Hi, welcome to KubeCon 2022 in Valencia. This session is about supporting edge devices using Kubernetes along with other open-source tools. I'm Steve Wong of VMware representing the Kubernetes IoT Edge Working Group, and I'm joined by Kate Goldenring of Microsoft. Unfortunately, Kilton Hopkins of Edgeworks was also going to join us, but he can't due to a death in the family, and our deepest sympathies go out to him. I'm going to cover a process for onboarding a host device to run Kubernetes. Then Kate will address onboarding of connected devices. Finally, we believe that recent technology is going to be disruptive in Edge. It's going to be big, really big, and you can be a part of a community that changes the world, and at the end we're going to tell you how to get involved. Devices don't just have a purchase price. There's an added operational aspect. Onboard is the process of taking a new device and initializing it to begin using it. I'm going to talk about secure device onboard. This open-source tool is specifically for putting a device in service at a remote location. Physical access can be challenging. Staff at Edge can be untrained and untrusted. What you'd like is to use existing logistics to ship a newer replacement device and put these in service using a random person trusted only to plug in the power and network cards and turn it on. No log-on or credentials needed. Secure device onboard does this even with headless or keyboardless devices. I want to make it clear what problems face this covers and what it doesn't cover. This is intended to do a one-time initial update or install of software. The scope is the software running after a boot, so from the OS level on-off through a container runtime, a Kubernetes distribution, and other things that run above the OS. I suppose that if you had an executable that updated firmware without triggering an immediate reboot, a one-time firmware update might be possible too. The open-source reference implementation of this has support for Linux devices and a couple of embed ARM devices. Using the spec, I believe you could write an implementation for other platforms, but this diagram covers what is out there today on GitHub. These are the players in history of the project. Intel originated this work and contributed it to the LF Edge Foundation. Secure device onboard and Fido device onboard are two names related to the same thing. The Fido Alliance is shepherding the spec. The LF Edge org is publishing reference open-source implementations of the spec. This requires a manufacturer to host a couple of servers. The manufacturer server is for in-house use. The rendezvous server is used by device owners and the devices themselves after a sale, and when this happens, the use of that rendezvous server is limited to a couple of brief one-time transactions. There's also an owner server not shown in this diagram that I'll cover in a moment. Open-source reference implementations of these servers are published on GitHub. They might not be sufficient for your production needs, but the spec is open if you want to build your own. I'm not going to cover how to deploy these servers. I just don't have time to do it in 35 minutes, but I'll tell you that Docker versions of these are out there, and I'm going to present a demo that already has these things deployed, and I'm not going to show you how they were deployed. After a device is made, it runs code that interacts with the manufacturer's server over a connection. A device GWID is generated and the manufacturer's server makes a record of the new device's model and serial number. The device itself records a crypto hash of the manufacturer's key and the address of the manufacturer operated rendezvous server that it contacts upon first power-up. This is stored in a TPM or other form of restricted operating environment on the device. Now, for demo, you could leave it on the file system, but that's probably not a safe thing to do in production. I'm going to be doing a demo using what I'd consider a representative edge device, a Dell Edge Gateway 5000. This is a picture of it, the actual unit in my home lab on a workbench with the cover removed. It's a four-core Intel Atom CPU with 8GB of RAM passively cooled with an M2 SSD and a bunch of ports suitable for industrial I.O. devices like CAN bus, RS-485, serial, etc. After sale, a digital voucher for the device is generated and given to the owner. In the voucher, the current owner is at the end of a chain and can demonstrate ownership to the device through use of a private key. The device GUID is in the voucher and is signed by all the owners and in this chain, the manufacturer is first in the list. Remember, the device also has a securely held hash of the manufacturer's key so it will be able to validate the owner when presented with the voucher after sale. The device is not involved in voucher generation. During this generation, it can stay unpowered sealed in a box until it goes into operation. The next step is that the device owner calls an API on the rendezvous server that causes the rendezvous server to host temporary name lookup service, kind of like DNS. And you do this just before you're about to power the device. The owner provides the device GUID and IP where the device redirects to the owner for configuration instructions and a time limit, for example, one hour after which time the lookup service for this device will terminate. The device is still all powered off here. The device will be able to find the rendezvous server when it powers up because remember, this was one of the elements burned into it when it was manufactured. Also observed that the owner is disclosing very little to this rendezvous server and that's intentional. The rendezvous server does not know who this customer is and the IP address provided can be a temporary one, perhaps a burner address, rented on a public cloud or even an address inside a private range that that device is going to be able to get to. So this allows a retailer that doesn't want people to know where stores are opening to keep this information private. Finally, the device is powered on. It first contacts the rendezvous server, gets quickly redirected to the owner address, which is where an owner server is being hosted, and then it connects to the owner server where it gets a device profile that drives the initialization. The owner to device transactions support mutual establishment of trust over a secure channel, followed by delivery of a series of key value pairs that are kind of open-ended in terms of how you use this to initialize the device. The reference implementation for the Linux client I'm showing here is pretty simple. The device gets a bash script and executes it. This connection isn't intended to support bulk transactions of large blobs such as an OS image. Instead, you use the connection to set up credentials and instructions that would allow you to set up a secondary channel for delivery of bulk artifacts. I haven't seen anybody do it, but I actually think if you wanted to, you could conceivably ask the person onboarding to plug in a USB key with an encrypted file signed and perhaps utilize that to cut the amount of network traffic involved if you had bulk artifacts involved in initialization during onboard. This is a recorded demo just sped up a little showing you that manufacturer process when the device was manufactured. I started with Ubuntu installed Docker. I actually, to accelerate this, there's a published Docker image that has the client SDK, so I didn't have to build it. I invoke a script on that client SDK that generates keys for the device, contacts the manufacturer server, gets the stuff burned into the TPM module and makes the record of this device being manufactured. It records it on the manufacturer server. So that was an 18 second video. I do want to shout out to Anthony LaPenia of Portainer for helping me out with this demo. I used a Docker container that he built so I was able to avoid compiling and building my own client SDK. You don't have to use Portainer. You're going to see me doing this in this demo because it has a nice GUI, but the Open Horizon project also supports secure device onboard. I suspect a number of other projects and commercial products do too. So I'm moving now instead of videos in the interest of time. I'm just going to show screenshots, but the process for getting a voucher is pretty quick. You can look at the one liner using a Docker container here. This doesn't have to be the device and shouldn't be the device. It's just you the manufacturer pull a voucher and you send it to the customer. So here is what I pointed out with the Portainer service, what's involved there. If you're going to use Portainer, you can set this up to configure where this owner server is as an initial step of using it to drive the process as an owner. You could also do this with code you write yourself, or I believe you could do it with the Postman tool to just call the REST APIs associated with these tools. I haven't ever tried to use Postman, but I believe it would work. You first create that device profile. Like I say, that's a bash script. If you're using Portainer, they keep a catalog of these so you can reuse one for multiple devices. You press the button, it brings up an in browser editor. You write your bash script, save it with a name, and then you can reuse it for multiple devices. This is the example of the profile I'm using in my demo with one omission. Just to fit it in this single slide, I cut out, oh, I apologize. It's kind of small print for the in-house audience, but when you download the deck, it is legible. I left out the part of installing Helm, but this is updating Ubuntu, installing a cube cuddle, a Kubernetes distro, instantiating a single node Kubernetes cluster on the node, and then at the final end installing Helm, which I omitted, and a Portainer agent. At this point, we've got the profile ready and we're ready to use it. If you're using Portainer, you would upload your voucher as a customer and then pick a device name and choose the device profile from a dropdown list. Okay, this is the actual device on board. It takes about 25 minutes to bring up unattended a Kubernetes cluster that is in operation. Obviously, I'm speeding this up, but the steps are the Ubuntu upgrade took a long time. I intentionally wanted to challenge this, so I installed a back-level Ubuntu and took it up to the current. That takes many minutes. It's now downloading a cube cuddle and a Kubernetes distro. It's untarring the distro. This distro happens to be Tanzu Community Edition because I work on the engineering team for that, but it could, I think, be any Kubernetes distro appropriate for edge. MicroKates, K3S, MicroShift, I don't know any reason why this would be locked into anything in particular, so long as you could install it from a bash script and maybe do a curl download, you should be good to go. At this point, the CLI for this distro is invoked and a Kubernetes cluster is starting up. I'm going to skip in this recording showing the helm installed and the portainer agent installed, but you get the idea if you were watching that this thing, oh, and by the way, this is headless, but what I did here just to record this is I did not auto invoke this client thing. You should set it up so it triggers on device boot, but I left it manual, so I invoked it in SSH and was able to get this recording, but you don't have to do it manually like that, but that's what this showed. Finally, we've got a Kubernetes cluster stood up. We want to use this remotely without going there, so you need some means of remote managing it. Now, this is the portainer UI that has a nice dashboard for this. One element of the dashboard, you can see the running pods. I can click on a container to get the logs out of it. They also have a button you click to get a kubectl shell, but an alternative would be to install SSH and just log in there and use kubectl remotely. I want to avoid giving commercial promo appearances, so many of you might be aware that there are commercial offerings made to manage and federate Kubernetes clusters at scale, so those are out there, but I'm not calling out any names because it moves into promo territory and it's an open source conference. This got you, you're running Kubernetes cluster, but you probably also need devices connected to this like cameras and other I.O. So at this point, Kate is going to talk about the tech that handles that. Great. So Steve just talked about those servers that are on the edge, but oftentimes around these servers on the edge, there's a bunch of IoT devices, a variety of kind, gathering really important data. So the question becomes, how can we easily deploy workloads to access this data, manage these devices, and in the Kubernetes context, oftentimes these devices are kind of on the smallest end of the user edge, so they're either smart devices like IP cameras or maybe they're constrained devices that have no extra compute to put anything else on them. So the question becomes, if we can't add them to the cluster in a traditional way as a node, how can we easily bring them into the cluster? And a CNCF Sandbox project that I work on called Aukri aims to provide a solution for this. So Aukri stands for a Kubernetes resource interface because it's an interface that abstracts away the details of discovering a variety of IoT devices, whatever protocol they speak, and it brings them into the cluster by representing them as native Kubernetes resources. And then once Aukri's discovered those resources, it can automatically deploy your workloads to use those devices. And it was built in Rust because we really are focused on those small edge scenarios and as an aside, Aukri also means edge in Greek because we're in the Kubernetes world. Looking a little bit at the details of this, so as I mentioned, we discover a device, then we create a Kubernetes resource to represent it. So what that means is in your pod spec, just as you could declaratively request CPU and memory, requiring that workload is only scheduled to a node that has those resources, Aukri extends that to the IoT space. So you can also request an IP camera. So say you have some monitoring application that you're deploying to the edge and it needs a USB thermometer, it needs an IP camera and it needs some robot arm. Well with Aukri, after we've discovered those devices, created those resources, you can add those to your pod spec requesting those along with your compute resources. And then Aukri ensures that scheduled to only nodes that can see those devices, maybe they're only plugged into those, maybe they're only on the local network of those. And as you can see, I've kind of bolded the protocols there for each of those devices. So currently Aukri, we discovered these devices via our discovery handlers. And we currently have support for three different protocols that we can discover devices for. So Udev for devices in the local Linux device file system, Envif for IP cameras and OPC UA for industrial machinery. But our discovery handler interface is just a simple GRPC interface. So you can implement that in any language you're choosing for any protocol you're choosing, maybe even proprietary. So there's some community members working on XeroConf for MD and S-based, co-op for more constrained environments, and we're currently having discussions around Bluetooth and MQTT, which are also very popular on the edge. So once you add a discovery handler to Aukri, you're basically extending Kubernetes to be able to declare the request a new set of IoT devices. And when we talk about workloads that are deployed on the edge to manage devices, they can kind of fall into these two categories. So the first one is device use. So you want to gather data from these devices, maybe do some pre-processing, only send up some final aggregated data to the cloud. Or maybe you want to just quickly pass some information onto a new workload, or maybe you're doing some protocol translation. So you're gathering data from a USB camera and translating that data to MQTT. Another category of ways that you can use these devices on the edge is managing these devices. And oftentimes in your managing devices, it's short-lived single tasks that are performing some action on that device. So for example, maybe you're configuring the frame rate of an IP camera, or maybe you're performing a whole firmware upgrade. And in Kubernetes terms, these kind of fall into the definition of long-running pods or Kubernetes jobs. So with Aukri, we can automatically deploy your workloads in these two forms, the kinds that we have current support for. So digging into that second one, so the management scenarios, I wanted to walk through a scenario of using Aukri to upgrade the firmware of IP cameras. So in this scenario, we have a two-node cluster on the edge. And if we're going to say it's running KBS, like Steve mentioned, it could be any of these areas to upgrade the firmware of these cameras from 1.0 to 2.0. So the first thing you do when using Aukri is you deploy our Helm chart. When you install our Helm chart, you can also install a configuration. And that's Aukri's custom resource where you say what you want to find and what you want to deploy to what you've found. So when you're saying what you want to find, you're specifying what protocol we're using to find that device. So in this scenario, we'll say we're going to use Envif to find these cameras that you want to deploy to your cameras to perform a firmware upgrade. So after you've applied your configuration to the cluster, Aukri's agent is going to look out across the network. I think we're seeing a microphone device onboard. Really cool. Okay. Great. I hope people have been able to hear me, but we'll probably have questions. Great. So you've applied your configuration and now Aukri's agent, which runs on every node in the cluster, sees that. So now it's told, go look for these IP cameras across the network. For every, there's the configuration. For every camera that it discovers, it'll create our second custom resource definition, which is an instance. And that represents the device. It's current usage, some metadata about it. And when I say current usage with Aukri, you can also constrain the amount of workloads that can simultaneously use a device at once. So that's also represented in the instance and maintained there. So once the instances have been created, our controller then sees that, and it will automatically deploy the workload you specified. So now we have our two firmware upgrade jobs that are deployed to the cluster. They're going to reach out to these IP cameras, firmware upgrade endpoint. So on VIF, it's device management endpoint does have a due system firmware upgrade endpoint. So these, in this scenario, those jobs are just going to reach out to that camera and signal that upgrade. However, not every IoT device has its own firmware upgrade endpoint. So maybe in your current device management solution, you have some agents that run on your nodes on the edge. Well, you could just change your workflow to be that your job that we deploy on your behalf reaches out to your local upgrade agent. And then that upgrades the camera. Or maybe you have one upgrade agent across your cluster, or it's on a different server that you want your job to reach out to. Well, then you could change that as well. So the point of these three different scenarios within this scenario is to say that Akri is really a platform to plug in your current solutions, but it makes it more declarative, just like Kubernetes is supposed to be in general. And at the bottom of the slide I've linked to a CNCF webinar we gave a couple months ago that shows a real demo of this, as we didn't have time to do it here, of performing a firmware upgrade on an IP camera with Akri. So to kind of summarize, the goal of Akri is really to be an open source standard way to connect clusters to connect workloads to your IoT devices and manage your IoT devices from Kubernetes clusters. But in order to become that cohesive standard it really needed to be as pluggable and extensible as possible. And I mentioned some of the ways we've done that, so our Discovery Handler interface, just that GRPC interface, you can really bring anything including your own proprietary protocols. You can extend Akri to be kind of a generic service discovery if that's of your wish. And then you really do bring your own workloads, which is that second part of it. And then we're really interested, as I kind of focused on these management scenarios with Akri. So we're really curious, how are you bringing in your own current device registries, your own certificate store solutions for IoT device management? Are there headaches when doing that with Akri and how can we ease those? Because those are some really powerful solutions that we want to make sure we're supported. So that's kind of a call to action to let us know how we can help there. And some resources to learn more. We have our documentation site. We have a demo, so it even helps you set up some fake devices in case you want to try it out.  We do have monthly community meetings. We have our Slack on the Kubernetes Slack, the Akri channel. And then once again, this is a link to that demo of IP camera upgrades. So kind of stepping back again. So in this whole talk, we've talked about first provisioning servers on the edge, and then also giving these servers access to those IoT devices. And there's a variety of scenarios that fit this. There's a variety of devices that fit this. And so the working group is really trying to build cohesion around the heterogeneity of the edge. The cloud's very homogeneous. The edge, we have so many different devices, so many different scenarios. And one thing that we found in particular over the past few years of the working group is that we extend beyond Kubernetes. So all the technology we've talked about today, Akri, it's not in the Kubernetes source tree. It's an add-on. SDO doesn't need to be provisioning Kubernetes. So there's really edge solutions that go beyond Kubernetes. So our working group is transitioning from Kubernetes to the broader CNCF as a working group. So we're going to fall under the runtime tag. And we're going to redraft our charter as a part of this process. So if this piqued your interest, and you want to be a part of that process, please join our working group meetings. Here are those resources. We have bimonthly meetings, both in Europe time and US time. And we also have all of our meetings previously recorded. If you're kind of curious about what we've been talking about in the past and the Slack's also a great place to kind of plug in as well. And with that being said, this is about us, how you can reach out to us. If you have any questions outside of this Q&A, we're going to actually have about 10 minutes, which is great to see. And with that being said, we're happy to take any questions that you have. And I saw you taking pictures, but the deck is available there. And usually these KubeCon's, the actual video probably gets posted on YouTube in a couple of months would be my guess. So if anybody's got questions, please raise your hand and let's get the question recorded on the mic so that the remote audience hears it. Don't be shy. It has to be the first one asking. How does all collide with the project matter? Because I saw that this edge node somehow collides with the border router concept there. I don't know if those border routers fall behind the edge node that you are designing in this working group or it's really the same concept. I'm not sure I understand the question. Are you talking about the onboard of the device as it first powers up or something related to the arc? It's more about the concept of the item. Let's say the node or the edge node in this working group and the border router concept in the project matter connected home over IP. And they are also working the secure commissioning and onboarding and provisioning of the devices. And I guess that they are also probably basing the decision in the final alliance. I don't know if there is some working together with those kind of people or not? Yeah, I've never noticed anybody working on any border routing group showing up to the meetings of this group. There are people who support scenarios where they are what they call air gapped where they don't connect up to the private public internet on purpose for security or just because it's problematic. Right now that spec I know for the secure device onboard that I talked about kind of was the reference implementation sort of implies that this manufacturer server is out there in public that at a location you can get to. But I'll tell you one way around that is in my demo effectively I made myself the manufacturer. I put up my own manufacturer server and in that case I could have had the whole system for that behind within my organization's confines with no outside access whatsoever. So that would be one thing that I believe would work. But if you go read the spec they initially I think targeted a scenario of the main manufacturers Dell, HP, whoever running these servers there's no reason you can't just get one that thing I used on a demo I just bought on eBay generic Linux box that happened to have a TPM module in it blew it out and essentially remanufactured it by starting from scratch at the BIOS level. The other thing that's in the spec but not working now is they have a plan to implement protocols like co-app for devices that wouldn't even have IP connectivity but I don't believe that that has been implemented right now but it is in the plan and if you were really eager you could probably help out by helping build that out it's been architected to allow it so I'm not sure if they answered your question but it's probably the best I can do can you hand the mic to the person right behind you? Hello, very nice presentation very nice projects I wanted to ask if you have explored the problem of at the end of onboarding providing a cryptographic device identity that you can trust you can use for example to trust that device or to have devices trust each other There's no reason you can't have that be part of the owner onboard so the spec where the device connects to the owner of the server exchanges key value pair so part of that payload could easily be keys, certificates whatever addresses for where you establish secure tunnels so I think that that might be the process that you used to I think at that point I was wondering because that is something I think it's not really defined for example in the FIDA standard when you onboard Yeah, they specifically didn't try to do things like day 2 operations just to keep it simple enough but the contention is they allowed you to install tooling that supports day 2 maintenance operations and there's plenty of people out there in enterprises that already have sort of a legacy system for managing those securely so the thought is that maybe a lot of those users aren't going to switch to something new anyway so that if you boot it up to the point where they can use what they're used to and already have in place that would probably be the most popular solution. Yeah, I was wondering it's a problem that everybody will need to solve at that point so maybe also like trying to bring some sort of standard or tools that maybe you have incorporated the other day at the third manager project they pointed me to the SPIFI project that maybe could be interesting for this. Yeah, the other thing is you know you say oh it's easy with these key value pairs but if you look at a threat model you really probably ought to put those into the TPM module because these edge devices for the common use case are probably not physically secured so you have to worry about people stealing them breaking into them undetected and all these scenarios so you clearly want to have some kind of tamper resistant storage in there to hold keys and things and just the fact that you got these key value pairs didn't get it into the tamper resistant storage but if you're executing a bash script presumably you can come up with a means to put it where it needs to go either you know TPM they have these puff modules that are lower cost or what I mean that's a very rapidly moving area and this vital onboard really didn't constrain you as to what secure store you have it's kind of open-ended but you realistically ought to have one any other questions we've still got time for one or two here let me get you the mic thank you thank you guys great presentation and you know thanks a lot I really enjoyed also the live mic on board during the session that was great as well so yeah I'm coming from the telco space and when we hear about aids immediately we go into our 5G Mac solutions if you know multi-access edge computing and I was wondering if you do things in these areas as well or it's totally unrelated in this group we've had a history of telcos but I have to say that the bulk of the conversations are not telco specific there are other groups out there that pretty much all the audience are telco interested and even within telcos I think you mentioned Mac but software defined radio there's so many niches in that stuff that I think it's even somewhat forked in terms of where those things go the biggest organization I'm aware of was something that started way back in the open stack days and a lot of telcos were using open stack technology rather than kubernetes but it's morphed into covering a bit of kubernetes and I think it has the broadest user base if you wanted to find that out it's not under the CNCF but I think that a lot of that telco conversation they have so many things to worry about that certainly things going on in this group are relevant but it's by no means telco focused this group is pretty broad covering kind of the general things that everybody needs I would say and historically it's been general things everybody needs related to kubernetes but when we move it over to CNCF maybe we'll go a little bit broader than that the kind of the latest cool kid talk that's been leaking into our group is web assembly where there's a lot of talk web assemblies like a cool technology that is kind of something container like like docker but smaller packaging tiger sandbox lower startup latency less variability in the latency and CPU agnostic and that kind of is weak being a member of this group for years it kind of transitions into cool technologies as they're evolving kind of at a general what if level and we move on to other things so it's kind of a general interest thing not specific to one use case like telco any other oh follow up go ahead thank you very much we have time probably for one more and while the mics being passed if you're trying to find a space for that like 5g community it might be worth joining the slack and kind of asking if anyone else is there having the same question because there is a fair user base already in there thanks for the talk it's quite interesting are you doing any collaboration with like on the firmer side on the boot loader side with like ufe or edk2 which is this tiny core thing well this group is not and I've been I really dug through that secure device onboard spec to do this demo and I don't think that they have an interface level that would expect to go they didn't anticipate doing firmware patches like like I mentioned in the talk once you can run a binary if you could get a binary to run at a command line to do a firmware patch I don't see why it wouldn't work although if it triggered an immediate reboot it would probably halt the rest of the script and that would not be desirable in terms of going at the management interfaces that are built in or the boot process no it doesn't it assumes that that thing got booted okay outside the scope of that project do you not say that there's because you have things like you know like Broadcom you know boot rescue thing where if you have a firmware that doesn't flash it comes back up on a rescue image and then you need to go down on the Ethernet level and actually send some magic packets like in the IP camera use case this is important because you're not going to go and get a ladder and go up and get and do some funky stuff with the reset button to flash it where I think as a general principle in all devices whether they're compute or IO devices like cameras the bulletproof ones essentially need to spend the money to make double the fat flash storage there so that you when you're doing an upgrade the original gets untouched maybe with a watchdog timer so that if the new stuff doesn't work and it doesn't come up you can revert to the old one unattended but that isn't something that is really in the scope of our group so far you know we started out being under the Kubernetes project so kind of at a higher level of the stack then firmware I've got nothing against people coming in discussing it but I suspect there's better homes for those talks than our group I don't know what those would be but we've got plenty of people who have that problem but I don't we're not we don't have ownership of any code that solves that problem if you want to come to the group and you're aware of it and want to give a presentation and share it I'd welcome that they're doing something in this direction as well okay thank you very much okay at this point we're past time so we'll break Kate can probably hang around I have another talk I have to go to so I've only got a couple minutes if you want to say hello and set up a meeting later I'm willing to do that but thanks for coming it's been great like I say if you liked it start coming to the working group meetings look for the space because as we move maybe some of our URLs and things for this group are going to change that should happen in the next month or two but once again thank you thanks everyone


Hi. So I'm glad to be able to join you all today. My name is Steve Newell. I'm from the American Association for the Advancement of Science, which is the world's largest multidisciplinary scientific society, where I'm project director at the Center for Scientific Evidence and Public Issues, usually referred to as the EPI Center. The EPI Center works to provide accurate, concise, and actionable scientific information to everyone from policymakers to parents to help ensure that science is a part of the decision-making process. Election Security has been one of our major initiatives since founding of the Center. I'm sure many of you are already familiar with it, but Susan Greenhall is currently a senior advisor on election security at Free Speech for People. He's well known in the election security space for tireless work advocating for secure election protocols, paper ballot voting systems, and post-election audits. Susan and I are here today to talk about leveraging electronic ballot options safely and securely during the COVID-19 pandemic. This presentation is based on a white paper with additional detail on these issues that will also be available. As I'm sure all of you here are well aware, COVID has scrambled existing policies and procedures in every area of the country, and election security is of course no exception. COVID has provided additional challenge to ensuring election security and ballot access during this critical time. Currently, five states vote primarily by mail. However, during the past few months, we've seen states across the country working to scale up their vote by mail options and capabilities as we head toward the November elections. These steps have taken a variety of different forms between states. For example, an emergency executive order in Delaware includes a measure that allows voters concerned about COVID to qualify as sick or physically disabled, allowing them to vote absentee. Just to make sure the evidence is known, researchers have found that universal vote by mail has no impact on partisan turnout or vote share. So vote by mail is really a non-partisan solution to ballot access concerns. Work by Amber McReynolds and Charles Stewart highlighted 204 cases of absentee ballot-related fraud in a quarter of a billion votes cast over the past two decades. As is the case across the election space, fraud is exceedingly rare with vote by mail. Alongside this expansion of vote by mail, states are examining various solutions for remote voting, such as remote accessible ballot marking, which allows voters to receive, and if necessary, mark their ballots electronically before printing the ballot and returning it to their local office. Uokava was expanded significantly in 2009 when Congress passed the MOVE Act to provide greater protections for service members, their families, and other overseas citizens. Among other provisions, the MOVE Act requires states to transmit boldly requested absentee ballots to Uokava voters no later than 45 days before a federal election. However, remote accessible ballot marking is also essential for individuals with disabilities or those who encounter barriers to marking a paper ballot by hand. We know that there is still a disability gap in voting with roughly 5% lower turnout in the 2018 midterm election, equivalent to roughly 2.4 million votes from individuals with disabilities, according to research by the Rutgers School of Management and Labor Relations. So we know that there's an ongoing equity gap in ballot access, which is essential to address. Further, electronic ballot delivery can help fill in the gaps from when traditional mail and voting is either not possible or appropriate. However, it's important to remember that electronic return of March ballots is an incredibly risky endeavor. The National Academy is warned against it in its 2018 systematic review of voting security. Also in 2018, our report Susan co-authored with the Common Cause Education Fund, the R Street Institute and the U.S. Technology Policy Committee of the Association for Computing Machinery provided additional warnings against internet voting. In April, from the EpiCenter, we sent an open letter to state voting officials signed by more than 70 internet pioneers, scientists, security experts, and voting groups urging those officials not to allow electronic return of March ballots. Due to the scientific evidence demonstrating these votes cannot be secured. Importantly, there is no way to conduct a valid audit of the results due to the lack of meaningful voter verified paper records for electronically returned to March ballots. In May, the Department of Homeland Security, the Federal Bureau of Investigation, the National Institute of Standards and Technology, and the U.S. Election Assistance Commission shared similar guidance at going these concerns. Even with the tools and applications available, this activity is still high risk. To be clear to the state, there's still no known technology that can secure electronic ballot return. So with that background, this brings us to remote ballot markings. Specifically, what factors should election officials keep in mind about these systems? Particularly in terms of safeguarding voters' privacy and security. At this point, I'll go ahead and hand things off to Susan to tell you a little more about these systems. Thank you, Steve. And I just have to say it's great to be presenting here at DEFCON, but it's certainly bittersweet to not be able to be in Las Vegas with everybody and at the voting village and seeing all the great work firsthand. So I'm really pleased to be able to present what Steve and I have worked on together with this paper and the findings, even though it's unfortunate that we're not actually there in person. And I just want to preface this by saying that this paper is really geared towards all the election officials that are participating more and more in DEFCON. We're trying to highlight some of the known security and privacy risks of these systems and how election officials can become aware of them and then make choices to mitigate those risks. So back into the presentation, as we're seeing these states expand their vote by mail options, it's really important that there also be an option for disabled voters to mark a ballot privately and independently if they're choosing vote by mail and that they have assistive technology if they need it. So what we're seeing is that there are several systems available in the commercial market which will deliver a blank ballot to the voter in line and then allow the voter to mark that ballot using the assistive tech that they're familiar with on their own device, print the ballot for the voter to return either by mail or a dropbox. So we're not talking about online voting here. We're talking about a way to assistively mark that paper ballot, but what we're seeing is that there's architecture, even though you might assume that it doesn't do this, that actually sends the vote choices back over the internet. The devil is in the details and the way these systems are designed and created. Many of the commercially available systems keep all of the information resident on a remote server so that each time the voter makes the selections on their own computer, that vote choice is transmitted back to the remote server. Now that remote server has already identified who the voter is because they've had to authenticate the voter when the ballot was pulled up and given to the voter. So this creates a set of records on that remote server of both the voter's identity and their vote selections which now can enable all sorts of secrecy and privacy of vulnerabilities or compromises if anyone gains access to that server, either the state, the vendor or somebody who compromises it remotely. Furthermore, each time those vote choices are going back and forth over the internet, they're vulnerable to eavesdropping and spyware. So it's really not advisable from a security and privacy standpoint. And even if that remote ballot marking system isn't designed to send these vote choices back over the internet, the ballot secrecy and the vote choice secrecy can still be compromised when marked online. So we really want to minimize the number of voters that are marking their ballots online to minimize these security risks because those vote selections are going to be recorded in temporarily, temporarily in memory on the on the voter's device as well as their printer. And for these reasons we want to highlight that issue and encourage election officials to speak to vendors and require that the system zero out the vote data upon closing the application when they're making these systems. Furthermore, voters should be encouraged to mark their ballots on their own devices if at all possible and to not use their work computers or any publicly available computers, which could also invite other opportunities for secrecy violations. Furthermore, it's also always important to know that there's a risk that the ballot marking system might not report the votes correctly. There can be bugs, there can be malware. For these reasons, voters should always be instructed that if they can to mark the ballot by hand to mitigate these privacy and integrity risks. And if they need to use the accessible technology and mark the ballot by their device, that they should always be encouraged to check the vote choices carefully and election officials are encouraged to disable the barcode feature on the ballot marking system and remake the ballots directly from the voter selection so that you don't have any issues that maybe the barcode is is reporting vote correct vote choices incorrectly. This issue has been looked at years ago by National Institute of Standards and Technology and the Center for Civic Design, which does a lot of work with voters with disabilities and providing accessibility. Both have provided clear recommendations that any remote accessible ballot marking system should not transmit the vote choices back over the internet to remote server and they should be designed so that all the vote data remains local to the voter's computer in a stateless state, I guess. It's important to note that the accessibility of these remote accessible ballot marking devices isn't not impacted by the configuration in either way, meaning you're not giving up any accessibility to provide a more secure and private remote accessible ballot marking system that keeps all the information local to the voter's computer. So there's no advantage to introducing these security and privacy risks. It's only upside to to to look for these devices that make these that that are right here to this design best practice. So California is a good state to look at that looked at these issues and put the policy into practice. In 2012 in California it was moving to largely a vote by mail state. It wanted to make sure that there was accessible remote ballot marking options looked at these recommendations from NIST and others and passed a law that prohibited the use of any remote ballot marking device that or system that transmitted the vote choices over the internet. And as a result they have certified three systems that are currently commercially available and that meet this design best practice. So their system is out there right now today that can be adopted and and will protect the voter's secrecy. So just to to give a quick summary of what we've just covered, state should be encouraged to adopt offline accessible remote ballot marking systems for all voters as they expect or for voters that need it that may need it when expanding vote by mail. The voters should also be instructed to carefully check printed ballots for errors. States should be required states should require the vendors to offer systems that delete vote choices from all the memory when the application is closed. Voters should be encouraged to avoid using networked or public devices if possible and election officials should consider disabling the barcode feature and remaking ballots directly from the voters choices. So now we're going to look at the risks of online blank ballot delivery and I'm turning it back over to Steve. Thanks Susan. So as Susan mentioned how do we minimize risk with online blank ballot delivery? The National Academy's report in 2018 described online blank ballot delivery as acceptable and the recent DHS guidance described it as low risk. However it's important to remember that low risk is not no risk. So the risk with blank ballot delivery systems are those that would impact the integrity and or availability of the ballots such as altering or removing vote choices. Some electronic ballot delivery systems perform functions to verify a voter's identity before presenting them their assigned ballot. The identification process can use personal identifying information such as name and driver's license number or biometrics. While when this verification is improperly configured remote electronic ballot delivery systems can present additional privacy risk such as the loss or theft of the voter's personal and or biometric identity information. Voters who have had their information stolen or harvested previously could have their ballots at risk especially automated attacks. Speed and efficiency of automated attacks can increase the impact of these attacks considerably. Further many ballot scanners cannot read ballots printed from voters home printers because the paper weight and size are incompatible. So vote so the voter selections must be hand copied onto traditional paper ballot stock that can be read by those scanners. This can be a time and resource consuming process the burdens already limited election staff and volunteers. The copying process also presents a potential source of inaccuracy as even an incredibly low copying error rate could impact elections if the volume of copied ballots is sufficiently high. Importantly the original returned ballots should be kept for auditing purposes. Finally this might also create a health risk for election workers who are typically directed to sit in pairs in order to prevent manipulation or fraud. Without transparent oversight or strict security protocols this process introduces opportunities for error or tampering. So here I'll go ahead and turn things back over Susan to go through some of the best practices and recommendations to keep in mind as officials prepare for the upcoming election. Thanks Steve. So we're just going to summarize the takeaways. We urge election officials to follow the best practices of NIST to only adopt and certify remote accessible ballot marking systems that can find the vote selections data to the voters devices and remove the choices from all memory when the application is closed. To limit the use of electronic ballot delivery only to the voters that can't get a mailed pre-printed ballot so that you're limiting the risks of that online blank ballot delivery that Steve just talked about or limited to voters that may need an electronic ballot to mark the ballot with a remote accessible system. To urge election officials to make printing the blank ballot the default default action of any ballot downloaded to encourage the voters to fill out the blank ballot with a pen before mailing it. We also encourage voters who must use a accessible remote ballot marking system to use their own personal devices networks and printers if at all possible rather than others infrastructure unless they may have some privacy concerns at home. Recommend that no voter should ever enter vote choices into device that's connected to the internet and maybe we skipped over that but it's ideal that the device should be disconnected from the internet once the ballot is downloaded when the marking process is being executed. Instruct voters who do not mark their ballot with a computer or device to care I'm sorry who do mark their ballot with a computer device to carefully check and verify that their vote choices were recorded correctly. To election officials we also encourage that they them to disable the barcode feature and to remake the ballots directly from the voter selections retain that original ballot and use the human readable part for all audits and recounts so that you have the original record of voter intent when doing an audit or recount not from the remade ballot and consider electronically delivered ballots to be at higher risk for unauthorized duplication and consider authentication of the voter's identity and eligibility when looking at those ballots. So I think we can wrap up with that. Any final words Steve? No I think he covered it all Susan. Great thank you all so much. It was great to be able to present this information. The paper is on both of our websites if you're looking to to get more information and thank you very much. Thank you all. Hope to see you in Vegas next year.


Our next speaker this afternoon will be Dr. James L. Bernat, the Lewis and Ruth Frank professor of neuroscience at the Dartmouth Medical School. Jim received his MD from Cornell University and then trained in internal medicine and in urology at Dartmouth. Jim, did you tell me this is your 40th year at Dartmouth? 40th, yes. Dr. Bernat is the director of the program in clinical ethics at the Dartmouth Hitchcock Medical Center. He served for 28 years on the American Academy of Neurologies Ethics Law and Humanities Committee. Ten of those 28 years, Jim was the chair of that committee. In 2011, he received the Presidential Award from the American Academy of Neurology, the Lifetime Service to American Neurology.  Jim, Bernat. Mark, thanks very much for the introduction and especially for inviting me here today. It's a great honor. I have some few disclosures, which is now to reger at any kind of meeting, but I don't think that any of these are going to influence what I say perhaps other than the last one serving on a national panel that's looking at the question of circulatory death. My learning objectives today are to look at the question of death determination in critical care. Because this is a seminar on ethical issues in organ donation, the original title was death determination in organ donors, but what I have to say is going to pertain to non-donors as well and anybody dying today in the critical care situation. I want to start by reviewing some points about the legal definition of death, talk about death determination by brain tests and highlight a few of the controversies, and determination of death by circulatory tests and highlight a few of those controversies, and then talk a little bit about this panel that I've been working on and what we believe is appropriate for death determination and circulation. First of all, a few comments about ICU death determination. Clearly, the issues have been spurred by the availability of organ donation. Sociologists have studied the impact of organ donation in the development of brain death in the 1960s and 70s, and it clearly spurred this. In the last 20 years, the organ donation after the circulatory determination of death has spurred a similar attention to precision on identifying if possible what is the moment of death, and there's where a lot of the controversy occurs. We would look at the DBDD or brain death determination and DCDD, which used to be called non-heart beating organ donation and donation after cardiac death. Ironically, perhaps, although the brain death controversies have not been resolved and have not disappeared, there's less written and spoken about them now, and there's much more of an active controversy about some of the issues regarding death determination in the circulatory death donors. What we're going to do today is have a point counterpoint where I'm going to present an approach, and then after I speak, Bob Trug from Boston Children's is going to present his position. Those of you interested in seeing a similar point counterpoint in print can look at a chest, the journal Chest in 2010, and I'll show the reference of this soon, in which we conducted a similar debate that is in print. Let me start with the legal determination of death or legal definition of death, and there are lots of different ways to look at the question of the definition of death. There's a medical, there's a legal, there's what one might call an ontological or bio philosophical, there's religious ways of looking at this. So the way the law looks, and I think everyone in this room knows, the Uniform Determination of Death Act, which was proposed by the President's Commission in 1981, and to a greater or lesser extent has been incorporated into statutory law and the overwhelming majority of states, and it provides two different criteria, a brain criterion and a circulatory criteria. And the words that I think one might pay attention to here are irreversible and circulation, and I'll be coming back to those later. And finally, the last little comment of death, determination must be made in accordance with accepted medical standards. Now these two criteria are not independent, and reading carefully the text of Defining Death, the President's Commission report, which was the fundamental document defending the proposition of the UDDA, it's clear that the primary criterion is the brain criterion, and the circulatory respiratory criterion becomes valid only because when it exists, it leads to the brain criterion, and only really in the presence therefore of supported respiration does the brain criterion need to be tested directly. Now let me say a few words about brain death, the irreversible cessation of all of the brain's clinical functions as human death, and of course this is a misleading term, but it has been come standardized both in medical and in popular culture, and has been more or less accepted throughout society and biomedical practices, although a number of studies going back decades and still present show there's epidemic confusion about what this means, and there are probably fewer active controversies about this now. Looking worldwide, ilcovedics from the Mayo Clinic reported 10 years ago that at that time there were, in addition to all the states in the USA and all Canadian provinces, that was practiced in over 80 countries, and the critics, some of whom are in our audience and in our speakers panel here today, irrespective of the merits of some of the arguments which I believe have merits, these have not created the traction necessary to change anything, and when this has been looked at carefully by high level commissions such as the Institute of Medicine review that was done in Cleveland at Case Western in 1995, culminating in that book published by Stuart Younger at all, editing it in 1999, there was a belief that the way things are works well and should be left alone. The more recent analysis by the Presidential Council published in 2009 reached a similar conclusion that yes there were some defects in some of the conceptual parts of this, but as a public policy it is working well and should be left alone. Now the critiques, and I'll just summarize a few of them and you'll hear more than by the next speaker, are first in a, if you will, an ontology issue that it's not really what we mean when we say that someone has died. Alan Schumann from UCLA clearly made the point that the integration of subsystems rationale that I and my colleagues, for example, 30 years ago cited as one of the justifications, and I'll come back to that in a moment, was inadequate and the President's Council accepted that as true and came forward with an alternative justification, a rationale which Alan also felt was inadequate, but in any event that point has been made. Bob, in his writings, eloquently has said that it's in a way an unnecessary an agronism that the concept arose in an era when it needed to be respected in order to accomplish certain things that now could be accomplished through other ways, such as discontinuing life sustaining therapy that wasn't possible to do in the late 1960s and early 1970s, and this was a solution to that problem. And similarly, organ donation, and again Bob will be talking about his ideas about that, that it can be done by consent if the patient is beyond harm, dying beyond harm. Religious opposition a little, although in most settings it's not a common issue. Now, what I'd like to do is just very briefly, and I apologize for going through all this material so quickly, but I know we have an audience of sophisticated people who are familiar with a lot of the work that has been done on this. I want to talk a little bit about the biophilosophical analysis that my colleagues at Dartmouth and I proposed in 1981, and I've refined several times since then, that provides an approach to this problem. And I think it's fair to say that even most of those who disagree with some of the substantive points that we made and some of the assertions that we have made agree that this type of analysis itself is fruitful and is a reasonable approach. And we came up with four sequential steps. The first was the paradigm stating the preconditions that frame the analysis, then the definition making explicit the ordinary meaning when we use the term debt, the criterion of debt, a general measurable standard that can be incorporated into a debt statute, and the tests of debt, which are done by physicians to show that the criterion has been satisfied. So if one looks at the paradigm conditions, either the ones we came up with, and not everybody accepts these, but what they are is to clarify that the meaning of the consensual usage of the non-technical word, it's not a technical word, and not to contrive a new definition the way some attempts are, if you will, redefine debt, but rather the ordinary meaning has been made ambiguous by life-sustaining technology, and we can't rely on it anymore and we need to look a little more deeply. A second, that death fundamentally is a biological phenomenon. It's the cessation of life. Life is a biological phenomenon. It has social, anthropological, legal, religious, cultural, etc. aspects, but it is fundamentally a biological phenomenon. We restrict the analysis to higher vertebrates. We're not talking about deaths of cells or tissues or organs or unicellular organisms. Those are valid, but not the task here, that the term applies only directly to organisms and other uses are metaphorical, like death of a culture, and specifically death of a person, and we'll come back to that a little bit, that the organism resides in only one of two states, alive or dead. There aren't in between states. You're either one or you're the other, and therefore death is an event out of process, and in fact it's the event separating a process of dying, which is a process, from the process of disintegration of the body, which is a process, and it's that event. And even though it's an event, we may not know exactly when it is, we may know it only in retrospect, but theoretically it's an event, and of course it's irreversible. Then the definition that we chose is the irreversible cessation, a function of the organism as a whole, and I want to talk a little bit about that concept. The criterion is a brain, whole brain, criterion, irreversible cessation, a function of critical number of neurons in the whole brain, and the tests have been put forward by the American Academy of Neurology, the Canadian Medical Association Journal last year by the children's criteria by the multi-society task force. So the organism as a whole is important to understand, to understand this. It's not the whole organism, but it's that functioning that is greater than the sum of the parts of the organism, and it looks at the question of the unity and wholeness and integrity of the organism. And this concept was first discussed in the early part of the 20th century in a text by Jacques Leub, the Rockefeller now university biologist in a book entitled The Organisms of the Whole, published in 1916. Now, bio-philosophical analyses of this talk about emergent functions, these concepts that individual subunits when they're operating together from those emerge functions that cannot be reduced to any single component of those, but rather emerge spontaneously in the presence of these. And this is the concept of wholeness and unity that we're talking about, and that there's a difference between the life of a component of an organism and of the organism itself. And that's really essential to grasp here so that the definition is the universal cessation of the critical functions of the organism as a whole, and the criterion is the whole brain criterion. And what is a brain that patient, but we say is dead, but subsystems of that patient clearly are a lot. There's quite a bit of that patient who remains alive, but not their organism as a whole. And the whole brain criterion, in addition to being coherent in that way, permits certain other attractive features from a medical perspective in terms of determination that are attractive to neurologists, neurosurgeons, and intensivists who are those who are called to the bedside to do these determinations.  So these tests of death, the cardiopulmonary tests are sufficient when there's no cardiopulmonary resuscitation or mechanical tracheal positive pressure ventilation, and the brain death tests are used when this is used or planned, and the tests must have no false positives or negatives. The society has been very concerned about false positive death determination. This is a painting by the Belgian artist Antoine Viertz hanging in the Viertz Museum in Brussels occurring during a cholera epidemic when there was a false positive death determination, presumably someone who was hypovolemic shock with no blood pressure and no palpable pulse, but was still alive. And this type of painting, and of course the works of Edgar Allan Poe, similarly looking at premature burial, which is the English translation of the French title. And this type of device, many of you have seen this image before, sold quite a few units in the 19th century where people would be buried in these special caskets in case the doctor had made an error on death determination. And there were elaborate treatises written about the signs of death to prevent this sort of thing. And of course the examination of the brain death patient, which I'm not going to go through here, but all of you are well aware, and this is from Vedic's paper in neurology a couple of years ago, which is the brain death standards for adults from the American Academy of Neurology with the usual knowing of structural lesion excluding reversible causes and responsiveness, cranial nerve reflexia, proper athlete testing. So a quick review of some both bio-philosophical justification of the concept of brain death and some of the testing and so on that we have. I'd like to change gears now and to move to the second subject I wanted to cover today, which is the death determination in after circulatory determination of death. And again, I'll use as a paradigm the patients who are in the DCDD protocols, which I'm sure exist in the majority of medical centers of people here. But for those that don't have a lot of firsthand experience, let me just briefly summarize it saying that the usual situation is of a dying ICU patient who is ventilator dependent usually with severe brain damage, although they're not categorically limited to that group, but they're not brain dead. If they were brain dead, one wouldn't need to go through this exercise. They would simply be declared. But these people are not yet because of the magnitude of the damage and the poor prognosis neurologically families make a decision to withdraw life-sustaining treatment, which as you all know is exceedingly common and is a very common modus of death in ICUs throughout the country. However, in addition to that they would like the patient to serve as an organ donor. So the protocols essentially link in time the readiness of the surgical team to do the donation with the stopping life-sustaining therapy and death determination. And this has been well described in a number of papers. But the controversy of this has been present since the beginning. If you look back at the original work from the University of Pittsburgh Medical Center where this protocol really, it wasn't the only one, but it was the most well reported and highly publicized one of this type. There was significant question raised then and now on the same question, which is, is the donor really dead at the moment that they're declared dead and taken to the OR for organ procurement? And basically the argument went that I mean the way it's done of course is that in Pittsburgh they would after dialing down ventilator or excavating the patient however it was done the heart would stop beating and they would wait two minutes by the clock and after two minutes of assistively they would declare the patient dead with them to the OR. And the question was that two minutes after assistively are they really dead given the fact that we know that some of some patients could have their heart restarted and circulation regenerated therefore by cardiopulmonary resuscitation. Now we know that these people have DNR orders and they're not going to do that. But that doesn't matter because what if you weren't going to do that? This would be possible and if death is by definition irreversible then something's wrong here because you've just reversed something. And as it violates the death statute which says irreversible on the UDDA and the question that we'll be discussing later has to do with the death donor rule should that be suspended or abrogated or is that necessary anymore? Now each institution who have DCD protocols have their own standards for death determination and most I can't I haven't surveyed them all but there is a report that's looked at all of the protocols as of last year in the United States and Canada. The majority follow the IOM recommendation of five minutes but some still do what Pittsburgh does at two minutes and I'm sure all of you read the paper in the New England Journal in the fall of 2008 from Denver Children's Hospital where they did three successful neonatal heart transplants from DCDD neonatal donors and in those in the second two they started out with two minutes but then they asked the Ethics Committee if it would be okay if they reduce the required interval of asystole from 120 to 75 seconds which they approved and that was done in the following two. So there's this odd-hook part of this whole thing that's not very satisfying and we're going to be talking and this was the paper the butchett paper that was in the New England Journal and all of the protocols except for experimental ones being done in this country now are the so-called control like the paradigm I gave where they're in the unit the decisions made to solve their life's the same treatment it's stopped they're watched everything is under control the so-called uncontrolled once of course would be the people in or more likely out of hospital who just dropped it of primary cardiac arrest usually a primary fib or a systolic arrest and then if they can't be resuscitated then they would be an organ that's the so-called uncontrolled I'm not going to be talking too much about that but I'll mention well what happened was I had when they did this they asked several of us to write little papers and Bob wrote one and I wrote one and Bob Beach wrote one also that was these little perspective articles in the New England Journal that a company of paper that they anticipate is going to have a controversy and it did and there was quite a bit of controversy about this and some of the controversy focused on whether the person whether these babies were in fact dead at the moment that their hearts were taken out part of it was about the shorting of the interval and all that sort of thing and part of my commentary had to do with gee you know it's not right that there that every protocol will have a different depth of termination there needs to be some uniformity and the uniformity should be based on a reasoned data driven and to some extent consensus driven approach to this that has some kind of uniformity so the HRSA that had funded that funds these experimental organ donation protocols did put a panel together and we worked on this in the control setting right from right after that until 2010 and published this paper and I'm going to be talking a little bit about some of the findings in this paper so some of the issues regarding the legal definition of death that our group tackled had to do with the fact that the UDDA and the President's Commission chose the term irreversible but didn't define what they meant by irreversible in fact when you read through the document defining death they use the term permanent and irreversible interchangeably but there's an important distinction between those that I think and our group thinks is important to understand and these despite the fact that they've been used synonymously there's an important distinction there by the Oxford English Dictionary irreversible means cannot be undone irrevocable and it's an absolute and univocal thing it's essentially impossible at least with current technology whereas permanent means continually without change or enduring and that's an equivocal in a contingent condition that it's contingent on certain conditions without those without which they it doesn't exist so those are some points and so irreversible means cannot reverse using current technology permanent means will not be restored spontaneously or through intervention and if you look at the set of permanently lost functions they encompass those that are lost irreversibly and those that are lost permanently rapidly progress to those that are lost irreversibly and the question is which of these do we mean when we're saying for the determination of debt and we made the claim and not everybody goes along with this you'll hear exceptions that that the permanence was the accepted medical standard of the application of the circulatory criterion of death in the non donation circumstance terminally ill patient a hospital expected to die getting palliative care as a dnr order they stop breathing their heart stops beating they're immediately declared dead one doesn't require the doctor to prove that it's irreversible by either observing them for 30 or 40 minutes or however long it would take to make it transparent that it was irreversible or to try to resuscitate them and show that that's unsuccessful and thereby prove it's irreversible that is not necessary as long as it's permanent that's sufficient so one of the points about this was that it's already the standard in non donation circumstances one could say yeah but this is different here it's consequential and I agree it is very consequential in this situation and it was perhaps inconsequential in the previous one the non donation circumstance but let's move on to some of the other points about this in a conference in a Philadelphia in 2005 of a group of people involved in this from a variety of areas that included ICU people who were involved in death determination as well as transplant surgeons there was a consensus that when we talk about a Sicily we're not talking about electrical a system we're talking about mechanically a Sicily or so-called pulseless electrical activity because the issue in death is circulation not cardiac function and part of the confusion was that a former term of this was donation after cardiac death and I use it myself all of us did but that isn't really the issue and you look at the udda or any death statute or the meaning of death it all talks about circulation it doesn't talk about cardiac function now admittedly the heart is responsible for the circulation and the majority of the time except in special technical circumstances nevertheless it the distinction between those two becomes relevant here because what we need to show is the permanent cessation of circulation so pulseless electrical activity that does not lead to circulation counts as a Sicily commonly seen in cardiac arrest our group said that pulse palpation as a means to determine cessation of circulation was not sensitive enough you really needed to have either an indwelling arterial line or echocardiography looking for open and closing of the aortic valve or a Doppler looking for something in the organ donation to be sure that you didn't end up with the patient like the veered space not that we would do that in our units but it's pretty important to be sure and that the question of a Sicily was empirical I said that the permanent you can say that it's permanent when you can show that there will not spontaneously reverse and we will not reverse it so what about spontaneous reversing this is so-called auto resuscitation and some of the early work in this by Mike DeVita from Pittsburgh and other people show that there were these cases of so-called auto resuscitation where the heart would start again after 65 seconds would Mike didn't do and the early work didn't do was distinguish those who restored to PEA from those that restored the circulation and that was done later and this just lists the different lengths that were required for different protocols to try to eliminate auto resuscitation well the Hornby group at Montreal did a very important study published in critical care medicine in 2010 where they comprehensively viewed all published cases of auto resuscitation and they showed an important distinction and that is in plan withdrawal of life sustaining therapy such as that occurs in controlled DCDD there wasn't a single reported case of auto resuscitation to restored circulation yes there were cases to restored PEA but not circulation however in failed CPR where somebody had a primary cardiac rex drop dead resuscitated after 25 minutes the team says this is hopeless we're stopping they stop there have been innumerable cases reported of re starting of the heart to the point of circulation some of it is from the auto peep phenomenon some from other causes but that is a well-recognizing including one case of well documented up to seven minutes after failed CPR so what you can say in the controlled circumstances that after five minutes or some brief time even less than that of of assistly that respiratory and circulatory functions that are lost permanently we know that there will be no CPR and auto resuscitation will not occur and therefore it satisfies the criteria for permanent cessation of circulation in order to prove that we want to do some technique that sensitively measures the presence or absence of blood flow and wait at least two minutes probably even though argue arguably that's a long time because the database on which these data are generated is very small and therefore the confidence limits aren't too hot some comments about the dead donor rule and I don't want to take much more time but I think I have about two more minutes that of course it says the multi organ donor first must be dead in the corollary that is you cannot kill the donor to procure organs and some scholars and Bob and some of his colleagues have written very convincingly about that that if the patient consents for donation and the dying patients be on harm my position and maybe we can debate this a little bit in the Q&A period is that that it I worry about it as public policy because even though in highly motivated and intelligent donors I think it would work well for a general public policy I'm concerned about public confidence in the system so our panel recommended that the C in DC DD be circulatory and not cardiac it's always hard to retroactively change an accepted thing but we I think defended why this should be the issue of circulation and not cardiac function that we can continue to rely on permanence in the organ donation as we do in non donation circumstances that if we do that that correctly applied it respects the dead donor rule we need to use these blood flow measurements we should choose a conservative interval I'd say sisterly until such time that our database of cases exceed extends to such a point that the confidence intervals get sharp enough that we can reduce that it's just a matter of prudence to do that that we had talked about it come we didn't have time to get into that so I don't want to get into some of these other points I don't want to overstay my time here but what I tried to do was to first talk a little bit about the legal definition of death and parse some of the words of the udda particularly their term irreversible and make the point that the physicians involved meant permanent and if you look at the appendix f of defining death it's clear that they were talking about permanent which I think is the medical standard and that it's worth noting that the medical standard may not always be completely congruent with what you might call the ontological approach to this but it's consistent with the medical standard to use permanence that most of the brain death controversies have been mitigated to the point that groups that have studied this including recently feel that it continues to represent a coherent and framework with good public policy that now more of the controversies are in circulation and that these hearsay panel in our paper in critical care medicine a couple of years ago talked about the controlled situation where our group is now meeting and talking about the uncontrolled determining death of the uncontrolled donor which is frankly a much more challenging question thank you very much


Hi everyone, Shawn with jaspyscasebrakes.com here doing 2021 PDV Contenders Draft Picks Football 2 box break, random pack number 7. These two boxes are from a fresh case, so 8, 9, random pack 8, 9, 10, 11 and 12 all from the same case. So 12 spots will first number all 12 packs, number 1 through 12, randomize the list, the numbers and names, whatever number you match up with is the pack you will get. Pretty simple. Here is the list of customers from Gale down to Michael Piccora with Last Spot Mojo and the numbers from 1 through 12. Random pack number 8, the next two boxes from this case is in the store now. And then we'll copy or we'll randomize both of those lists, paste them here and like I said, whatever name your number or your number ends up next to is the pack you end up with as well. And here is the fresh case. So let's pop this thing open, we've got six high stats. So to figure out which boxes we're going to do, we're just going to make it real easy. That is 1, 2, 3, 4, 5 and 6 on the dice. So whatever you roll, those are the two boxes that we're going to do is my lucky dice. It's a 2. So we're going to go with the boxes in row 2. So these, I'll put a little X's on there so we know they're all from the same case. We'll all be for random packs 8, 9, 10, 11 and 12. Random pack 8 break is in the store now. Same setup. 12 spots, 12 packs. I used the Sharpie last time but that word is off so I'll put it on labels this time. So there's no smudging or anything like that. So this is going to be 1 through 6, 7 through, so there is 1 through 6, we'll go 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12. Pop back over here to the randomizer. We'll leave the knit cam on just so you guys can see the packs are still there. Same dice roll for both randomizers. Two and a one three times. So three times on the names, one, two, from Gale down to Gale and three times on the numbers from 11 to 6. Not, I don't think I've ever seen anybody trade for packs but the trade window is open just in case there is a lucky pack or number that you were hoping to get. Gale Ablo with 11 and 5, Michael Peacore with 1, Gale Ablo with 2 and 10, Michael Peacore with 8, Robert Flores with 12, 7, 9, 4, 3 and Gale Ablo with 6. So we're going to sort it by this so I can print out the sheet. And we'll break them in the order of least amount of packs the most, so Michael will go to your two packs which is packs 1 and 8, Gale will do your 5 and then Robert will do your 5. So we'll pop back over here, here's that final list as well. So first up is going to be Michael Peacore with packs 1 and 8. Good luck Michael. Patrick Mahomes and we've got a Victor Dimuk Keiji, college ticket auto out of Duke, defensive end. Victor Dimuk Keiji and a Calvin Ridley Crome, Jalen Hertz in there too. Victor Dimuk Keiji, Arizona Cardinals it says. Cardinals in the 6th round of the 2021 draft. So there's your first pack, pack number 1 and pack 8 as well. You've got Jordan Love, Trevor Lawrence, Jamar Chase. Tua and you've got Auto Peyton Turner, college ticket auto, defensive end out of Houston. And Stefan Diggs is your Crome, Peyton Turner. Peyton Turner, New Orleans Saints, first round. First rounder for the Saints, there you go. Six foot six, 269 pounds. Went to Westside High School, 22 years old. First round draft pick for the Saints. There you go Michael, thank you very much man. Okay, next up is going to be Gale and Gale we're going packs 2, 5, 6, 10 and 11. So 2, 5, 6, 10 and 11. Oh yeah Adam, can't escape the greatness of James Morgan. 3, 4, 7, 9 and 12 will be for Robert so those are his 5 right there. There you go Gale, good luck starting off with pack number 2. But yeah that actually is surprising. Justin Fields and you've got a Pat Freermuth, ticket stub auto, 80 out of 87. He was the pick for the Steelers, I want to say in the second round. And James Connor, conference finals ticket out of 99. A vet quarterback on the Jets, didn't they sign Flacco, Justin? I think, nice ticket stub auto on card. Pat Freermuth was drafted by the Steelers in the second round pick 55 overall. Out of Penn State, staying in Pennsylvania. Not on the team anymore, okay. I think they have some, some late round pick or some vet quarterback on the team. So Flacco's in Philly, William's saying. That guy's just getting moved around huh. Patrick Mahomes and a Joe Burrow. Devonta Smith, another Joe Burrow. Cadarius Tony and we got Samaj Pirine. Legacy ticket auto of the great Pirine family and Lamar Jackson campus ticket. So who is the Jets veteran quarterback? Water. James Morgan and Mike White. That's awesome. I mean, so it's all in Zach Jones then. There's no, no question about that, right? Or does Zach, does James Morgan start the season? Pack six. Jordan Love. Ian Mahomes again. Jalen Waddle. Trey Lance. And we got Drabriel Cox, college ticket auto out of LSU and a JJ Watt campus ticket. Did I say Zach Jones? Yeah, Zach Wilson. Jets fans would ride if Morgan starts week one. Well, I think, I think what'll happen is they'll be, they'll be surprising cuts from the off season this year. There'll be some vets that just don't make it and I'm sure the Jets will pick one of them up. I don't think they're going to go Zach Wilson, Mike White and James Morgan as their quarterback room. Just a, just a guess. Gail, we got two packs left for you. Pack 10 and pack 11, I believe. Kyle Pitts. And we're going Pat Freyermuth again. This one is a game day ticket signatures. That is eight out of 10. That's that second round pick for the Steelers, tight end. And conference ticket of Mari Cooper to $199. Nice low number, eight out of 10 on that one for you. Pack 11. Last pack for you, Gail. Cadarius Tony. And Zach Wilson, we were just talking about you. Jalen Waddle. Travis Etienne and Ian Book. College ticket out of. I want to say, New Orleans Saints. Chase Claypool. Two of them. All the Saints picked up somebody. I want to say it was Ian Book. So there you go, Gail. Those were your five packs.  Yeah, he's Saints. Okay, cool. That's what I thought. John's went to the Vikings. Davis Mills went Texans. Kyle Trask went Buccaneers. Pack three to start for Robert. Trevor Lawrence. Jamar Chase. And we've got a Jermar Jefferson. College ticket out of running back out of Oregon State. And a Robert Woods campus ticket Chrome. To again, I don't disagree with you, Justin. I think a year sitting was good for him. But it is still concerning. You know that he still leads the league in turnovers since 2014. And one, he was drafted in 2015. And two, he didn't play at all last year. And he still leads the league in turnovers since 2014. And that's a scary stat to say. So for a guy that didn't play two out of the year, two of those years in the stat that we're talking about, he still leads it. Pack four. Kofrak wins. Kofrak always wins. Zach Wilson and Herbie. Kyle Pitts. And you got a Spencer Brown auto. College ticket auto. Melvin Gordon. I think you actually lose just a fraction of the time of the second. And then Kofrak, with his second win, is losing by a lot of votes. Or not. If you will, the hometown favorite, is Milo L70 and a big person. Amanda, how do you? Pack seven. Patrick Mahomes and Joe Burrow. Yeah, they were definitely rooting for Justin Fields. Oh, and you got a dual. Nice. College connections. Crack dice, 18 out of 23. Ryan Tannehill and Kellen Mond. I didn't realize Tannehill went to Texas A&M. And a Tyron Matthew. Kofrak, Kofrak. And we got two packs left. Packs nine and 12. Pack nine. You got Mac Jones. Najee Harris. And then Kofrak, Kofrak, Kofrak, Kofrak, Kofrak, Kofrak, Kofrak, Kofrak, Kofrak, Kofrak, Kofrak, Kofrak, Kofrak, Kofrak, Kofrak, Najee Harris, Zach Wilson, and Israel Mukwamu. College Ticket Auto, cornerback out of South Carolina. And Miles Garrick. Jalen Hurts. William says Muk. Is he any good? William. Patrick Mahomes. And you got Brandon Smith. Mukwamu, Mukwamu. Nice. And Brandon Smith. And Teddy Bridgewater. Mukwamu is the man's name. Get it right, Sean. So the final auto out of the break is Brandon Smith, wide receiver out of Iowa. And the Hawkeyes. And there you go, guys. That's the break. Got a nice dual auto in there. School connections. And the next 12 pack two box break is in the store. That was 2021 Panini Contenders Draft Picks Football two box break, random pack number seven from jaspyscasebreaks.com. I'm Sean, jaspyscasebreaks.com. Thanks for hanging out, guys. We'll see you next time.


This study found that the amount of time spent playing football and the severity of the impacts experienced during play were both linked to the presence of chronic traumatic encephalopathy, CTE. The researchers used a position exposure matrix, PEM, to measure the amount of time each player was exposed to certain types of impacts while playing football. They then compared these measurements to the presence of CTE in the brains of deceased football players. The results showed that the longer a person played football and the more severe the impacts they experienced, the higher their risk of developing CTE. This suggests that repeated blows to the head may be responsible for the development of CTE. This article was authored by Daniel H. Dineshvar, Evan S. Ney, Zachary H. Borkam, and others.


While the all-progressive Congress says it is set to hold its campaign rally for the party's presidential candidate, Senator Bolatino Buu and his running mate, Senator Kashim Shatema, on Saturday in Lagos, the director general APC presidential campaign committee in the state, Senator Ghanius Solomon, said this during a news conference. Solomon called for the cooperation and understanding of all residents as regards the diversion of traffic around the areas. The event is like a homecoming for our leader, a mentor who has become a national pride. I wish to seize this opportunity to invite all our party leaders and members to this equal-making and carnival-like event as it gives an opportunity for our presidential candidate, Ashwa Jibola, to address the people on his manifesto happily tagged renewed home. As a responsible political party, it is imperative to seek the cooperation of members of the general public as regards the need for temporary diversion of traffic and mass movement of supporters within the vicinity of the rally. Lagos State APC Chairman Pastor Conelos Ojela B. Solisit had a cooperation of the media while assuring that adequate arrangements have been made for a peaceful rally. Now the national youth leader of the APC, Dario Israel, said the party's national working committee officials, support groups and members were all excited to come to Lagos for the rally. This is the first time Lagos State will be presenting a presidential candidate, not to opposition, a presidential candidate in a ruling party. And the presidential candidate himself has become a household name in Lagos State and in Nigeria generally. So we are not restricting the number or we are not rolling out any number. I'm sure you gentlemen of the press, you'll be part of the people that want to come and give a housing homecoming to our presidential candidate. And we can assure you, you'll see the number of people without being coerced, without being influenced with anything that will come out.


Just keep looking straight ahead, please. Okay Now I'll do the other side. Good. Now I'll do the same thing again, but when I shine the light in his left eye I will check the pupil on the right side because the pupils constrict together at the same rate even though I'm only shining the light in one pupil. So when when I shine the line in the left eye now I'm going to check the right pupil and make sure that it constricts at the same rate that the left one does and it did and I'll do the same thing again on this side. Okay, good. So we've now assessed that the pupils are equal.  And then ask them to focus on an object that's further away. And what I check is for the pupils to accommodate, which means that when the patient focuses on something closer to them, the pupils constrict. But when the object that they focus on is further away, the pupils have to accommodate and they actually dilate. So in this case I'm going to hold the pen right here above the camera and ask you to look at the pen and then look at the place on the wall and look at the pen again and look at the wall. And here this is a very slight reaction, but the accommodation was there and the reason is that this room is not very big so he can't look very far away. But that is how we checked if the pupils are equal round, reactive to light and accommodation.


OpenSUSA has been supporting KDE basically since its founding. We've always had a very good relationship and we've been supporting and sponsoring the KDE community for several years. This year we're here in Berlin and what we have new coming out is our 42.2 series of OpenSUSA League. That's going to be a great new distribution that's going to include KDE's long-term support of 5.8 in plasma. It's really good to be here and be with the community. There's a lot of friends that I've seen here and it's nice to see them and talk about free software. What's your favorite thing about KDE? Actually, I really like the opening of KDE about the wheelchair access and that. It's a really, really cool project. It's open source. My wife came with me and it's a shame she was not here. I really would have liked to have seen that but that was my favorite thing. Just meeting people and talking with them about OpenSUSA. I haven't seen it from last year but we've got more out there. It's nice to be able to see this.


What's going on guys you're with Justin Henry here with the FanDuel quick picks talking about the NBA play-in tournament I got two games I don't want to take a look at and get you guys three picks that I really like for the game slate The first is the over under in the Hawks and Hornets game. It's set right now at 236.5 and I love the over in this one The Hawks are averaging a hundred and twenty three points over their last nine games Which they've won seven out of two against the spread so to me this seems like This is trending up and I really like the point total that they put up over that time coming into the playoffs red hot Obviously the Hornets this is you know the mellow balls first time in the playoffs But I expect them to come out put up some points as well as they've had an increased point total over the last ten games as well Now for both of these teams I can see this being a high scoring matchup Obviously a lot of good supporting cast and in both teams, but for this total. I do like the over 236.5 With that being said, I also want to talk about a player point total that I like from this game And that's Trey young at 30.5. I want to take the under in this one Trey young against the Hornets has only had one game in his career over this point total and to me It just seems a little bit high I think everybody is going to look at the point total for this game and expect that Trey young does hit that mark But he's really only hit that mark in three of his last eight games as well So even though I think Trey young will score the ball. I think he'll have a good impact on this game I don't see his point total being over 30.5 He's only hit this number one since some yellow balls been in the league to defend them in the last game that I want To talk about is the Spurs Pelicans total right now set at 228. This seems a little bit high I want to go with the under on this one The Pelicans are one of the slower teams in pace and the Spurs are one of the best defensive teams in the league So this total to me does seem a little bit high has the feeling of a close game as well Spurs have been under this total majority of their games as have the Pelicans this season So I'm gonna go with the under in this one I think the Spurs and Pelicans have a close game below scoring obviously those are the three plays that I like Which one is your favorite?