunderstands its impact on the economy. It's why things like the minimum income guarantee are really important, because that provides a way for us to rethink the value that we put on care in every shape and form in our society. It's absolutely key that we do that properly. Thank you for all of that and, again, for further immune system. It's really strong. The other question that I have is about social security. It's about the Scottish child payment and the fact that 170,000 children receive the Scottish child payment through the bridging payment, but my understanding is that it's not yet being doubled. I wonder if Chris could comment on the impact that not doubling it for that group might have. I think that I have spoken at length about how we want that to happen as quickly as possible. I think that in the context of the rising cost of living this year, particularly if we hear a lot about the energy cap moving, the uplift in the energy cap is going to be about the equivalent of those bridging payments. I think that the full rollout to all children can't come soon enough. I'm pretty sure that the Scottish Government Agency will be working to do that as quickly as it possibly can, because it will be an enormous boost to families. The families that are getting it do talk about its positive impacts, but, yes, you're right, Pam. It can't come soon enough. Thank you for your opening statements and all the detailed responses that you've been giving to all the questions today. My question comes in the back of what Pam's just talked about, a little bit about the child payment. The question is about the Joseph Rowntree Foundation expressed that the Scottish Government's plan to double the child payment by the end of 2022 is on its own not enough to meet the child poverty target. Given that councils are responsible for vital service provisions, with council cuts could impact the services provisions available to children living in poverty, what do you feel can be done to improve the co-ordination of policies across all the areas of the budget so that, where one has a positive effect, it is not negated by a policy in another area? My question would go to probably Chris first, yes, and then others. I think that it's absolutely vital that all policies are pushing in the same direction. If we're talking about a national mission to end child poverty, that should impact on everyone who is working across public services. There are areas where we have to think carefully about where the impact of one thing is negating the positive impact of something else. For example, increases in council tax will impact more on low-income families than they will comparatively to those who are better off. With rising energy bills and so on, that has greater impact on those low incomes than it does on those higher incomes. While the increase of the child payment should be positive in terms of the overall numbers of child poverty, because of those other things, its impact on people's quality of life will be held back. In terms of wider council services, those services can be vital in helping families to get by. The commitment to family well-being services that were announced in the budget were very welcome in that regard. Increasing social security while stripping back other services is not going to reduce child poverty in the sustainable way that we are all worth to see. I am not sure if any Emma Orr, Angela, will come in on that. I jump in quickly on a point about the process point that you made across portfolios. It links to a number of questions that have been offered by the committee members this morning. To use really old-fashioned language, I say that every time I say this to other committees, that joins up thinking. However, the point that I want to make is about making linkages across portfolios and recognising that equality and human rights are relevant to all portfolios. In the future, we do not see statements like that from the Rural Affairs and Islands portfolio that say that this spend does not tend to reduce inequalities for groups with protected characteristics. That is an unacceptable statement in the Equality and Fairer Scotland budget statement. It has maybe been some unfortunate editing and short-handing, but does it point to a lack of understanding and analysis? What is really meant by that? How does that portfolio know that inequalities are not addressed? There may be some spending lines which, to use the Italian categorisation, are neutral, are sensitive and are specifically around addressing inequalities. That analysis has to happen before you could even contemplate a statement like that. I am not convinced, given the surrounding statements and analysis that it has. Those weaknesses across Government, we still see in some of the presentations in the Equality and Fairer Scotland statements and in the budget, as Emma Cymru clearly articulated at the top of the meeting. Thank you. That is me. Unless Emma wants to come in, thank you. Okay, thanks then. Can I go to Fulton MacGregor, please? Thanks, convener. Good morning, panel. I think that I am very impressed with the quality of the responses so far. It has been a really, really good session, and I want to thank the panel for that. I wanted to ask a question about tax policy. I will just put that out there to the panel. How do you think that the Scottish Government could use tax policy in order to meet human rights and equalities obligations? I am quite happy to start in any order, convener, to him, if he wants to come in on that. I think that we touched on that part in our previous session. Obviously, the way that you raise taxes is very important. Most people in the Parliament would urge that to be in as progressive a way as possible, i.e. very much related to your ability to pay. For those on lower incomes to be contributing less, for example, the income tax system is generally progressive, which is good, and the Scottish Government has taken steps in the last few years to make that certainly more progressive than the UK system. I think that the comparison with the UK system should not be top of our minds when we are talking about impacts on child poverty.  It then becomes that, if we have raised more money and we have done that in a progressive way, that is good, how are we going to spend that money to redistribute income across our economy? We need a big debate about that in Scotland, and it can be led from the Parliament, it can be led from the Government, as it really matters, but how wealth is distributed across our economy in Scotland? Income inequality is bad in Scotland, wealth inequality is eye-watering, and that is the sort of thing that is locking people in poverty over time. A lot of that is related to our housing market. Our housing market is often the economic security that lots of families have, and the idea for a lot of people on low incomes to access and get on the property ladder is a pipe dream. I think that that is something that we need to look at. Dr O'Hagan, I see your wording in as well. Yes, thank you very much. I will take off my chair of the equality budgets advisory group, because I have no policy role there. As somebody who is part of the human rights budgeting working group and a member of the Scottish women's budget group, I have quite a lot to say on tax. One of the things to say is that we are moving to a more open conversation with the Scottish Government about tax. There were opportunities, some of them, that were missed in the recent tax policy consultation. I echo many of the points that Chris has just made. There are positive flexibilities around income tax, but there needs to be, yes, the debate that Chris talks about, but some political boldness across the parties, in relation to having a conversation with the public about the central role of taxation in raising revenue for the quality and character of public services that we want to have. That means being prepared to look at a range of tax instruments, which can, in my opinion, include wealth taxes, re-looking at land value tax and valuation of property. That links to council tax and its fitness for purpose as a funding mechanism. Of course, that links us into Chris's point about how revenue is allocated and the process of allocation on one-year cycles, as opposed to three-year cycles, which at the moment inhibits longer-term planning and sustainable services. We need to see revenue raising in step with allocation processes and the purposes of allocation. The point that is underlined is boldness in tax and not shying away from having conversations about taxation and tax policy in Scotland that are about raising the revenue that is necessary to deliver the quality and character of public services that we all would like to see. Thank you for that, Dr Ohegan. Emma Congrie, are you wottening on that question? Yes, I will, for a few points. One thing that we have talked about a lot at the Fraser of Allender Institute is about having a grown-up discussion on tax. Obviously, we have a progressive income tax policy in place and more progressive than south of the border, but some of the decisions that are made at budget time on income tax sometimes look like they are going to help lower income households. When you look into the detail of them, it is not quite as clear-cut as that. I will give the example of this year's increases to the start and basic rates of income tax being raised by inflation. When you looked into the detail of that, it did not mean that the rate at which you start to pay tax would rise by the rate of inflation. What it meant is that the size of the income bands above the personal allowance increased by inflation. That had an impact when you look at some of the amounts that people pay. Compared to a decision to freeze thresholds and cash terms, the operating that they did meant that those who were earning above £25,000 gained by just under £5 a year, but those earning below £25,000 and above the personal allowance benefit is by less than £1 a year. Those issues that come up when you look into the detail of some of those things say to us that there is not necessarily that level of transparency that we would like to see and that kind of intelligent conversation with the population and the Parliament sometimes in terms of some of those decisions. We saw something a little bit odd in non-domestic rates, where they desired to make Scotland's tax policy look good in reference to the UK policy on it. It meant that there was slightly below what the UK Government put in place increase in the poundage rate for income tax. That only led to about a saving to businesses in around £30 a year. It is poorly immaterial, but it will have had a big impact in terms of the amount of money that would have been lost from that budget because of that decision that has been made, and that has impact elsewhere. It is that kind of conversation that we need to have about tax so that everyone understands what is going on. We use the phrase tax gimmicks to say that we are not being as straightforward as we need to be in terms of our conversations about tax. There are the things that I think are really important. As more levers and as more difficult decisions on tax needs to be made, people really understand what is going on. Thank you. I am happy with that, convener. Sorry, I noticed from the chat that Angela has a little point that she wants to make, so maybe it is better to make it so that it is on the record. Thanks very much, convener. I just meant to say in terms of a human rights-based approach that one of the legal requirements through the International Convention on Economic, Social and Cultural Rights places a duty on states to maximise available resources. That is about effective and efficient tax policies to secure the progressive realisation of rights. We have a legal requirement, if the incorporation of the conventions goes ahead in the way that we would like to see it, which drives compliance. Much more than compliance, it is about the flexibilities, the boldness and the innovation and inventiveness—not the gimmicks that Emma referred to—to continue in good faith the positive conversations that are on going about tax policy. There has been a lot of effort from the Exchequer to improve that, so we are on the right road, but there is a lot more positive work to do. Thanks very much, Angela. Can I go to Pam Duncan Glancy, please? Thank you, convener, for allowing me to come back in. I just want to take the opportunity if that is okay, Emma, to ask a question about the report that you guys published yesterday. You have obviously noted that the Scottish fiscal commission has a disappointing outlook, basically, in that they have revised their tax take downward. I wonder if you could tell us what is your analysis of the reason for that downward revision and what do you think the implications for the budget on equalities could be. In addition to that, you describe the effect of using social security kind of verses, although I know that it is not as simple as that—using social security and longer-term economic policy in employment and the impact that some employment policies can have on equalities groups and protected characteristics and their ability to work. I wonder if you could say a little bit more on that analysis, just to help us to understand the impact both in terms of tax take for equalities but also in terms of how much money we are going to have to be able to address some of those inequalities. The fiscal commission's forecast that came out at the time of the budget did have relatively bad news in it in terms of income tax forecasts. The commission revised downward its forecast of income tax revenues for the years 2022-23. That is due to lower earnings growth than was expected, based on the fact that employment and earnings have grown less quickly in Scotland compared to the rest of the UK since 2016-17. Through the mechanism of the fiscal framework, that means that there will be less money forecast to come into the Scottish budget. That was one of the key stories from the budget in terms of that part of your question. Thinking ahead in terms of the policies that can and potentially reverse some of what we have seen there in terms of tackling poverty and inequality, one of the key routes to do that is through improving access to the labour market. The report that you referred to, which we published yesterday, looked at some of the structural barriers and how they could be removed. There was a child care in particular, and there was a child care policy report, so there are parents, mothers in particular, and the kind of skills that help with CVs, the employability type support that exists. There are relatively expensive policies to do. You can see them as informers of big investment both in people and in the economy. There are returns over time in terms of that boost to what we would call the supply side of the economy. The number of people working, the number of hours that people are able to put forward, and the productivity because of hopefully the less stressful environment that they are trying to deal with, because we were living in poverty and we couldn't quantify that last bit, but the other two we did try to look at. You get big payback in terms of that investment. It then just goes through to things like tax revenues if you are able to improve people's access to work, but I think that one thing that our report did find is that when you were looking at what our assumptions would be in terms of what extent would 50 hours of childcare remove barriers to work for women, for mothers, it was clear that when you look at the data that we tried to use as a comparison, it is clearly not just childcare that is the barrier to work. I think that that is what Chris has talked about in terms of transport. It is the cost of commuting, it is whether there is a boost to get you to work at the right time and get you to school to pick up your kids. It is whether or not there is the right job for the right schools in your area. There are so many factors that are centring on that, but if the Government can start to pick off barriers as it goes, that would obviously be an improvement. The report that we did also looked at social security, which is a really direct way of course of getting money into people's pockets. When you start raising those amounts, there will always be questions raised about what the impacts of those are on things like work incentives. To be honest, I do not think that the academic evidence on that is clear. Cups, particularly changes in the structure of the economy and over the past 10 years or so, and the pandemic will have changed things again. Understanding how people make those decisions is difficult, but certainly putting money into people's pockets because people on lower incomes tend to spend more of their money because they need to on essentials. You get a boost to the economy to do that as well. One of the key things in my report is putting money into tackling poverty and getting money to people who cannot work as a result of care and responsibilities for young children or their own disability or ill health. That has benefits to the economy too. We should not be thinking that this is a zero-sum game in terms of putting money in and getting nothing back out again. Coming back to your original point, if you think about budgetary terms, that could come back in terms of beneficial income tax revenues in the future. That answer is enough of your question. Chris Stark is hoping to come in and answer that question. Just to follow up briefly, it is important to gently remind everyone across the political spectrum in the Parliament that they have all signed up to child poverty targets by 2030, which means a very different Scotland to the one that we have today. What Emma's report has helped to highlight is the choices and trade-offs that are included in that. As Emma has said, more forcefully, a fairer Scotland, with very low levels of poverty, will be a better country than the one that we have today. That is something that we can all sign up to, but we are not going to get there by accident. We cannot just take it along as we are now and make those changes. We need to have big discussions about, for example, the value of care, as we have talked about. There is not a free way of doing that. We can change the ways in which we spend money. Of course, it does not need to all be a discussion about tax, but there are big questions in that, but big changes need to happen. Everyone is signed up to it, so we all need to go on with doing that. Thanks very much, Chris, and thanks, Pam, for the questions. Have we got Maggie Chapman, please? Thanks very much, Joe, and sorry for coming back in. I know that we have heard an awful lot. I appreciate that this is potentially quite a big topic, but just sort of headlines please. Maybe from Angela, we know that we are talking about a multi-year resource spending review, and one of the things that many of us on the committee are interested in is how we engage and how we ensure that we get the right participation from people. Do you have any top tips for us or any key recommendations for us to be thinking about as we think how we make our budget processes more participative, how we hear from the voices that we maybe haven't been hearing from in a way that still allows us to analyse data, gather expert evidence and all of that, but specifically thinking in the context of the multi-year spending review. Thanks very briefly. I think that being much more proactive as a committee but across Government as well and across the Parliament maybe bringing together different committees to do proactive engagement with a range of community organisations, particularly around social care, particularly voices of unpaid carers who are accessing a range of services. They will have a lot of experience of engaging in public services but less experience in informing how those services are designed and delivered. I think that there is also a need, and I say this with utmost respect, to build the knowledge base across parliamentarians and the range of functions within the Parliament from inequalities and human rights analysis perspectives so that the quality of the scrutiny and the analysis is more intense, more robust. I would also say that consultation and evidence request timescales recently have not supported effective participation or responses and are the source of huge frustration to many of us, particularly in voluntary or unresourced roles but across the piece. Real consultation takes time and should not be about creating what colleagues call busy work for the rest of us, which is external to Government, where we effectively repeat evidence that we have given on many occasions and we are asked to repeat it in successive consultations. I think that it was very welcome to see a participation framework mentioned in the budget documents. I would like to know more about that and know how participation in public finance decision making will be supported as that framework is developed, but there is really good stuff happening through the fiscal transparency project coming out of Scottish Exchequer and open government and open budget work. In answer to your question, part of the how-to is to make much better links across the different areas of work that are already going on. That is really helpful. Thank you, Angela. Chris, you wanted to come in. That is just a very quick point, just to back up some of what Angela has said. Those things take time. It is almost February. Spinner reviews used to be published in May. There is a traditional consultation out just now. People will be sitting in Government writing that already. It is a chance for the Parliament perhaps to be a bit more muscular, because what genuine ability is there for people to impact on the outcome of the spending review as we sit here today. The ship appears to me to be sailing. It is a challenge for everyone involved in the process. Thanks for that.


Going back in summary proxy with HTTP using HTTP our data is not encrypted So we generally would like to use HTTPS With a proxy and just HTTP we must trust the proxy the proxy can read our data as can others But if we use a proxy and HTTPS the others cannot read our data the firewall cannot but we still must trust the proxy and The proxy can read your data Because the proxy needs a way to be able to decrypt the data to see the destination server address And that's a key difference with a VPN server Here the proxy can read the data So if you're accessing your bank website via the web proxy You may assume that the proxy knows your username and password and knows your account information because Normally for a web proxy to work the proxy requires the ability to decrypt the data So that's not a good idea But with a VPN and HTTPS The data is encrypted on your computer using HTTPS And it's not decrypted until it gets to the final server So the VPN cannot read your data But we still must trust the VPN not to reveal who's communicating Before we look at the the last technique the server cannot identify you well We say that because the addresses the server receives a packet the source is V is not you But how else can the server identify you? How does a web server know it's you? That's accessing it How does Facebook know it's you that's accessing it based upon your IP address? Based upon some session which comes from what you logging in All right So if you log into a website and you supply that your username and password of course the website knows it's you So when we assume or say here the server cannot identify you I mean they cannot identify you by the source IP address But they may identify you via other means if there's a login for that website of course they can identify you or if Even if there's not a login, but there's some other information that the web server observes cookies And some tracking of your behavior based upon past access. They may still be able to identify you So it's just with respect to the address Let's see the last technique which will try to Provide all security features and we'll see how it does that and The last technique is called Tor to our or the onion router It uses onion routing. What's an onion look like round and if you open it up an onion You cry and often why you you peel off the layers So there's usually an outer layer on an onion and then you peel off an inner layer and another layer and and so on so The concept of an onion or the concept of the name of onion routing is that we'll send a packet Which will be encrypted multiple times and as we send via Multiple VPN servers each one will peel off a layer Will unencrypt and send the inner part to the next one which will peel off another layer and keep going until it gets to the destination so the name comes from this concept of peeling off layers Which is in our context decrypting the packet and sending what's inside Taking out the outer header and sending what's inside Tor was designed for anonymous communications in the public Internet and The way that it works is that computers in the Internet Whether it's your home computer or a special server. It can be any computer that runs the Tor software actors relay nodes and The Tor relays are really like VPN servers But in Tor instead of using one VPN server. We'll see we'll use multiple VPN servers and What your computer does your source computer is That when you want to access a website The Tor software on your computer selects some relays to send via And has some approaches for doing that and they will send to a special Tor node called an exit node And then that exit node will send the data using the normal Internet without using Tor We'll see that in a picture Between the nodes from your computer to the first Tor relay to the next Tor relay They use encryption SSL in particular There's some key exchange so that they can Decrypt correctly What else? We'll see this come up when with our example the last one so let's see how it works and then look at the advantages of the issues here's our Client you want to talk to the server s some normal website in the Internet. There are some Tor relays Think of them as some routers in the Internet, but they in fact can be any computing device that runs the Tor software and In my picture, I've identified t1 t2 and t3 is Tor relay nodes and E is a special Tor node called an exit node So that there are four other computers. We're going to send via in this case So how does it work and this is the simplest as I can give explanation of Tor You choose so your computer runs some Tor software and one thing it would do is choose a set of relays to send via and an exit node So my computer has chosen t1 2 3 and e I have a HTTP packet to send not HTTPS yet just HTTP I Take that original HTTP packet and I set So take the data I Encrypt that and I attach a header that says the destination will be e and Then I encrypt all of that and this is hard to show on this picture. We may draw it again We will encrypt all of this packet With a different key and say the destination is t3 and then encrypt all of that again and Attach the outer header t2 have that all encrypted again and then the final outer header sources you destination is t1 Let's try and draw that as we go So you can see the steps. What have we got? We have and you can use your same picture. We'll draw it on top. We have t1 here t2 t3 and the exit node I Create a packet and it's going to be big There's the original data the HTTP request and some header identifying e and that is all encrypted with a key Let's get it correct. Actually, we can have the data encrypted with a key Known by e and then All of that is encrypted with a key known by t3 we attach another header identifying t3 and that's encrypted With a key known by t2 There's the header to t2 All of that is encrypted with a key known by t1 and then there's the outer header Source is you destination t1 That's the packet. It's on the slide, but I've also shown the keys and we'll see how that works So you can draw the keys on the slide to make it clear. So this is the original packet sent by you Who do you send it to who gets this packet? t1 all right t1 is the first relay node and Can t1 decrypt this packet? Well, let's look. Let's say we throw away the header. We peel off a layer. This is our onion t1 receives this packet Let's get rid of the header. What have we got left? We've got something encrypted encrypted with which key a key Which I don't know k t1 meaning a key that's known by both you and t1 only by that pair So yes t1 receives this removes the header peels off a layer and decrypts the contents What do they see? They see the destination. So when I write the address t2 here, I mean the destination of the next packet is t2 So t1 sees I need to send this onion to t2 Can t1 see the data the data is encrypted in fact multiple times It's encrypted that inner part now is encrypted with a key known by t2 not t1 So what does t1 send on to t2? Across this and I won't squeeze everything in but across this link from t1 to t2 there's the data e t3 and The source is t1 and The destination t2 When I write t2 here, I mean the destination is t2 and what's encrypted? Well The header is no longer encrypted from t3 through to the data is encrypted this part with k t2 Here that's that part. So this is this the onion being sent from t1 to t2 what happened That relay node t1 received the first one they could decrypt the inner part So they remove the header they peel off a layer of the onion Decrypt the inner part and realize our I need to send this to t2 That's what the header indicates. So now t1 sends this onion to t2 t2 receives this Can t2 decrypt again t2 a Tor relay node receives this onion it peels off a Layer it removes the outer header And it then it decrypts inside it can because it was encrypted with the key of t2 t2 decrypts this Sends it to who t3 when we decrypt This packet we see the next destination is t3 and we send that on to t3 Can we squeeze it in maybe at the top? We have the data He and the destination of this packet is t3. Remember we remove the header decrypt the insides And we see the destination is t3 source is still the one who send it t2 and that Internal of that is encrypted with t3 this part here so this was This packet is sent to t3 T3 receives it peels off the outer header It is the destination fine It decrypts because it was encrypted with key known by t3 so it can decrypt and It gets the internal packet and then sends that on to e another tour relay or tour node What is it data? Destination is e So just to save space when I write just the letter here I mean that is the destination. I haven't written the source address and the data is still encrypted With ke T3 sends this on to e e receives and then peels off the outer header decrypts and The data in this case that we're left over with is the original packet Which is going to go to the web server for example the HTTP get request here. We're just using HTTP so By the data really what we're left with this data We can think it it's going to go Source is e Destination is s and maybe it's the HTTP packet HTTP TCP and so on Everyone get that a lot of steps involved, but each relay node is doing the same thing What happened at the start is the source computer you you generate this packet this onion which starts with the The data that you want to go to the server say the HTTP request and the source or yeah, it goes to the server and Then you say this needs to go to e The data is encrypted with a key that e knows Then all of that is encrypted with a key that t3 knows and then you add a header saying this needs to go to t3 All of that is encrypted with a key t2 knows We add a header saying this needs to go to t2 and Then encrypted with a key that t1 knows Add a header saying this needs to go to t1 We send it to t1 and The way that we've set up that onion at the start is such that each relay node can decrypt and See who the next relay node is T1 decrypts and sees ah send it to t2 t2 receives decrypts sends it to t3 and T3 to e and then e eventually gets that HTTP message Which is not encrypted. It's HTTP sends it to the real web server The web server sends it back to e and he does the opposite Sends the onion back to you so that's the simplest explanation I give how it works What security features do we get with this? Let's say you intercept the packet at the firewall What can you see? You're the firewall. You're an ISP. You want to intercept the user's data We see the source and destination. What do they identify? The source and destination address tell us tells the firewall you is you are accessing t1 All right, so they don't reveal that you are accessing the server It does reveal you're accessing some computer in the internet known as t1 So that's some privacy the firewall doesn't know you're accessing this server s Can they see the data? No, the data is all encrypted multiple times. So the firewall cannot see your HTTP request They don't know it's going to the web server s What if let's say you intercepted the packet between t2 and t3? It may not be a single link here despite what my picture shows T2 and t3 may be computers on the other side of the world But they send to each other so let's say someone intercepts a packet between t2 and t3 What do they see? Source t2 destination t3 data encrypted So no one can see it's you Talking to the server and no one can see the data. So we have data confidentiality so far and No one knows that it's you talking to s What if you intercept at this router between e and s? What can you see you can see the data Between the exit node and the final server Tor is not used. This is just the normal internet access So the HTTP message is in the clear But the source address is e and the destination is s If you intercept here, you don't know that it is you talking to s you think it's e talking to s the exit node So we have privacy of who is communicating But not privacy of the data How do I keep that HTTP message encrypted? HTTPS So the next slide shows use Tor and HTTPS and we get almost the same but in addition This data going from e to s is encrypted Meaning no one between you and the server can see the data and No one can identify who is communicating in particular you to s What about that relay nodes the Tor nodes here? There were four relay nodes t1 t2 t3 and exit node e What did they see? Does t1? Know that it's you contacting the server s You shake your head why why does it not know t does t1 know it's you to s They know it's from you or they know they've received something from you So t1 receives a Tor onion from you That was here, but they don't know that the destination is s What they do know it's coming from you and it's going to go to t2 But anything beyond that they don't know because it's all encrypted so t1 Doesn't know that it's you talking to s In fact t1 doesn't even know if you was the original source The way that it works is that maybe what t1 received Came from someone before you So maybe you is just a relay node so there's no way for t1 to identify that you as the original source or a relay node forwarding for another source Similar for t2 t2 receives a packet source is t1 destination t2 and then they send a packet to t3 so t1 t2 Knows an onion come from t1 and Going to t3 But they don't know it's going to s and they don't know it came from you So the relay nodes only know their next neighbors the one that it came from and the next one They don't know the original or the final and they don't even know if the one that they're sending to is the original or is the final Similar with the others What about the exit node? It doesn't know you The exit node receives a packet from t3 and sends it to the server It doesn't know it's you accessing the server. It knows someone is But it cannot identify the original source That was using HTTP This is using HTTPS where we encrypt that HTTP message and the end result The firewall cannot read your data. It's all encrypted. They cannot see that it's you talking to the server Again, those addresses are encrypted Anyone between you and the server cannot read the data. It's encrypted all the way to the end and They cannot see the pair of addresses you and s being together Including the relay nodes and the exit nodes So in fact, we have confidentiality of the data all the way across the path and Privacy of who is communicating from everyone. We don't need to trust the relay nodes or exit nodes With a VPN, we needed to trust the VPN server with a web proxy when it needed to trust the web proxy in tour We don't need to trust any of those So we get with respect to these three solutions the ultimate security We've achieved our aim Questions on tour We're going to keep going for five or ten minutes and we'll finish this topic Everyone uses tour on a daily basis anyone has used tour recently It's quite easy. You can install some software on your computer and It's similar way with I use the secure shell proxy with my browser I can set it up to use tour I'll show you in a moment or in fact an easier way is you download firefox Which is configured automatically to use tour and it immediately uses the network. I'll show you an example before I What do we do we accessed? This was using the secure shell client. Let's disable that Let's go to no proxy back to the original Try again. What is my IP address? Well, that's accessing. I'll stop my secure shell session slow Okay, back to normal internet access I access what is my IP address and it says that Thomas out one. That's normal Now I have the tour client software installed on my laptop and Now I configure my browser to instead of sending direct across the internet send to the tour client software and it's quite easy it's similar to the secure shell proxy, but the tour client commonly uses port 9050 You can change it, but that's the default port number What that means Whatever I do on my browser my browser sends the data to the tour software on my computer and then that Software sends it to t1 t2 t3 exit node and then to the website and The tour software on my computer chooses the relays and there are rules as to which ones to choose and how often to change them But since the software is sitting and running in the background. Let's see if this works While that's accessing I Will start some interface that shows us the tour statistics The software is called arm arm just shows us some Statistics of what we're sending through the tour network the uploads and downloads So it's actually uploading some data and it's actually downloading some data at some speed now So I've accessed that website. Where am I? Where does what is my IP address think I am? Somewhere in Europe, maybe in in I don't know the city. I don't know former Serbia or Croatia or something I don't know the exact location somewhere in Europe We see from Euro net and this is the ISP indicates maybe in that region and The IP address of course is not Thomas up. This is the IP address of the exit node So what I just did my tour client sent to one relay sent to another relay and Then eventually sent to the exit node and then the exit node sent the request to this website So the website thinks the person requesting is The exit node and that will be the address there So I've hidden who is communicating the statistics we can see something about the The connections so the relays in my case I This is my address the Thomas out address The current one I'm connected to this address this other this is a first relay node and Then it Well, sorry, let's be precise my address the first relay node in France the second relay node in the Netherlands and The last node here. We just have two relays and then an exit node in SK. What's that Slovakia? okay, so This example has two relay nodes and one exit node So my data went to France Netherlands and then the exit node in Slovakia and then to the what is my IP address? website So that's the the tour. It's called a tour circuit in this case And you can change that so you'll have a different path and on a regular basis your tour software will change the path If I connect it again or or at a later stage it would have a different path and I would show up as a different IP address here So let's close with a summary or comparison of these techniques I think this picture is hard to see on your slides because you only have black and white But you know it all already. It's just a summary see what it shows us on the rows. We have the four techniques basic means no extra technique and We consider either HTTP or HTTPS and Then using a web proxy either HTTP or HTTPS a VPN and tour So really three security techniques web proxy VPN tour, but we have two options HTTP only or HTTPS and the columns the first five Show some of the security features Do we have data secrecy? That is can anyone read my data? If there's a tick and a green box it means no no one can read my data. That's good We have data secrecy if it's a red and a cross it means that's bad for data secrecy Someone can read my data so for example With basic HTTP we have no data secrecy with HTTPS we do our data is encrypted with a proxy With HTTP again no data secrecy. That is someone can read my data with HTTPS We do actually have secrecy Except we must trust the proxy So I say there's a question mark here. That is it's not full secrecy because we must trust the proxy in that case With a VPN we must trust the VPN server If it's your server, you of course trust your own device So that's okay, but if it's someone else's VPN server you must trust that and With tour if we use HTTPS we have data privacy The next column can we bypass the firewall all three techniques? Yes without them. No Because all three techniques we changed the destination address If the firewall was simply looking at the destination IP address Then we can bypass it with a web proxy VPN or tour Network privacy and server privacy network privacy Can someone between you and the server identify it's you talking to the server? Server privacy can the server identify it's you talking to the server? That's the difference Well, they all do the three techniques provide privacy, but there are some exceptions in some cases for example a proxy Knows that it's you talking to the server the VPN server knows it's you talking to the server So you must trust them With tour there's no one to trust there. We have the the full network privacy Do we have privacy from the server? Yes, but be aware the server can still identify you if you log into that website Or use other techniques to try and track who you are So it's not perfect if you use other techniques to to identify you We didn't say much about log analysis, but the idea is that You use these techniques today and then in a month's time some law enforcement agency or some government comes to your VPN server your web proxy operator and Can they then look at the logs of those different companies and find out that you contacted the the website? so that's the idea here or What would that? Agency need to do to find out Well, if you use a web proxy They would need to contact the web server and the proxy server and get their permission to see their log files If you're using a VPN you must they must contact the VPN operator With tour it's quite hard for some other agency to try and find out based upon the past Access what happened the last three are not security, but cost which one's cheapest Which one's easiest to use and which one performs the best Basically tour is free the other two may be free or maybe a pay-per-month. There's different options Which one's easy to use with a web proxy is simply use your browser pretty much anyone can do that With a VPN you need to set up some software or set up some configuration on your operating system and With tour you need to install some software With performance tour is generally the worst because you go via multiple different nodes Okay, he is not just one VPN server to send via but multiple relays in an exit mode So the performance can be much worse than the others and the others that performance depends upon Where the servers are but generally tour is worse than the others none of them none of the techniques Will give you the best performance Which one's best? tour Unless you want good performance Then maybe you need to go back to a VPN Unless you don't want to pay money and maybe you go back to a free web proxy unless you don't trust that web proxy server then So there's no one best solution you need to consider your requirements But generally the speed of tour is improving so it's now considered one of the better options If you're prepared to install the software and sacrifice a little bit of performance This slide we will not go through talks about the different tunneling protocols We demonstrated secure shell, but there are others I'll let you explore them and find out how about how those different tunneling protocols compare