Okay, let's start. Let me introduce you to Dagelings Moor Graf, security officer in FreeBSD and working for the security team in the University of Oslo. Thank you. So as Olivier said, I am employed at the University of Oslo in Norway where I work in the security team and for the last two years I was also a developer on the TSD project which is what I would like to talk to you about today. I've also been a FreeBSD developer for more than 15 years and I'm currently the security officer. So the title of the presentation is Securing Sensitive and Restricted Data. So I'm going to start by defining what sensitive and restricted data are. And in the context of a university these are genetic sequences, patient records, responses to surveys, audio-visual recordings of patients and respondents and anything you care to think about. So we have, in TSD currently we have projects that work on human genome data, human genetic sequences for diagnostic purposes. We have sociologists who work on a research project regarding alcoholism and they have interviews with patients. We have psychologists who work on a research project regarding the psychological effect of the July 2011 bombing in Oslo. So they have recordings and videos of interviews with victims and next of kin, things like that. In most cases these are the usual, these are personally identifiable data, these are privacy issues but in some cases leaking those data could actually bring harm to the person in question. We might have, I don't think that we do at the time, but we might have for instance researchers working with dissidents in the Middle East or in Asia where leaking information about their research might mean that somebody dies in the worst case. So the law, I'm not a lawyer so I'm not going to explain this in detail but I can summarize this as follows. Personally identifiable data which is anything that may be connected to a specific person may only be collected and retained with the person's informed consent for a specific purpose, for a specific length of time. And in the academic world at least in Norway the way this works is that a research group that wishes to collect a certain type of data such as patient information or whatever, first have to get approval from the Academic Ethics Review Board for their research. Then they have to get written consent from everybody involved, they collect the data and the authorization that they get from the Ethics Board has a date limit and a specifically stated purpose. And once that date limit is reached the data must be destroyed. So the dilemma is that the data must be accessible to those who collected it but thank you Impress for running the animation backwards. The data must be kept under lock and key however the data must also be accessible to those who collected, that's the dilemma we face it. And we solve that by providing a fully functional working environment which I will define later within which the data is accessible but from which it cannot be extracted or at least cannot easily be extracted. So a fully functional working environment means a storage, we're talking about data so necessarily there must be storage. Databases for organizing that data, depending entirely on the type of data of course some of our users require relational databases we offer them PostgresQL and some require entirely different tools. We provide virtual windows and Linux desktops with remote access. We provide the usual suite of office software and scientific software. We have a standard package that includes things like Biopython R, we can provide MATLABS, Tata, SPSS and other commercial software on demand. Provided of course that they have licenses or they acquire licenses through us. And we also have a high performance computing cluster inside the TSD environment which is separate from our... We have an HPC cluster which is currently number 400 or something on the top 500 list. It was number 96 when it was built but... Once again data, the data originates outside of TSD and it must be brought in. And the results must be extracted again in some sort. The only direct access that we provide to this walled garden is as I mentioned earlier virtual windows and Linux desktops with either RDP or SPICE as a graphical remote desktop protocol. And those are tunneled through SSH and I will describe this in a little more detail later. So we turn off all side channels in those protocols. We turn off the clipboard, we turn off shared folders, USB tunneling and other easily used side channels. Of course let me say this right away because if I don't inevitably somebody will ask me about it at the end. We cannot, it is impossible to close all side channels. The only way to do that is to store the data on a disk, put the data in a bucket, fill the bucket with concrete and bury it in the ground. At which point we're back to our dilemma, it is not accessible, it needs to be accessible. So there will always be side channels. You can screen scrape the desktop connection. You can write an RDP client that sends key presses to display the data and then scrapes it and of course we have to draw the line somewhere. We do, we make a best effort and we make a certain number of assumptions about the users and about the attackers. We will never be able to defend ourselves against a truly determined adversary anyway. So we make a best effort. So when data has to be transferred into the system or results or whatever have to be transferred out of the system, we use what we call a data lock in the same sense. Lock here in the same sense as an air lock or a lock on a river. Which is a pair of machines which I will describe in slightly more detail later, where the outward facing machine is an SFTP server and data can be deposited there and it will be copied into the system. And likewise, users within the system can move data into a specific area of the storage system from where it will be transferred, copied to the SFTP server and they can download it from there. So a bird's eye view. We have the big bad internet traditionally represented as a cloud. So this is becoming a little bit confusing because the cloud is something else now. But anyway, the big bad internet has a cloud as is traditional. And we have two interfaces between the red zone, between the world, the internet and our green walled garden. One of them is the file lock that I just described. And the other is, I've written jump hosts in Singular here, but there are actually two jump hosts that are redundant. And the jump hosts are the main entry point for users into the system. So from the internet, I could access it from my laptop here or from my workstation at the University of Oslo or from my PC at home or wherever. I can connect to the jump host to establish a tunnel and then through that tunnel, I can connect to my virtual desktop. And depending on which services the research group to which I belong have ordered and paid for, from that desktop I can access the high performance computing cluster. I can access databases. And of course, I can always access the storage system where a certain amount, however many terabytes you're willing to pay for, have been reserved for the project. The storage system is a segment of a system called AstraStore, which is a seven petabyte hierarchical storage system, which is split about evenly, I think, three petabytes of disk and four petabytes of tape or the other way around. So it's a segment of that system that has been set aside with a separate, it has its own head, if you're familiar with storage terminology. So there's a huge amount of block storage and then there are SIFs and NFS heads, front ends that we communicate with. Right. So let's take a closer look at the network topology that we see here. So we have two space heaters in the server room. One of them is a big Cisco box, the other one is a smaller Cisco box. They're our main routers. So what I haven't shown, which is off the screen here on the left, is the rest of the university network and the internet and the world. And the jump hosts are directly connected to the routers and the external half of the data lock is also directly connected to the routers. So these are accessible. They have public IP addresses, both IPv4 and IPv6 addresses and are accessible from wherever provided you have an account and credentials and everything. And on the inside, the inside network is divided into separate, quite a large number actually of VLANs and subnets. We have a Slash48 IPv6 block that we use for everything, but as I will, as I mentioned on a later slide there, we've had a lot of trouble with IPv6. So we also have to use an RFC1918 network on the inside, an IPv4 network. But the IPv4 network is a private address space and it's not routed, whereas the IPv6 network is a public address space and it's partially routed. So that, for instance, machines on the inside can retrieve security updates, install software within certain limits. Some of our machines need to be able to access licensed servers, which are on the outside. Some of them can be proxied, but some of them can't. Things like that. So the jump hosts and the external data lock are FreeBSD10 machines. The inside of the data lock is Linux. Most of the other stuff is either Linux or Windows. The Nexus, which I will describe later, is also a FreeBSD10 machine. Prism is, it's a Linux VM that sits, so we have a separate storage VLAN. And Prism is the only VM in that VLAN, apart from the data lock that actually has. It's a management machine. We call it Prism because it can access all the data. These two machines are the only ones that can access absolutely all the data in the system without, and they do it by being within the same VLAN. So everything is routed through the jump hosts. They have a dual role. They are both routers and firewalls and also login nodes. I'll get back to that later. On the management VLAN here, for instance, we have a domain controller. We actually have two, but one of them is physical, one of them is virtual. We have an authoritative name server, which is not used as resolver. The jump hosts run unbound with multiple forwarders. So our internal authoritative name server is used to resolve our own DNS domain, and they forward other requests to the university's resolvers. Our DNS base is also exposed, by the way, to the world. We made a decision there. We made a judgment call and said that, well, it makes our lives much, much easier to have our DNS base be accessible, and the risk is not really that high. So we chose to do that. RevM is the Red Hat Enterprise Virtualization Management Node, which is a separate... So the jump hosts and the external data lock are physical machines. Most of the other machines are virtual, and they run on Red Hat Enterprise Virtualization in a Dell Blade server. The management node is actually a separate physical blade for obvious reasons. We don't want to have the management node be a virtual machine.  Note that this is a network topology map, so of course this large black box is not actually located in the same room and inside, etc. It's located in a different room. There are other details that I've hidden there. There's a 10-gig fiber between... We actually use the built-in switch in the Blade Center. The Blade Center has a built-in switch with a 40-gigabit backplane, I think. We have a 10-gig connection going from the Blade Center to the storage facility and 10-gig connections going to the jump hosts to the data lock. The jump hosts have, as I mentioned, a dual role. They're routers, slash firewalls, and they're also login nodes. In hindsight, one of the things I would have done differently, and which we could probably still change, is to have login nodes that are separate from the routers and firewalls. The problem is that the login nodes have to have IPv4 addresses because they have to be reachable. Most of our users don't have IPv6, so they have to have IPv4 addresses. I can't just fire up a couple of VMs inside TSD and designate them as login nodes because they won't be reachable. You'll have to use the login nodes to access the login nodes. These are surmountable technical obstacles. They run FreeBSD 10, as I mentioned. They started out running 9.1, and over the course of two years, they've been upgraded to 9.2 and then 10. 10 was a huge relief. There were many issues with, for instance, with carp in FreeBSD 9 that are fixed in FreeBSD 10, and some of them are issues that I discovered and fixed in the process of developing this system, and some of them are issues that, for instance, Gleb completely rewrote carp in FreeBSD 10, and it's much, much, much simpler to configure and maintain now. And the login function is implemented with OpenSSH with two-factor authentication. I'll go into... I'll describe the authentication system later. Right. Multiplicity. There are currently around 45 separate research projects. I'm not sure they're all active. I say around 45, because I know that the... So internally, we have objects in our provisioning database that are called projects, and the first 10 are reserved, and we are currently at 55 or 56. So 55 or 56 minus 10 equals 45 or 46, but I don't know how many of those precisely are active or how many are reserved for future users. But it's about that, and we get new... There are a lot of people from all over the country, because the University of Oslo is with 7,000 employees, 30 or 40,000 students. We're the largest in Norway, and we provide services to other universities and colleges. This is a national service. We have new applications almost daily or at least weekly, and we've actually gotten to the point where we need to rethink the one project per VLAN model and where we're probably going to merge or to place smaller projects, projects that have very small amounts of data and they... to place them on the same VLAN but with separate subnets. So we have a slightly lower level of security because if somebody manages to get root on one of the... on a VM, on one of the subnets on that VLAN, they can, of course, change their network configuration or spoof and talk to other machines on the same VLAN, but the point is that they must be kept separate. They must be protected from each other and to a certain extent from themselves but from each other. So back to the network topology. I've removed the Cisco space heaters, and we have... so we have the jump posts here and a few more VLANs that I didn't mention earlier. We have a separate VLAN for Drax, serial consoles for all the physical... all the actual hardware. The management VLAN and the storage VLAN were shown earlier. The hypervisor VLAN, the Red Hat Enterprise Virtualization host nodes are on a separate VLAN. And we have project VLANs. We have a lot of project VLANs that are kept separate. So all traffic between each project and anything else in the system is routed through the jump post and the jump posts can monitor and control that traffic and we have a very fine grained packet filter in place. So I talked about the login function. We have a very complex identity authentication authorization system which is composed of multiple different... I've written multiple provisioning systems there but multiple IAA systems. We have a system, a provisioning system called Cerebrum which was originally designed as an IAA system but it has grown to also... it's now also a machine database. We use that at the University of Oslo and several other universities in Norway use it as well in colleges. So it's a database of persons, users. Those are distinct concepts because a person can have multiple users associated with them and machines... not only machines but also... so it can generate our entire DNS zone file. It knows about machines and we use it to assign IP addresses to machines. We use it to assign names to machines, CNames, PTR, DNS records and also roles because we can set... we can assign roles to machines which are then exported as groups in the LDAP directory which means that at the other end we can do an LDAP lookup. Is this machine part of that group and if it is then this machine will have either automatically install this software or things like that. Active Directory is used for identity and authentication internally so Cerebrum is not something that you access directly. It's not like when you log in on a machine it will ask Cerebrum for information about you. It's a database and when you make a change in Cerebrum it will propagate that change to our domain controllers or to our Active Directory and also to the Nexus which I forgot to list there but it was on the network topology map. So the Nexus is... it grew out of... we made the decision to use Cerebrum rather late. We were initially going to have our own provisioning system and the remains of that provisioning system is Nexus which is used specifically by the two-factor authentication system and also for network configuration to a certain extent. The second factor is handled by a radius server which... so Cerebrum, when you assign an OTP key to a user it is pushed to the Nexus which delivers it to the... places it in a place where the radius server will find it and then... I'm getting ahead of myself. I have a slide for this. Here is the entire... if anybody here actually knows and likes UML I'm terribly terribly sorry for my horrible abuse of a sequence diagram but anyway... so you... a TSD administrator or tech support person creates a user in Cerebrum I will not go into all the political details there is a lot of paperwork because we have to get a copy of the ethics board approval and everything and create a project, I won't go into that. So you create a user in Cerebrum and... that is immediately propagated to Active Directory and it is immediately propagated to Nexus then you set a password and that password is sent to Active Directory it is not sent to Nexus, Nexus doesn't need to know the password then you set an OTP key the secret for an OTP key which is then sent to Nexus so... at a later point there should be an arrow here that says login or whatever but at a later point the user attempts to login so we do an identity request from Active Directory that's LDAP then we ask the user for their... for a one-time code which is then transmitted in a radius request to the radius server and the radius server runs a program that retrieves the key from the Nexus database and verifies it and if it is correct it will increment the counter or to prevent reuse and then the OpenSS actually verifies the password that's actually a Kerberos request to the Active Directory server and... this line was supposed to be there then it updates the firewall it uses auth.pf to insert user-specific rules into the firewall rule set and at a later point at a later point when the user essentially logs out then the auth.pf process dies and the rules are removed from the firewall so here's some of the things that we do with the prevailing system other than... other than user management when a machine is created in cerebrum, a machine object is created in cerebrum so I type into my command prompt and I host add whatever and then I assign a role to it that says a role that's called auto-provision I assign a role to it that says for instance Linux operating system what happens is that within a few minutes there's a back-end that will create a virtual machine in rev and start the installation we use I think for Windows machines Windows machines are cloned I think I'm not entirely sure because I haven't been involved in the Windows side of things and Linux machines are pixie installed with Kickstarter every machine in the database has a role which is either Linux operating system, Windows operating system or FreeBSD operating system so that in the LDAP directory I can look up a group in LDAP called Linux operating system or Windows operating system FreeBSD operating system whatever that group will contain all the machines that run that operating system at least in theory if the information in the database is correct and I can use that there's a script that goes every either every minute or every five minutes that will traverse the LDAP directory and look at specific groups in the LDAP directory and translate those groups into pf address tables so it looks up a group for instance Linux operating system and it gets a list of machine names and then it looks up all the machine objects and gets the DNS hostname property from the machine object resolves that does a DNS lookup for that and you end up with a long list of addresses and those are shoved into a pf table which is updated dynamically so we have firewall rules based on those tables for instance we have a tool that says that Linux machines and FreeBSD machines are allowed to talk to the CF engine server for configuration management but Windows machines aren't they have no reason to talk to CF engine and I don't want somebody to log in on their Windows desktop wherever and start messing around with the or try to mess around with the CF engine server for whatever reason only Windows machines are allowed to talk to WSUS the Windows software update system for instance Linux machines are allowed to talk to our YAM proxy which is a proxy for the Red Hat network for automatic updates our FreeBSD machines are allowed to talk to the FreeBSD update and package servers things like that and that's updated dynamically so if you add a machine in Cerebrum five minutes later the machine is at least for a Linux machine is very fast the machine is created installed and firewall rules have been updated for that machine users are affiliated with projects and machines actually everything in the system is affiliated with a project that's one of the modifications we made to Cerebrum which means that we can also modify the firewall rules or have firewall rules that are specific for groups of users and that's something that we haven't it's on the to-do list but it hasn't been implemented yet but if a user on project 42 logs in then the rules that AuthPf will install into the PF rule set will only allow will only allow that user to access machines that belong to project 42 here's an example of the login process it's not really very interesting but it's just you get a banner connecting to the University of Oslo blah blah blah restricted to Julia accredited members so we had a lawyer who required us to print a banner before logging in which is fine by me I think the operative part here is that we had a research project from the Oslo University Hospital and their security people have restrictions on which machines they are allowed to use to login to our system so that's actually why we have that banner here one time code password blah I am now logged in and what I get when I log in is a screen full of text that describes how to use describes how to use it and of course you don't get a shell because your login shell is AuthPf and your home directory is var empty so it just remains open until you control C or you lose the network connection so where the rubber meets the road I've covered I think most of how it's supposed to work but we've had issues TSD was intended to be an IPv6 only environment unfortunately as we discovered after a fairly short while a lot of software does not support IPv6 still does not support IPv6 or they claim to support IPv6 but they don't do it properly Red Hat Enterprise Virtualization does not support IPv6 at all that was an eye-opener and even you can't even have IPv6 name servers in your resolve.conf on a Red Hat Enterprise Virtualization host node because they don't use the glibcdns resolver they have their own resolver which does not understand an IPv6 name server address in resolve.conf also you can't pixieboot over IPv6 it doesn't have an RFC for it but it's not implemented so the QMU bios the pixie bios in the VMs doesn't talk IPv6 we can't use Slack which would have been very nice yes Slack has limitations and issues and security issues but we can't use it because Linux source address selection is broken so we have to use carp on the inside using Slack for router advertising also found and fixed some bugs in FreeBSD's rt-advd some crashes and things issues with pf and carp there was a bug in FreeBSD's source address selection as well so the backup if you have a master and a backup node and they share an IP address but the backup node is not supposed to use that IP address when it's the backup node but it will still use that IP address as the source address for outgoing connections fixed that we still have problems with routing of IPv6 UDP packets and I think it's related to the fact that pf does some weird things with checksums and I know that the IPv6 the IPv4 code there is somewhat wrong and the IPv6 code there is very wrong so we have to test under certain circumstances and apparently we trigger those there's a PR for that that's a sign to me I haven't our state table kept filling up and I discovered that it was actually due to DNS NTP Kerberos LDAP requests boom like the script that populates the pf address tables 2000 states and the individual LDAP requests the moment I run it I suddenly have 2 or 3,000 new entries in my state table so my state table is now has a state table limit is now 100,000 states should be enough yeah IAA issues so free radius is difficult to configure correctly it's also slightly unreliable there are weird things that happen when we add a user sometimes free radius insists that the user does not exist so you get a you invalid user it doesn't even ask the back end it doesn't even try to verify the code it just know that user doesn't exist even though the user has been in the ETC SPWD whatever for days and SSL DAP is also slightly broken and that's my fault it had a huge bug and I fixed a huge bug but when I fixed a huge bug I introduced a small bug and I'm out of time I could go on for hours about all the things that don't work in TSD and all the things we should have done differently but I'm out of time so questions wait for the microphone do you have a mechanism to rate limit outgoing data transfer just to stop bulk export if there turns out to be a bug in your implementation to stop the design of the system is to stop people bulk extracting the data for so do you have a mechanism to say rate limit network throughputs for given connections to at least mitigate some of that I'm sorry do I have a mechanism to to rate limit to stop the oh rate limit okay the so when you export data at some level we have to trust our users so we have groups we have user roles as well and initially only the administrator and head of a project are allowed to export data and they do that by placing it in a specific directory and then it's copied from there to the SFTP server and they can download it from there currently there's a flaw in that mechanism because it's limited to I limited it to 8 simultaneous transfers so the system scans the directory and then it picks up new files and it starts transferring them but it won't transfer more than 8 files at a time the problem of course is that if you have 8 huge files like 8 huge FASTA files, gene sequences then nothing else gets transferred until they're done so yes that's an issue but other than that no we we have to trust our users to a certain extent and we chose to trust them there any other what you're using for OTP exactly you're using tokens you're using SMS or what's this RFC 6238 time based one-time password the same same algorithm that Google uses so users who have smartphones can use free OTP or the Google Authenticator app but I prefer free OTP which is Red Hat's version of the Google Authenticator app users who don't have or don't want to have smartphones get a UB key instead and so they get event mode instead of time mode I just wanted to ask if your jump posts are they independently or is there some load balancing between or have the users to explicitly choose one of the jump posts there's carp both in front and behind so the users are instructed to SSH to the jh.tsd.use.no which is the carp address and which will go to whichever is the master so it's a failover mechanism not a load balancing mechanism if I correctly understand the users have to connect to a desktop which is inside the perimeter so they can access the data from there so are there some way to prevent the users exporting the data from their desktops outside using some DOP because you mentioned that the files are already using SHA 256 so using DOP with this information sounds quite easy using DOP, data leap prevention tools because first of all they get a remote desktop but they can't copy paste out of that desktop they have to use the file lock to send data out and all accesses are logged so this is a case so we're back to what I said earlier we have to trust our users but there's also from a legal point of view there's a point where our job is no longer to move around but to be able to document that the data has moved around and this is what the checksum is for we log the file name, the user, time stamp and a checksum of the file and we have, I mean the system is useless if our users aren't allowed to extract the data at all so it's difficult I hope I answered your question how easy is it to leverage your implementation for other sites like other supercomputer sites at universities that have got similar requirements yeah so it's a huge system really a huge system it's not it's not really a product but there are components that can be reused and we know that there are other other institutions such as the Kungliar Techniska Högskolen the Royal Technical College in Lund who are implementing a similar system and they've expressed interest in our file lock implementation and that's actually that's a self-contained piece of software that if you have the need to copy data from A to B and log it etc that's software that you can actually build and it's written under a BSD license but I don't think the Git repo is accessible currently so I just have to move it to a different Git repo the OTP code is something that I wrote myself it's still experimental sort of it's in the OpenPam SVN repo when I initially wrote it two years ago there were no other BSD license OTP implementation except for a command line based one for open BSD's authentication framework I don't remember what it's called now there are plenty but yeah last question how usable for end users is connection to SSH and making local port mapping do you have some third party utility for everyone like Mac users Windows users which use something like P-Link we we document how to set up putty basically so unfortunately so this screen documents how to use SSH unfortunately there's no way you can't distribute so putty does not have a file based configuration we would have it uses a registry so we would have to distribute pre-generated files that install registry keys dot what is it dot reg files that install registry keys to configure putty so instead we just tell people how to do it and most of them managed to figure it out so the question yeah the question was batch files with P-Link can we use that instead I haven't looked into it I think that somebody looked into it and decided that it wasn't as simple so there's the two factor thing I'm not entirely sure of why we chose not to do that we did look into other SSH implementations than putty but we end up with putty it's not really difficult to configure so okay thank you very much


In this discussion we will discuss the discussion question of define property plant and equipment and how to account for them. So if we see an essay question like this of course the best place to start is the definition what are we talking about when we're talking about property plant and equipment. We're typically talking about tangible type of assets, assets that we can physically touch, physically move and feel, assets that have a useful life typically more than one year or accounting period and therefore assets that we will be allocating or depreciating or allocating the cost of those property plants and equipment to the income statement over the useful life. Couple issues when we determine property plants and equipment what are we going to do with it? How are we going to record property plants and equipment? One is that when we purchase it we need to determine should we record it as property plant and equipment and again if it's if it's tangible assets that's something that we're going to use more than one time period or we're going to use it multiple time periods into the future multiple years into the future then typically it's something that we would need to capitalize as property plants and equipment. When we put it on the books then we have the problem of how do we record it and we would typically record it using the cost principle at cost what we paid for it. Now that doesn't mean that we had to pay cash for it if we took a loan out then we would still put it on the books for the loan amount whatever the sticker price was because we bought it in essence by financing it in that case so we'll put it on the books at the cost then we have the the next problem which is that we put it on the books as an asset we debit the asset credit the cash that we paid or any kind of liability that we paid for it now it's not going to stay on the books for an asset forever because we know that this type of asset will depreciate over time it'll go down in value either through deterioration or just you know normal normal deterioration maintenance and stuff like that that it will decline in value and therefore what we want to do is allocate the cost over its useful life not the market value we're not trying to get it to the market value per se what we're trying to do is allocate the cost over its useful life which may mirror in some ways the market value of the equipment as it goes down but it's a it's a key distinction here that we're using a cost principle and recording the cost allocating it over the useful life not trying to record necessarily the fair market value as the equipment so the way we're going to do that will be through depreciation a couple different methods we can use a straight line method is kind of the standard default to explain depreciation and then we have some variations on that including some accelerated methods like double declining balance or a units of production method which can also be used to calculate the depreciation now the goal of these are going to be to allocate the expense for the cost over the useful life we do that with the journal entry of debiting depreciation expense and crediting accumulated depreciation you'll note that within that we don't have the term property plants and equipment we have depreciation and accumulated depreciation we're going to make up another account in other words that will be reducing the equipment it's called a contra asset account that's going to be the accumulated depreciation so therefore to to allocate the the cost and then to calculate the book value we would have to take the equipment minus the accumulated depreciation and that would then give us the book value so we're going to do that over the useful life and at the end of the useful life we will then have the salvage value being the remaining value now in order to calculate the straight line method or double declining method we would typically need the cost of the equipment what we believe the salvage value would be at the end of the useful life of the equipment and the useful life of the equipment those are going to be some factors needed in order to calculate the depreciation another component we need to calculate in depreciation is at the end of the useful life or if we sell it then we have to record the disposal whatever that disposal may be in some way and to do that we've got to take off not only the equipment account off the books once we get rid of it but also the accumulated depreciation related to it so it's an asset type of account so when we get rid of it we'd have to debit the we'd have to credit the asset the equipment asset to make it go down we'd have to debit the related accumulated depreciation to make it go down and then the difference there if there is any difference would possibly go to a gain or loss now if we had sold it for something then we'd have to say okay we got cash we debit cash we credit the equipment to make it go off we debit the accumulated depreciation to make it get off the books and then any difference there to make the journal entry balance would be a gain or loss on the sale of the equipment so those are going to be our major components when we deal with property planting equipment it goes on as an asset we got to record the assets and then we got to record the depreciation over its useful life then we have to record the either sale or disposal of the property planting equipment at some point


This is the proposal that you're investigating. It's known as Project Diffuse. And it's essentially a proposal to DARPA, the Defense Agency, to collect and manipulate bat viruses ostensibly for the purpose of predicting what kind of viruses might jump from bats to humans and cause future pandemics. And you summarize one of their proposals this way, that the scientists sought to insert furan cleavage sites at the S1, S2 junction of the spike protein to assemble synthetic viruses in six segments to identify coronaviruses up to 25% different from SARS and to select for receptor binding domains adept at infecting human receptors. And then you go with these bullet points and you list kind of one by one the characteristics that SARS-CoV-2, the ways in which it matches the viruses that are described in this proposal. So SARS-CoV-2 has a furan cleavage site, which has been discussed at length. And we can talk about a little bit more later. SARS-CoV-2 can be divided into six contiguous genomic pieces by the restriction enzymes BSAL and BSMBL, and orders for one of those enzymes, BSML, can be found in the documents. And the receptor binding domain appeared finally tuned for human ACE2 receptor. And then the genome has the genetic differences from SARS. So here's where I want to bring in Alex to help explain the significance of their plans to assemble the viruses specifically in those six segments using some very specific enzymes. Could you explain that for us a little bit more deeply, Alex? Absolutely. And one kind of interesting backstory is that the Diffuse Grant was proposed to the DARPA preempt call in 2018. And I had submitted or helped write in ACE7 as well. So this call is very intimately familiar to me. And in that context, what was distinct about Diffuse was their search for this motif that had never been seen in the SARS coronavirus before the fear and cleavage site, and their proposal to insert this thing that had never been seen before in the SARS coronavirus. And so the proposal to insert a fear and cleavage site instantly puts them down a particular laboratory path. So how do you insert a fear and cleavage site into a SARS coronavirus? The SARS coronavirus has this RNA genome, which you can think of as a really flimsy film of a genetic strand of RNA. And it breaks very easily. It's very hard to insert motifs inside of an RNA genome. So if you want to insert a fear and cleavage site, you have to build this much sturdier DNA copy of the virus. And in order to build a sturdy DNA copy of the virus, you have to build it one block at a time. We looked into the pre-COVID, well, I guess not we, but Valentin Britell and Tony Van Dongen these are bioengineers, Valentin and University of Pittsburgh and Tony at Duke University. They're bioengineers. They build these DNA blocks from scratch. So they looked into the methods for how people did this in coronaviruses pre-COVID and found that one of the most common methods for building these full-length DNA clones of a virus was to order these blocks and nip them at the end with these restriction sites that allow you to attach them one at a time until eventually you have that full-length DNA clone. And one of the diffuse PI's really popularized this technique. Ralph Beric wrote a paper on efficient reverse genetic systems. Well, that's a lot of words. It just means reverse genetics as you have this DNA clone that you're tinkering with to make these different RNA viruses. And in the process experimenting with the role between these genes and the manipulations of these genes like if you're in cleavage site on the function of the virus. So that was kind of the context we looked into this diffuse proposal and asked, okay, if they're inserting a fear in cleavage site they need a full-length DNA clone. If you're building a full-length DNA clone they're probably using methodologies like those that Ralph Beric popularized. Is there any evidence for this in the SARS-2 genome? We studied, we ran a meta analysis of all of these infectious clones and reverse genetic systems made before COVID and found that they all had this characteristic manner of manipulation. The researchers would look at the genome of the virus on the computer screen, look at where these cutting sites are and they move them around a little bit to make it easier to assemble these blocks. And they would move these cutting sites around with these mutations called silent mutations that change the genetic sequence without changing the resulting virus. So researchers before COVID would make these full-length DNA clones by using silent mutations to move these cutting sites that form these little notches you can use to attach chunks of DNA together to build that full-length clone. We looked into that and found that SARS-2 had this very unusual pattern of evenly spaced cutting sites that was consistent with how people built reverse genetic systems before COVID and that when you look closer at these cutting sites, yeah, this is the figure here, those cutting sites BSMB1 and BSA1 typically are randomly spaced throughout the genome. When you have randomly spaced things they don't often come with fragments of this similar size. But when you look at this visually, Valentin and Tonya just screamed at them, this is unusual and they have a lot of experience seeing what you see in the other, so SARS-CoV-2 is the top row here. All the other viruses from vanilla 20, 247 to SARS-1, their BSMB1 and BSA1 sites are randomly scattered and that's what you typically see when you upload a genome into this software that helps you see the cutting sites. Valentin and Tonya uploaded SARS-2, saw this unusual pattern and thought, wow, this is like an Ikea virus. This is something you could just order right from scratch and get this Allen wrench of BSMB1 and this screwdriver of BSA1 and stitch it together. So the question then was, what are the odds of this occurring in nature? And that's where I came in as a mathematical biologist to study the evolution of coronaviruses and try to get an estimate on the odds of this appearing in nature given that it is so consistent with a reverse genetic system. We found those odds were really low. So when you, the way we estimated it was looking at this longest fragment length, so this top figure here, the y-axis is the length of the longest fragment from cutting up a virus with any one or any pair of these enzymes. And then the x-axis is the number of fragments. When Ralph Berick wrote his paper on efficient reverse genetic systems, he proposed that red box is this idealized range for an efficient reverse genetic system. So more between five to eight fragments and ideally less than 8,000 base pairs long for the longest fragment because when you order these chunks of DNA online, 8,000 base pairs is a common cutoff. Now that said, the longer the fragment is, the more likely it is either contain a toxic element that prevents your ability to replicate it and clone it and make a lot of it. And it also reduces the odds of faithful assembly when you have a really long wiggly piece of DNA, it may not attach as faithfully or at high of rate as shorter fragments. So there's a preference to have smaller fragments in general, and that's what really was the lurking lab protocol constraints that led to this pattern of unusually even spacing in these restriction sites. So we looked at, we qualified the odds of seeing something as or more extremist SARS too just in the pattern of the spacing of these sites. And that was about a 1 in 1400 event. So one out of 14,000 is actually the most extreme case of a coronavirus that we've seen for these enzymes that can be used for the assembly of these reverse genetic systems. Then we look further at the silent mutations. That's where we found hotspots like glowing genetic dust right on these specific sites. And wherever they were moved around, they were moved around exclusively with the mutations bioengineers use. And that was our most significant finding. And so this is what the title of your paper is endonucleus fingerprint indicates a synthetic origin of SARS-CoV-2. So the fingerprint that you're referring to there is essentially the fact that there are, let me pull up that figure one more time, these rather evenly spaced like somewhat regularly length segments as opposed to in a naturally occurring virus, you would get much more variation in the length. You'd get some really short ones and some really long ones. And so it's just mathematically unusual for that, or maybe even mathematically impossible or highly improbable that that would occur in nature. I want to give credit to DARPA. They invented the internet and they rejected the fuse. So this is a diffused proposal of interest. The fuse proposal reveals the intentions of these researchers who previously had conducted a lot of gain-of-function research of concern. They would find these bat coronaviruses lurking in nature and they would swap around these parts of the bat coronavirus making these chimeras to then ask, oh, which chimera is the most infectious in people? And that question is modifying things found in nature to improve their transmissibility and the intention their search was for something more transmissible. So you would expect this research program to result in something more transmissible because that's what they were trying to make. And the fear and cleavage site specifically was well known before COVID that fear and cleavage sites are found in other viruses. And when they're found in other viruses, they're kind of this master key that allow the virus to unlock all sorts of different host cells and the enter into bat cells and human cells and dogs and whatever. So the fear and cleavage site was this master key. Why would you give that to a SARS coronavirus? That's anticipated to improve the transmissibility of this virus possibly improve the virulence as well if the virus is able to infect more tissues within the human body. So that the assertion of the fear and cleavage site was the gain of function research of concern. And that's- And just to be really clear for our listeners who may not have been following every detail of this, the fear and cleavage site, the reason that there's so much attention on it is because A, it is this SARS-CoV-2 is the only virus in its category of these SARS-like coronaviruses that has it. And B, that makes it particular humans, particularly susceptible to it. It eases the entry into human cells. Is that more or less the reason why the fear and cleavage site was like the first kind of red flag for people who thought that this might have originated in a lab? That's exactly right. The fear and cleavage site had never been observed before on a SARS coronavirus. And when we build the evolutionary tree of the SARS coronaviruses before COVID, we had 1,000 years of branches in this tree. And there wasn't a single indication that the SARS coronavirus existed anywhere in that tree. Yet, they were very prominent in the minds of virologists. And this is where I can speak as someone who's in that DARPA preempt community of accepted grants that we all knew that the biggest crux for these jump-capable quasi-species, the biggest crux for host switching is binding onto the receptors of a new host. Because new hosts have very different funky receptors in their cells. So how can a virus latch onto that and enter into the cell? The fear and cleavage site assists with that process and it was known to assist with that process. So virologists everywhere were looking for these things because they really wanted to find them. If you found a fear and cleavage site, in for instance, an influenza virus that passed through a chicken farm, which they did once in one chicken farm, out of all the chicken farms that had been infected with this, that was documented and there was explosive news because virologists understood the context. So the fear and cleavage site was a motif, this master key that virologists knew about what nature didn't or nature knew about, it would stumble upon it randomly but had not stumbled upon it in the 1,000 years of SARS coronavirus evolution that we'd seen. Yet then we find a SARS coronavirus with this master key in Wuhan, exactly where researchers proposed to give it to a SARS coronavirus. So that's the fear and cleavage site. That's the gain of function research of concern component and our work was focused more on the laboratory protocols that they had said they wanted to find all these wildlife coronaviruses.  When you sequence it, you get this long genetic code, 30,000 base pairs on a computer. Now, how can you go from that genetic code to then saying, this virus is more likely to infect people or less likely to infect people. For that, use all these laboratory techniques to construct parts of the virus or entire viruses. And our work was focused on that, both the rescuing of viruses from a genetic sequence using these reverse genetic systems or infectious clones. And that's a really remarkable thing to think about is that most viruses go from a virus to cell to a virus to cell to virus to cell and you can trace that back in time indefinitely to the origin of the virus, but infectious clones, they go from a virus to a cell to a poop sample in a bat, to a genome on a computer screen and then from that genome on a computer screen, you order these blocks and stitch them together and then we make from that DNA clone, this RNA, we electrocute a cell to form these holes in it an electro paraded cell and shove that RNA inside the cell, it starts making a virus. It's this sort of immaculate conception of modern biotechnology. And that was the most common way of rescuing coronaviruses from these wildlife samples where you could have the genome, but you may not have cultured the virus, the virus may have died while it was being transported to a lab, but you can still get the genome, you can still get the virus, you can still study it and that methodology was also in diffuse, but it was a bit more technical and subtle to find these fingerprints in the genome, but that's what we found. Hey, thanks for watching that clip from our new show, Just Asking Questions. You can watch another clip here or the full episode here. New episodes drop every week, so subscribe to Reason TV's YouTube channel to get notified when that happens or to the Just Asking Questions podcast on Apple, Spotify or any other podcatcher. See you next week.


officially bring up Garrett and and welcome him to to our Yankee family. I would turn it around first and keep the number and then we can get it and throw it on and we'll take a couple more photos. Okay Garrett you can throw it on. Cleans up nice doesn't it. Get a photo here. Ladies and gentlemen Garrett Cole. Hello everyone. Okay well I'd like to start with something that's pretty special to my heart. If I could have Scott and Hal if you guys could stand up Amy if you could come back over here. Guys I think we're going to move this slide this way. Wow I know. I would just like to say I've always been here. That's great you kept it. I did. I need my note. There you go. I'll take this. Okay. You don't. Okay so I have a few thank yous. First I'd like to thank God for blessing me with this amazing opportunity to fulfill my dream. I can remember as a little boy dreaming about being a Major League Baseball player specifically Yankee. And like Brian said it's the right time and the right place to take that step and I'm just tremendously excited. And I hope there's a lot of young boys out there that chase their dreams just like I did. I'd like to thank my parents as well. My sister Erin and my wife Amy for the amazing support over the years. Family is so important and to have a good backbone and have people that unconditionally love you and support you. Truly blessed in that regard as well.


We are here at the World Telecommunication Development Conference 2014 in Dubai in the United Arab Emirates. I am pleased to be joined Mr Shola Taylor, who is adviser to the Minister of Communication Technology for Nigeria. Mr Taylor, thank you for being with us today. Thank you. We are here at the World Telecommunication Development Conference. It is a conference that happens every four years. The major theme here is broadband for sustainable development. What opportunity does broadband development bring to the ICT Centre? First of all, what is important to recognise is that broadband and ICTs should be seen by major governments and all the governments of the world as an engine of economic growth and sustainable development. Therefore, it is important for countries to use broadband to aid economic work. Just last week we had the Minister of Communications from Nigeria mention how ICT is contributing to the GDP 8%. I think ICT should encourage many countries to do that and to encourage ministers of other sectors also to appreciate the importance of ICT in the overall development of their countries. And what challenges are you facing in present? One, the major challenge is one of universal access. Currently, broadband is available in major cities of the world and particularly for the developing countries. The issue is rural areas, remote areas. Even in some cities, broadband access is a major issue. Mobile broadband has grown very well beyond the 7 billion population of the world, but internet has been very slow. It's quite important for countries to look at this issue. Secondly, there's the issue of gender. There's the gender inequality in ICTs. The number of women who are involved in ICTs is not very encouraging. And I said it needs to face this challenge. Perhaps more importantly is the need to have a broadband network secured, cybersecurity. This is rather important given the fact that children use the media users of ICTs and it's quite important to address this particular challenge. And this conference has been organised by ITU. What role do you think ITU should play in broadband development? First of all, the ICT has done quite a good job. The broadband commission which ITU co-organised with UNESCO has given us a number of recommendations. I think we need to take you from there. Secondly, many agencies of the UN are currently elaborating their POST 2015 agenda following the MDG in Switzerland. ITU should now ensure that in the POST 2015 development agenda, broadband is still key and that's quite important. We also need to see how the ageing population which was not addressed in the MDGs had to be addressed in the new agenda. And this should also be linked to the ITU 2016-2019 financial and strategic plan. That's very important. There's one major outcome that comes from this conference. What would you like that to be? Well, I'd like to see the ministers who have come to this conference go back home and start sending the message that one, we need to see broadband as an engine of economic growth. Two, we need to encourage the youths to develop applications which are immediately relevant to their environments. Promote local applications, promote the use of broadband at local level, amongst women in rural areas and for the overall growth of the economy. Mr Shola Taylor, thank you very much indeed for your presence in the studio today and some very interesting answers there from you. Thank you too. And thank you for watching too.