Hi, yw'n gweithio. Fy fawr hynny yw'r parwysgwrn gyda'r hollol? Yn fawr, mae'n amgylchedd y gallwch chi'n gweithio i lawr am ymwneud â'r masgau arall a'u gweithio i ddim yn cyfael â ymddirionedd ymddirionedd. Felly, mae'n gweithio'n gwneud hynny. Rwy'n James MacLeod, dyrech o'r cymuned ar Finos, ac dy'n hynny i gweithio i gael os ymddirionedd â'r hollol ar gyfer cyflau $1. Before we actually start going into the panel discussion, I'd like to introduce Jen and Udam, if you would like to introduce yourselves and let the audience know who you are and what you do and what we're going to be discussing today. Great, thank you. My name is Jennifer Hayes and I've worked for Fidelity Investments. I am also a chairperson of the governance board of the Phin Ops Foundation. I as a member of the Fennops Foundation Governance Board I am actually a practitioner member so I represent the practitioner community. So with infidelity investments I helped establish the first Fennops organization with infidelity and I have helped run it for the last 2 and a half years. pound in. Hi and I'm Udam Daivaraja, headed of Cloud Financial Management for city. At city, what we are doing is building a infrastructure cloud platform Ie, mae gennw'n gweld gwelio am gwrthau papunau, a phatwch yn cyfran o bobl yn amlwg nhw, sydd ei wneud i gwneudio i eirio sy'n gwaith sydd yn styl 좋아하는ol. Yna cyfwyr yma llawer i'r Chelyw Pethau Fellygrwyledig ceisio'r unrhywg llyfrigol. Yn y ceisio, yna ddarfodol. A'r thymau i ddechrau, rydych chi eisiau cwestiynau, fydd arall, nid ei wneud, a chydwch chi'ch cwestiynau yn eisio y gallwn a ddweud y dychwyn, llawd y dychwyn i'r amser, yn oed i'r hoffa i'r ysgulinaid. Felly'r dŵr y dychwyn, Jen, roeddwn i'n ei ddrwynt chi'r hyn yn gwybod. Achos, James. Yn y ddweud, roeddwn yn cyflwystio ar hyn i gyd yn eu bod yn byw ymuncheg iawn, a'r llead o phryg f assassinol, llefniad, proses, greu cant allan ymwiel, of people, three different types of roles within the organization, your financial organizations, your technology organizations, and your business organizations to collaborate and make data driven decisions based on how to get the most value out of the money that out of what you spend in the cloud. The real purpose of Fin Ops and the goal at the end of the day is that when you're spending money in the cloud, it's not about necessarily reducing what you're going to be spending on.  So you're really talking about it from the beginning of the process which is procuring and deploying resources and doing that appropriately all the way to the financial aspect about it, which making sure that you are not overpaying for those resources when you do them. Fin Ops itself, we think of it in four different ways. We have a set of best practices and principles that we bring to play every time we think about how we want to set up a Fin Ops organization. There are a different type of personas who will play within the Fin Ops organization within your group and there are different phases by which we go through. First, we'll talk about the principles itself. So from a principle standpoint, this team has all of these different personas, the business, the technical groups, the procurement groups and the financial organizations. It is important that they communicate and collaborate together and create a common understanding of how they're going to pursue cloud spend. Everyone in the organization takes ownership for cloud usage. Traditionally, what you used to see is that small groups within different organizations made key decisions about procurement and cost of IT. That no longer comes into play. Within the Fin Ops, I apologize, within cloud-based organizations, what you actually have is that every person who is able to deploy to the cloud is actually able to make a procurement decision for you. So it's really important that you change the culture of an organization and really have it focused on cloud usage and the ownership of cloud usage. We do recommend a centralized team within the Fin Ops community that helps drive these principles throughout the organization and the culture change that needs to happen with it. At the end of the day, decisions are business decisions. They shouldn't be made from a technology standpoint. They shouldn't be made from a financial standpoint. We should be bringing information together that allows the business to make the right decision for the organization itself and really be able to take advantage of the variable cost nature of the cloud. So how do you use that as a business advantage versus it actually bringing more overhead to your organization? One of the key statistics right now is that 35% to 45% of all consumers of AWS overspend over provision on their cloud. So this is really the key underlying principle to the Fin Ops. Thank you very much, Jen. That was a very good overview. So, Udam, now that we have a basic understanding of Fin Ops, can you tell us what value it brings to financial services organizations like Citi? Yeah, I'd say Fin Ops is critically important for any organization looking to operate in the cloud to gain that efficiency. A lot of the things that Jen talked about here, right? But especially for larger organizations, there's a lot more complexity because of different legal entities or lines of businesses or countries. So having Fin Ops, which has these best practices, really helps the organization go from maybe a place where they weren't so familiar with the cloud to operating very efficiently in the cloud. So I would say having that, you know, I call it a GPS for cloud financial management, right? Because it really helps teams navigate that this new environment that they're getting into where things are very different, right? You have the variable spend model. You want to provide things like the visibility into cost and usage all the way down to the edges of your business. These things are new concepts for these larger organizations. And also the collaboration that Jen mentioned, right? Like that's a new thing because generally you had those conversations maybe twice a year, once a year, when it was time to do budgeting with cloud, you want to have that continuously. And you want that to be a value-based discussion that engineering the business organization and finances having, you know, because your usage is going to evolve and change frequently. So with that description, would you say that Fin Ops actually removes organizational siloes? I would definitely agree with that, yes. That's brilliant. So Jen, who in the organization should be involved in Fin Ops? So we talked about the personas already, right? And that's a really important piece that there are different groups that have different levels of needs out of the Fin Ops organization, right? And when we talk about where it should reside within an organization also, usually what ends up happening within an organization is you have multiple people start to think about cloud costs, right? And how to manage it. The finance groups tend to be very concerned about it. They feel like they're losing fiduciary control over because due to the variable spend and the nature of it, their current controls and their processes aren't really good at actually dealing with on-demand resources that result in variable spend. So you start to feel the finance organizations start to feel anxiety actually about moving into the cloud and you probably have all experienced that with your finance organizations. The technology organizations, of course, they see all the advantages of the technology itself, but you'll start to see the CIOs and the executives within the technology organizations begin to be concerned not only about the budget and the cost of it, but over provisioning of resources too, and how you can actually start to leverage the information. And so what we see is that in general, in many different organizations, technology and finance is the place that these start to funnel up with each other. And you can actually see in different organizations the phenops either reside in the finance or the technology groups. And they will tend then to lean on what type of activity that they want to focus on first. If they're in the technology organizations, they will lead to resource utilization and usage and how to control that portion of it. And if you see them bubble up in the finance organizations, they would tend to think about how do we do budgets and how do we do allocation of resources or cost back to the appropriate business units, how do we reduce that cost? They'll be really focused. The best type of organizations probably bring those collaborations together. And actually what we did within our own organization was had co-sponsors from both the finance and the technology organization to help manage and make sure that we didn't go one extreme over the other to break down those silos. That's awesome. So we were talking earlier, both myself and Adam were speaking about the similarities that phenops could have to an open source program office where you have different people from across the organization coming together in order to remove blockers from that aspect of the organization. Would you say that phenops is similar to that type of self-organizing coming together of different stakeholders? It really is. And it's one of the big principles of this, right? And Uddan talked about how it breaks down these silos. And that's what you want to have happen. One of the things that when we start to educate people on phenops that we focus on first is actually creating common language between the two different groups because one, there is a completely new language that comes up with the cloud versus on-premise and technology resources. And two, you need both the finance organization and the technology organization to understand what each of them needs in order for this to be successful because if you don't have collaboration on this, you know, we have seen places of where, if the finance organization tries to control things too much, right, they try to limit the amount and the usage of innovation and the usage of the cloud-based resources. And that's not actually what you want. You want them to be informed and understand the value that these things bring and then they can bring their set of skillset to help reduce cost in these different areas too. So, being part of digital transformation and, you know, seeing how Agile and DevOps actually transforms a big enterprise in terms of culture, would you say that, you know, bringing phenops into an organization also, you know, has an unintended consequence, you know, of changing the culture of an organization? I would agree with that. I think, I mean, the collaboration piece, not to harp on that, but that really is core to phenops and that, I think, then leads to people having value-based discussions in their organization, right, because we're always strapped for resources, always, you know, having too many things to do in engineering, but if you can have this kind of data-driven decision-making, then you really end up having, you know, better decisions made for your business. And to build on that too, you know, one of the nice things about what Agile and DevOps brings to an environment, brings to organizations, right, is their ability to increase velocity. And finance decisions have traditionally been very long in the making, right, budgets are done once a year, you do these very long studies to see whether or not you should spend money. The cloud, as all of you know, the transparency of cost is amazing, right, and the real timeness, so we tend to get, you know, updates even during the day about our usage. They build based on sometimes seconds or fractions of seconds of cost, and so there's this amazing amount of data that is given in near real time that you can make decisions on. And so one of the greatest things about FinOps is really moving that whole-time table forward and really thinking in a very agile organization of how do you bring finance into a really agile organization and make good cost decisions based on near-time decisions. Absolutely. I remember previously we were talking about accountability and how FinOps actually brings accountability into teams, you know, who are actually developing and engineering, you know, with cloud-native solutions. Can you tell me how that is different from a CIO who's doing upfront budgeting, you know, compared to implementing FinOps, you know, where you've got near real-time data, you know, and the ability to adapt fast to, you know, impact and change within your application? I mean, I would say the iterative approach emphasized here is really key to that, right, because as you're getting this data, you're iteratively being able to, you know, make changes to your plans, right? And as a... And I understand, like, there is an importance to that upfront planning, but that planning also needs to account for the fact that your business needs, you know, change, your engineering solutions might change. So having this visibility, I think is super critical, you know, for this kind of change when it's happening in your organizations. Yeah, I would also say that one of the ideal situations, right, is unit-based metrics and economy with the cloud, and it's really being able to understand and make good decisions on real information about the cost of something. So traditional data centers, they tend to, you procure and you're having to take those costs for years, if not decades. With cloud, of course, you can, they're on-demand resources, and depending on the way you purchase our eyes and that you're really talking about short-term costs. And so one of the most, the proudest days that I had within FinOps was meeting with a squad who was doing development work, and they actually measured the cost of their resources and their unit transaction before and after a release, every single time, before and after a release. And so they understand what that release caused from a cost standpoint if they gained an efficiency out of it, which most of the time they did gain an efficiency out of it, but a couple of times it increased their cost and whether or not there was enough value that was being delivered from that release. And so their work times, when they can back out releases because the cost was not enough valuable, was value. So this is actually where you want teams to get to. That is a perfect union of the technologist, the business need, and the finance behind it, right? They're, and I've got to say that most engineers, once they understand that they can actually impact cost decisions, become very engaged with FinOps, you know? So that control that they've never had on-premise is great. And that leads to what the CEO needs. That leads to what those product area and delivery needs is understanding what their products are actually costing. And when Jen talked about the granularity of this cost, you know, the cost data that comes out of the cloud vendors, like part of this is also to adjust that granularity to appeal to the different audiences that look at this data. So the finance folks may not necessarily care about the granular details of every instance or every database or the network charge that happened yesterday, whereas the engineer really does care about this. So it's important to understand the layers in this and aggregate to the right level so that people can get the right value out of this data. Right? So when you were talking about a squad measuring the book before and after effects of making a change, is Finland something that you would put like on a screen, you know, with your squad, like with agile metrics to measure, like burned down charts, you know, and other cycle times and lead times for engineering? Is it something that can count towards your success? It is. And so, you know, there are different, you once asked about the challenges, right? There are different opportunities and challenges with this understanding and breaking down cost to the right persona, to the right person, so that you're showing them what they actually need to make the decisions that they need to make to take their ownership of usage. And so we use a external vendor for our data platform because the amount of data, if anyone's seen the AWS files or the GOOTWIDE is a tremendous amount of data. And so we take that data and we present it in ways for each of these different personas and what they need to do. And that should be a different part. So again, what we would like to see in their natural routines is that they check their usage, they check and see whether they've cleaned up their development environments, whether or not they're launching things within spot usages or whether they're covered under reserved instances and things like that. So they can make decisions that are based on what they need and you want to see this in a fairly consistent routine, whether it's a weekly routine, you know, or something even, you know, depending on the persona how often it needs to occur. That's fantastic. I would add just one point to that. It's also the trend that that's important. You want to look at this data instantaneously, but you also want to see is my team trending in the right direction? Because it is overwhelming when you see that, hey, 30%, 40% of my spend is being wasted, but you want to understand, is it going in the right direction or the wrong direction? Because then, you know, it's not always possible to get down to zero for, you know, optimisation like savings, at least in an efficient manner, because you're prioritising other things, but you might at least want to know that you're not making the problem worse as you keep using the cloud. And I'm going to just add one more thing, you know. One of the things that is really important here is anomaly detection. So trending is actually really important in this space. So you understand when you're going to see increases in spend and when you're not, and what your normal trend is. So anomaly detection is really good, and there are a million different reasons of why you could actually have anomalies happen. And so one time, we had someone misuse a service, actually wrote the coding wrong and was calling the service a thousand times more often than you needed to, which just generated this huge increase in cost, right? And then it ran over the weekend, and of course, we continued to pay for that resources. But by having anomaly detection there, right, based on the trends, you go through and you detect this and you can cut that off as soon as possible.  But I will also say the second reason is that unpredicted usage of resources is actually also being used as indicators of possible data breaches, too, and breaches within your environments. And so having that anomaly detection tells you when your resources aren't being used internally or externally by the right people, so. So briefly, now that we're into the last 10 minutes, can you tell us, you know, how fidelity and also how city are actually using Phinops and maybe some of the challenges that you've actually overcome whilst using it? I feel like I've talked a lot, but so fidelity itself, we are a privately held company. We have 16 different business units-ish and each of those different business units actually maintain their own budget. They maintain and direct their own technology resources. And so when you have this type of model which you get traditionally with these large enterprises, have a lot of these different business units, you want to be able to continue to give accountability where accountability needs to happen, right? But you also want to work together as a group in order to get the most out of some of the, like, the pre-purchasing and other sort of decisions that you're making. And so what we decided to do was a hub-and-spoke model, right? So you have a central organisation that we have, it's a virtual team. It is made up of people from each of those major business units, the larger business units. And we actually work in a contribution type of model actually within it. It is led by both a person from a business unit and a person from the centre so that we get both of those perspectives. And what we do is we talk about all the different opportunities that we have and assign them out to the business unit that is most close or would benefit the most from doing this. And so if we brought on an additional cloud service provider, whichever business unit was going to be using that cloud service provider would be the one to take the lead and then contribute back to everyone else. And so this model has worked really well with us because it, again, one of the principles here, right, is everyone takes ownership for their cloud usage. So the business units still have to take ownership for their cloud usage. And they have to take ownership for implementing the right sort of policies and processes in place and that yet contribute back to the larger enterprise as a whole. Yeah, I mean a lot of the same at CD2. We, organizationally, so I report to the head of public cloud. So cloud financials has a seat at the table for all the things that we want to drive. But from an implementation perspective, I'd say we're doing the visibility aspect first, right? That's first and foremost in this. I think if you can't give visibility to your engineers that are using the cloud, you cannot drive accountability, right? So we're tackling that first. We're also tackling kind of the budgeting process to sort of say that, look, we're in the early stages of this. We can't expect applications coming into the cloud to know how much they're going to spend in 2022 in like July of 2021, right? So instead we're going to a more iterative approach for that of get into the cloud, start using it, start building your solution, incur costs, then from there project out to what your production workload might look like and what other regions might look like in terms of costs so that you can get a better, more accurate estimate and a forecast for your usage. So, yeah, obviously there's also optimization related things. We want to integrate these optimization recommendations sometimes from the cloud vendors, sometimes from third-party tools directly into the developers' SDLC processes, right? Them being there in a tool is great, but then if nobody looks at it, then they don't get action. So instead if they can directly be incorporated into their development process, then these things get prioritized just like the rest of their engineering work. So those are some of the ways that we're... So I'm going to have one more thing about it because I think both Citi and Fidelity did it very similar, it's two, is that down at the bottom here there's these different domains and there's best practices from Fennops for each of these different things. But there's also something at the top that says crawl, walk, and run. And so what we decided to do was not tackle all of these domains at one time. We put our focused energy first of all of where we could make the most impact of the smallest number of people because culture change takes a lot longer than that. And so for us, we came through and said, okay, understanding cloud usage and cost is fundamental to all of this. But really then going to cloud rate optimization and organizational alignment was the key pieces for us. So we spent the first year and a half really focused on those things and doing it really well. And then we started to go into the next domain area which was cloud usage optimization, which is actually harder to do, involves a lot more people and the return amount is smaller. So, Jen, within the last few minutes, you mentioned that Fennops is actually an open source framework. Can you explain what this means and how organizations can get involved and maybe ask more questions and learn more? Definitely. So I'm passionate for an advocate. I reached out to JR who helps really, and he's out there who helped create this foundation because I wanted to participate in it, right? So two and a half years ago, three years ago, I was googling and did cloud optimization and that his book came up in it and then we started to learn more and more about the practice and become engaged. So Fennops is part of the Linux foundation. It has 4,400 active practitioners right now and it is an open source, open contribution type of model. And so from those 4,400, we have, I'm going to hopefully get the numbers right, we have 18 different sigs that you can participate in and we have a number of different open projects right now. Fennops does this great thing is every year they take a survey of all of the practitioners and they ask what is the thing that you're struggling most with? And based on that, they open up a series of projects and so some of the projects that you could participate in right now is how do you get engineers engaged to doing cost optimization, to doing resource optimization? How do you do shared cost and cloud container cost Kubernetes? How do you actually take that environment and get it back to the people who are actually consuming it? So they really listen to the practitioners and they allow them to drive the next set of projects that are opened up and then all of those practitioners are able to do it. They also allow certifications because one of the other goals is really to promote this practice and the practitioners themselves and so they've developed a certification, there are multiple other certifications being developed right now and training and personas. So it is really about supporting this community. That's amazing. We now have just under a couple of minutes to take some questions from the audience if people want to put their hands up and maybe ask the panel. Alisundri. I get it, thank you, you have failed. So the nice thing about the transparency of those bills is that it has everything in there. I will say that when we were doing business cases of moving to the cloud there were costs that we didn't assume when we were creating the business cases and then when you start to see the bills you start to understand what it is. And then you have to, for us, we look at the different costs and our best tool to use is the engineering, the architecture community when really dealing with those costs. So we talk to them and bring information to the table to help them then make the determination about the right way to design an application or to design a transaction so that that cost gets reduced and yet doesn't impact the service level agreements or anything with it. So our goal is never to tell anyone, no, what you're doing is too expensive. Our goal is to have a meaningful conversation where we're bringing data to the table and then ask people to think about things in a different way. A lot of other things that happen on the cloud that you don't get on-premises there's so much more access to different types of services and service level agreements that sometimes architects and engineers come in with one viewpoint of how they're going to solve a problem.  Well, maybe I could use this other service or maybe I could archive this or those type of things and really pushing the architecture to use a lot more of those cloud-native services. That's amazing. We're out of time now. Thank you very much for that question. Jenfrann, sorry, we're unable to take that, but I was going to actually ask, maybe if you can hang around outside. I will definitely go. Maybe we can take a few more questions. So thank you everybody for being here this afternoon to learn more about Phinops. Thank you Jen and thank you Adam for being here and enjoy the rest of OSSF. Thank you everybody.


Good afternoon, folks. Steve Rhodes coming to you live from the shores of Delray Beach, Florida with your 2 p.m. update. And currently we have the Dow up 436 points. That's one and three tenths percent. The S&P's up one and a half percent or 62. The Nasdaq two and two tenths percent, 288 points. Brussels up half a percent. That's 11 points. Semi's up three and two tenths percent, 97 points. Strandy's up 180. A little over one percent. Gold is off 34 bucks. She's trading down at 19, 26, 70. That's one and three quarters percent to the downside. A half a percent for silver. That's 11 pennies at 25, 18 lights. We crewed off $6.39. That's down six percent. Natural gas is off two and a quarter percent or 10 cent. The 30 year treasury trading out of 150 to 05. Let's go spend a little time with our indicee charts out here. Let me see if we can get that going. We can. I've got the weekly chart up on the screen here. I'm going to try to change this to the daily timeframe. We'll come back to the weekly. We take a look at the, and don't do this to me. Okay. So I've got a streaming issue going on. That's a bummer right in the middle of it. So we're going to have to go to, let's see if it populates here real quickly. We're going to have to go to game plan B. Good thing we've got a game plan B. I don't know what it is, but I'm going to come up with a real quick. I know we'll do. We'll go simply go take a look at our nine panel market update chart. Sorry about that, folks. What actually we can do is take a look at the indices. So let's pull up. That's really terrible. Here we go. Here's the indices. So we take a look at the indices. What do we know right now? The Dow is trading the back above. It's February 28th swing point. That's a little bullish sign. The S&P still consolidated with inside that swing point from February the 24th. My apology. Not the 28th inside the NDX 100, which tested rejected. So far the swing point from February 28th. Just consolidating with inside that swing area. The Russell 2000 doing the same. The semis doing the same out there. That's not the case with regard to the transports. The composites just trading with inside that 24th candle out there. So it's just kind of a good old fashioned consolidation ish. If you will, not a ton out there to report on that with regard to the indices here. Quickly, let's take a look at the index ETFs. What are they doing? The index ETFs still with inside their swing point other than the Dow, which is trying to close above 332.74. That's the top of that 24 swing point. Folks, that's still an area that you really want to see price close above to suggest that there is some room to the north out here. But stay tuned. Your favorite polar bear. David whites up next. Tom O'Brien will take us on home. I'll be back with you on wonderful Wednesday. Please have a terrific Tuesday and thanks again so much for joining us.


Welcome, everybody, to the Meet the EFF panel. Thank you all for coming. We understand that we're up against General Alexander, so it's a tight competition, and we're glad you all decided to spend your noon hour with us. So thanks for being here. So this is the Meet the EFF panel. We're going to go and have brief introductions from each of our panelists who represent some of the EFF folks who are working to defend your civil liberties. Actually, a quick show of hands. How many people here are members or otherwise very close to familiar with the EFF? Okay. Thank you. Thank you very much. For those who don't know much about the EFF, you'll learn a little bit today. We are civil liberties non-profit that fights to defend your rights online privacy, free speech, and innovation policy, try and make the world safe for security research, to do their research and talk about it. And we're here today to answer your questions about what we do. We have a great selection of panelists. We might not have the particular person who works on a issue you have a question about, but we'll do our best. And one thing I wanted to say is if you have a question that's specific to some situation that you're in, this is not really the forum for those kinds of questions. One of the things we do is we provide counseling to people who needed pro bono, but this is not the forum for those types of questions because we want to make sure that if you did have such a question that it was in a confidential, privileged manner. But for general questions about what we're doing, cases we're working on, policy issues, this is the place for that. Before I begin, I just wanted to play for you a short video that we created to support coders' rights. And this is, well, let me just let it play and then we'll introduce the panel. Thank you. The production quality is, I understand, not very high, but that's because when you donate to EFF, your money is going mostly to programs and not to video production quality. All right. So let me start off by introducing myself. I'm Kurt Oppsall. I'm a senior staff attorney at EFF. I work on a wide range of issues. Probably the most prominent thing I've worked on lately was representing Matt Inman, the creator of the oatmeal in a dispute that he had with Funny Junk and attorney named Charles Carrion. I can tell you a little bit more about that in the Q and A session if people are curious. And let me turn it over to you. Hi there. My name is Eva Galperin. I'm trying. Here we go. Let's try this again. Hi there. My name is Eva Galperin. I'm the International Freedom of Expression Coordinator at the Electronic Frontier Foundation. I think I'm the only member of the international team here. So if you have questions about what goes on in the rest of the world, state-sponsored surveillance by authoritarian regimes and such, I am the person to talk to. Do it. Hey everybody. I'm Hanny Fukuri. I'm a staff attorney with the EFF. My focus is on criminal law. And recently we've, or some of the work I've been working on has included some work on cell site location data. And we just recently filed a brief in a Washington state criminal case challenging the constitutionality of Washington state's cyber-stocking statute as a First Amendment violation because it covers a lot of protected speech. So, yeah. Thanks for having us. Hi everybody. My name is Trevor Tim. I'm an activist at EFF and I do a lot of work on free speech issues and government secrecy and surveillance. So we can talk about WikiLeaks or surveillance drones coming to the U.S. And given that General Alexander is in the next room, we can also talk about our NSA warrantless wiretapping lawsuit that's been going on for six years. And just a reminder that actually just a week ago today the NSA admitted for the first time that they violated the constitution in a letter to Senator Ron Wyden. So we can talk about that too. I'm Peter Ackersley. I'm technology project director. I work on a range of issues from a computer science sort of perspective. The big ambitious thing that our team is working on over the next three or five years is encrypting the entire web. And we have a few projects that are helping to do that. And we've got a few more in the pipeline. HTTPS everywhere, the SSL observatory, sovereign keys. So if you have questions about encryption or EFF software projects more generally, you can ask them. Hey there. My name is Marsha Hoffman. I'm a senior staff attorney at EFF. I work on the civil liberties team. And I consider myself kind of a generalist. I work on privacy free speech issues. Our coders rights project which works to ensure that security researchers can do the awesome cutting edge work that they do without running afoul of the law. A couple of things that I've worked on recently include our requests to the copyright office to grant exemptions to the digital millennium copyright act to make sure that people can legally jail break phones and tablets and video game consoles. I also have done some work on a case that we're handling right now. Our client is a tele communications company that was the recipient of a national security letter. And we are representing that company in its challenge to that letter in the associated gag order. I also have been involved in a couple of amicus briefs we filed in cases in the past year or so. Involving attempts by the government to force people to decrypt data. And the question of whether the Fifth Amendment privilege against self incrimination applies in situations like that. I know that last year here there were a lot, a lot, a lot of questions about that. And I suspect that you may still be interested in that. And I would just flag that I'm actually giving a talk about that topic only on that topic in a couple of hours. And so if you have questions about that you might choose to wait and go to that talk. But if you want to ask questions about that here that's cool too whatever. I'm just going to jump in quickly to other fun topics that people can ask questions about if they want. One is the phenomenon of Apple's crystal prison and all the other lock down devices that we're facing, particularly with modern mobile devices and what we're trying to do about that. And the other is open wireless networks and encrypting open wireless networks so that you don't have to lock people out of your network in order to be safe from eavesdropping. Okay. Thank you panelists. And so let's start. We can start with your questions. Unfortunately we do not have a mic for the audience. So I'll ask you to say your questions and then I will repeat them so that everybody can hear the question clearly. And those who don't have loud voices maybe want to come up and be close to cut so he can hear you. Well, let's start out with you, sir, in the front row. So the question is about the NSA warrantless wiretapping lawsuit and the question is who are we representing? Do you want to take that? I can take it as well. So we have two lawsuits related to the NSA warrantless wiretapping. The first one we filed was against AT&T for its cooperation collaboration with the program. And in that case it was a class action. So we had a representative set of plaintiffs who were AT&T customers. That was based a lot on some information that a whistleblower provided to us about the Folsom Street facility which is a facility in San Francisco where in which there was a room built into the facility containing a splitter that would split the signal and send one copy of it off to the NSA and the rest routed to its destination. And so these were customers whose communications had gone through that facility. The second lawsuit was filed against the government itself, against the NSA and other elements of the governments that were participating in the program. And in that case we were trying to get a couple of things. We had the same set of plaintiffs who were saying they were injured by it because their communications had been splintered off. And we're also trying to get a ruling there that what they're doing is unconstitutional. Get a ruling at least on the merits of what is done. As far as the question, you know, what's the injury, what's the damage, is one of the things that is provided in a variety of the statutes, the Foreign Intelligence Surveillance Act and Electronic Communications Privacy Act and such are statutory damages, damages that are set by law where Congress recognized that sometimes damages for privacy violations may be hard to prove and set that forth in the statute. I'm just to add on to that a little bit. As far as how do we know this is going on, you know, after the New York Times reported on it in 2005, you know, dozens of major news organizations reported the same thing. And this evidence has been kind of in the public record for, you know, six years now. And even after Congress passed the FISA Amendments Act, which is actually going through Congress right now for renewal, which we are strenuously opposing because it really, instead of strengthening privacy protections in the wake of this scandal, it actually weakened them for Americans talking to people overseas. But even after that passed, there's been numerous reports that the NSA is still collecting just purely American domestic communications. The New York Times in 2009 said that they had been doing it still in a systematic way. Wired just reported a few months ago, I'm sure many of you saw about the massive data center they're building in Utah, which they plan to store basically every email sent around the world. And William Binney, who is actually on a panel here later this weekend, he, it was an NSA, longtime NSA employee, and he actually just joined our case, one of three NSA whistleblowers to present evidence in our more or less wiretapping case against the NSA. So the evidence is vast and yet still the government has yet to allow us to present that evidence in court. So the follow on question is, do we have a discovery and to get further evidence from that? And the answer is no, we did not actually get to do discovery. The case, even though it's been six years, is still in the preliminary stages. They have, well, there's two cases. So the first case was moving forward. They tried to get the case dismissed. That failed. And then went to Congress to get retroactive immunity given to the telecoms. There was a big battle in Congress over that, but unfortunately, telecom immunity did pass. And we fought the constitutionality of that and took that to the appeals court as well, but that unfortunately was not successful. I mean, it's flattering when you have your case being specifically talked about at the highest levels of government and they pass a special law just to kill your case. But nevertheless, that doesn't get us any closer to ruling on the merits. And then the second case against the NSA and the government, the state secrets privilege was asserted. And so we need to resolve whether or not the state secret privilege prevents us from moving forward with the case before we go any further. So we're a long way from that sort of thing. All right, another question. Sir. So the question, let me just repeat the question. The question was about SSL decryption devices placed outside a network so people can look at SSL communications perhaps to find malware, but also examining the communications. So this is a, I won't say totally common, but it's a thing that a decent number of companies do. They install these devices and then they go around to their employees' machines and add a root certificate. They make that a trusted certificate for each of the devices that's on that network. And then every device, whenever it makes a TLS connection, it gets man in the middle. The key it sees isn't the true key for the server it's trying to talk to so it does a handshake with the firewall and the firewall gets to read the contents of the encrypted communications. I'm not a lawyer, so I'm not going to give you the legal analysis of this and maybe one of my colleagues will, but I will say that doing this without getting very clear explicit consent from all of the employees who are affected by such a device is extremely risky. Okay, and then the sub part of the question was about the legality of it. So there are a number of laws that affect when you can eavesdrop on communications, most prominently the WireTap Act, which is a federal law. The WireTap Act requires one party consent. However, a lot of state laws require all party consent. And so one would certainly be wise, as Peter is suggesting, to get consent of all parties to a communication before intercepting it. There's also a provider exception that allows a provider to do things to protect their networks, but that would have to be that for someone who is a provider of it. So I mean, I hate to say it, it's often the case with these sort of legal questions, but it depends and check with counsel is probably the best answer. I'll take another question. Sir? Okay, so to repeat the question, the question is about TOR and other anonymizing technologies which may sometimes be used by people like child pornographers or other malfeasers. And the question is, does that affect how we feel about the technology and how we react to it? So from a legal perspective, I think that this is something that comes up in our discussions when we think about which cases to take. Because what we're trying to do on our legal team is try to pick the best cases that we possibly can to create a really good impact in the law that's going to help a lot of people, right? And so, you know, when a case comes up that we're thinking about maybe getting involved in one way or another, you know, and it involves child porn, for example, that's certainly one of these things that we take into account. Because I feel that often in cases like that, the judge is really going to want to bend over backwards to make sure that person gets punished, right? And sometimes I think that that creates the possibility that the judge is going to bend over backwards to sort of torture the legal analysis to make sure that that person gets punished.  To give you an example that actually does not involve child porn, how many of you are familiar with the Lori Drew case? Anybody?  And, you know, the daughter was all excited that this, you know, this good-looking guy was into her and all of this.  And the girl became very, very depressed and she committed suicide. And it was, it was a terrible, terrible thing. And there were a number of prosecutors who looked very hard at that situation and I think they thought, you know what, somehow that should be illegal. And they looked into it and they couldn't really find any laws that they could prosecute her under. And so one prosecutor had this idea that maybe they could use the federal hacking law, the Computer Fraud and Abuse Act, to go after this woman on the theory that when she signed up for a fake MySpace account, she violated MySpace's terms of service. And in so violating the terms of service, she was gaining unauthorized access to MySpace's servers and therefore was guilty of violating the Computer Fraud and Abuse Act. And they, you know, they pursued a felony charge against her. Now the problem with that is, if that woman is guilty of a crime for violating terms of service, then that's going to be the case for all of us. And you've read these things, right? I mean, or you haven't. And that's part of the problem, right? I mean, you could be guilty of a crime for violating something that you never read and you don't even know what's in it. And of course that would be a big problem. And so we got involved in that case as an amicus. And ultimately a judge found in that case that it just couldn't be the case that violating terms of service turns you into a criminal. And we thought that was a very, very good outcome. But you know, I think that this demonstrates, at least from our perspective, as a legal organization, how difficult it is sometimes to deal with those sorts of things because you're right. On the one hand, you know, somebody's been accused of something really, really bad. And often they, you know, it appears that they've done something really, really bad. And perhaps as a society, you know, we say we want to punish that. But we also want to be careful not to do it in such a way that it moves the law in a direction that could affect a lot more of us that are not even implicated in that case. Eva, do you have something you want to add? No. I'll take another question. Let me see if I can get somebody in the middle, sir. Okay. So the question is, the gentleman comes from Spain. There are some protests who are organizing through social media. And do we have some experience in helping protesters internationally who are protesting using social media? Well, the work that EFF does internationally is a little bit different from the work that we do domestically because we do not have lawyers in every country. So we don't actually litigate internationally. But what we do do is we work with activists on the ground in order to help them to help them organize and oppose these kinds of laws. And we work with the organizations that already exist in the country in a sort of partnership in order to give them our support and sort of move the, our many members towards this issue. A lot of countries have actually looked at criminalizing certain kinds of speech in social media, including the state of Veracruz in Mexico. And I think there's also a similar law in India. And recently there was the Twitter joke trial in the UK where a British citizen joked about blowing up a plane over Ireland and was taken to court for, I think it was, I think today, was it today? Possibly yesterday that he had been convicted and he went on appeal and was acquitted today. So we do work with people all over the world and we certainly oppose these kinds of laws and try to draw attention to them when they happen. Okay, next question. I'll take at the end. Repeat the question. The question is if I could elaborate on the collaboration between EFF in the United States and EFF in other countries. EFF is not divided up by country. There is just one EFF. It's 30 something of us sitting in an office in San Francisco. But our reach is international because the internet is international. What we do is we collaborate with other organizations such as the online rights group in the UK. We work with NOAT in Tunisia. We work with an organization called Global Voices which helps give voice to bloggers all over the world and sort of highlight times when they're in danger for things that they say online. We've worked with the committee to protect journalists. And there are many sort of EFF like organizations all over the world and we try to encourage their formation and work with them to oppose bad laws in their countries. There are a few organizations called electronic frontiers like there's electronic frontiers in Finland, electronic frontiers in Australia. And those are fellow travelers but they are not directly affiliated. We don't have, they're not branch offices. So I take another question. In the back there. So the question was about battles about throttling bandwidth and where ISPs have, ISPs being asked not to connect to certain websites which I think maybe a reference to some of the ICE seizures of domain names and I guess a reference to throttling of a bit torrent by certain networks. Do you want to talk to that part? Sure. So we did a lot of work a few years back when Comcast which is the second largest ISP in the United States started injecting forged reset packets into bit torrent and other peer-to-peer connections and also some other protocols that their firewalls just randomly confused for peer-to-peer. So Lotus notes I think was having its connections reset and other stuff like that. So that Comcast back then was doing that very blatantly and a number of other ISPs were. And we ran the first controlled tests that confirmed that it was definitely Comcast doing this by collecting data from both ends of the connection. And that led to the FCC, the Federal Communications Commission, attempting to establish authority over a network neutrality in order to prevent Comcast from being able to do this kind of thing. And there's been a huge like kind of side argument about whether the FCC has the legal authority to do this and whether they're the right institution to do it. But the state of play at the moment is that all overtly US ISPs have kind of agreed not to do this sort of thing. And they've tended to be sued and run into trouble when they have done it. So if you're aware of a US ISP that is definitely throttling, differentially throttling traffic to one domain versus another, that's a really interesting thing to come and talk to us about, or just draw attention to, and it will tend, just drawing attention to it will tend to get the problem fixed. Because I think that a US ISPs are under a lot of pressure not to do this kind of thing. Internationally, the situation is more varied. There are a handful of countries such as the Netherlands that have actually passed explicit network neutrality laws. So in those countries, it's outright illegal to do this kind of thing. Whereas in the US it's more complicated. And there are some places where it's more overtly just, okay, we're doing it and getting away with it. And so I think what the internet community needs to do is catch companies that are doing it, draw attention to it and make sure it stops. All right. On the edge there with the EFF hat. So the question is how often are we engaged by legislatures and their staff when they're crafting legislation and drafting it? Okay, I'll take that. Fairly often we have some contacts in DC. Our main focus for advocacy is more on the litigation establishing precedent side of things. But nevertheless, we have had some good communications with some people back in DC over the language of bills. Do they listen? Well, I mean they listen. They don't necessarily do what we ask them to do. But you know, their staffers will make the time to be on a call with us, at least some of them, not all. And then we also, from time to time, will get involved at state legislative levels and also have some of our international team working on things like EU directives and some of the sort of semi-legislation that occurs out in that sphere. One great story of the sort. There's a big difference between talking to people, which people tend to talk to us. Sometimes they even come to us and then write a bill based on stuff that we tell them, but then there's this whole other question of whether the bill passes and becomes law and most of the time it doesn't. And then there are times when people in government and in Congress come to talk to us but don't listen. So a good example of this was Quaker and SOPA and PIPA, the various internet blacklist bills where they came to us and said, you know, we need to censor websites in order to, they didn't say censor, we need to take down these websites in order to enforce copyright law. And we said, no, you don't, that's a terrible idea. You should definitely not do this. And they didn't listen to us. They continued to try and pass those bills. And so then we ended up basically with the giant political campaign that we and a number of other groups ran against SOPA and PIPA that culminated with blacklist day. And we won. So sometimes they don't listen to us but we win anyway. Thank you. And thanks, I mean, I'm sure many of you were participants in the fight on SOPA and I think it's worth calling out and thanks for the clap there. That was a watershed moment in trying to put some sanity into what Congress did. One of the first times where Congress was really coming forward with a really bad bill and they were being told by the content industry, you know, this is fine. Everyone on the hill was saying this is a done deal and the only question is how bad is it going to be? And through massive grassroots support, it was turned around. So that was a really great thing. And it's important to point out that after SOPA and PIPA went down, they listened to us a lot more now. Sir, you were at it for a while? The question is what is the current state of encryption keys and being asked to give up your password and the Fifth Amendment? So for those interested in this issue, I'm going to speak about this briefly but I have an hour long talk about this later this afternoon. And so I don't want to take all of the, I don't want to steal my own thunder here and have you all just not come because you're like, oh, okay, I got the deal then. Two o'clock, right here. Two o'clock. So this is a really interesting question. Basically the issue is the privilege against self-incrimination, which we get from the Fifth Amendment, which ensures that witnesses have a right to remain silent and not have things that they say be used against them. And how that affects attempts by the government to force people to disclose passwords or encryption passphrases or, you know, simply compel them to decrypt data and then turn over a version that the government can then read and use. And there have been a couple of big cases on this in the past couple of years and I think that the rule that we can see from this new precedent is that, you know, if you have a valid Fifth Amendment privilege, meaning, you know, the government is trying to force you to make a testimonial communication that would reveal things in your mind that would tend to incriminate you, you can have a valid privilege that keeps the government from forcing you to decrypt your data. However, this can have limits. And the case that was decided first this year, you know, basically said, you know, listen, if there is a situation where the government already has a pretty good sense of what is, what that data is and that you have control over it and custody over it and it can, you know, it can be authenticated in some other way, then, you know, really they're not forcing you to say much more than they already know. And in that case, you might not have a valid Fifth Amendment privilege. So that's kind of the story there if you want to hear more explanation about it. Come this afternoon, please. Alright, another question. In the back, EFF hat. So the question is, what is EFF's position on the deployment of drones, offensive, domestic deployment of drones? Trevor? So, in February, the Congress passed a bill called the FAA Modernization Act and buried in this bill is a clause that says the FAA has to start issuing drone licenses to public agencies, including law enforcement agencies. And the FAA itself estimates that by the end of the decade, there may be as many as 30,000 drones flying in the U.S. And so these drones aren't, you know, going to be shooting missiles, but they will be able to do pretty much everything else that military drones are capable of, whether it's surveillance, you know, flying for hours or days at a time.  But they can also be equipped with facial recognition software, fake cell phone towers that can intercept text messages or phone calls or crack Wi-Fi or, you know, a Texas sheriff even suggested that he wanted to put less lethal weapons, he called them on drones like rubber bullets and tasers for crowd control. So, you know, the dangers are kind of unprecedented, especially in the privacy area where, you know, there aren't really laws that protect us against this type of surveillance. When you walk outside your home, you could potentially be followed by a drone for 24-7. So we've actually been working a lot in this area over the last six months. We filed a Freedom of Information Act lawsuit against the FAA. They were actually keeping who had the authorization to fly a drone secret, even though if you fly a manned aircraft, the FAA is actually very transparent.  But they didn't do that with drones at all. So we had to sue them and they released a list a few months ago that detailed about 60 public agencies that have drones. Now it's about up to 100, but again that's about to explode because of this law. So actually we're running a, because the FAA only really told us who was flying them, we don't know what they're using them for. So what we're doing now is we're running a campaign with an open government group called Mukrock. You can go to their website at mukrock.com and we're trying to file a public records request with every police agency in the U.S. that either has a drone authorization or wants to get one. So we've already filed with everybody on the FAA list and we're trying to ask them what are they doing with these drones? What do they want to do with them? What kind of type of surveillance are they going to, to use with them? And then we're also going to ask your local police station. So you can actually go to mukrock.com and fill out the simple form and they will file a public records request on your behalf and they'll do all the, the legal trouble and all the tough stuff. All you have to do is just fill out, fill it out with your information and your local police agency's information and you can find out hopefully if they have plans to get a domestic surveillance drone. And so once that we gather enough information in that regard we hope to take this information and take it to local city councils or municipal governments or state governments or even congress so they can pass legislation that can really set up robust privacy safeguards so if drones are being used to follow somebody that they have a warrant first and there's already a couple bills in congress going around right now. We don't know how much support they have but let's say generally this, this idea and hopefully our goal at least is to stop this before it becomes a problem and to kind of have this legislation be implemented before there is a drone flying over every town in the US. Alright thank you. So the follow up is are there any private organizations that are on the FAA list? Not yet. Right now only public agencies can get drone authorizations but that's going to change in 2015 according to the bill that congress passed that I just mentioned. In 2015 commercial entities can start getting drone licenses so you can, we might start seeing you know FedEx flying a fleet of drones to deliver packages across the US. In the black shirt fourth rule? So the question is how to reach out to people who might be satisfied with the status quo and to speak to them about some of the troubles and why they should be opposed to things like warrantless wiretapping and how do you, how do you communicate with those groups? So you know this is a really interesting question and I think we saw a little bit of this in January in the US Supreme Court when in January the US Supreme Court issued a decision called USV Jones that talked about the physical installation of a GPS device on a car and the Supreme Court held that that type of installation was unreasonable and in violation of the fourth amendment. Well it held that it was a search under the fourth amendment and because in that instant case that the court was considering it was done without a warrant it was unconstitutional. What was interesting about that case was during the oral argument Chief Justice Roberts who I would certainly say is a man of I don't know higher standing or whatever you want to call it asked the government attorney in that case whether under the government's interpretation of the law if they could install a GPS device on every single person of every single member of the Supreme Court's car to which the government attorney rightfully answered as they argued in their brief yes and naturally the Supreme Court unanimously said no and you know found the search unreasonable you know found that the installation of the GPS GPS device was a search but I think that really kind of captures how we can approach these technical concepts to people who may not necessarily be worried about it. You know in the Jones case the defendant they were surveilling was a guy who was a suspected drug dealer and he ultimately got sentenced to life in prison so you know this is kind of going back to your question you know this is somebody who maybe society may not think really deserves a break but I think when the technology got boiled down to a got boiled down to a way and explained in a way where nine elderly members of society who are Supreme Court justices are pretty highly ranked members of our society can recognize like you know what it's a bad idea if we let the cops just put GPS devices on anybody they want wherever they want for however long they want that's when change starts to happen and I think the way that gets done is both through just people like you talking to your friends and talking to maybe like your parents and people of an older generation who may not be as familiar with the technology and help them explain hey you know what you remember how you when you put a letter in the mail you don't expect the post office to open the letter and read it you just expect them to deliver it shouldn't the same thing happen or be true of our email and I think all of us here I think we all try to do that we all try to explain these kind of complicated or not so complicated but you know concepts that are relatively new to an audience of judges and legislators who may not necessarily appreciate them and I think as that happens more and more that's where you're going to start to see a change in societal values another example just very briefly and I'll stop talking like in the cell site location data think about a year ago I think you know everyone at DEF CON may know what cell site location data information is but the general public probably didn't and you didn't have a lot of major media companies covering it but in the last four or five months we saw as a result of the ACLU's FOIA request where they got all this information about it and as a result of some poking around by some congress members to different cell phone companies about hey how many requests are you getting from you know law enforcement when the number came out and it's the number that was reported was 1.3 million requests in 2011 and there have been some people who have suggested that that number is actually closer to one and a half million once that number comes out in the Wall Street Journal runs an article about in the New York Times runs an article about it and congressional leaders are starting to ask questions that's when you know people are starting to take notice so that that's that's how that change has to happen just to add on to that a little bit I think a lot of the times the problem is with people that are you know not they wouldn't attend this conference that may not know a lot about technology or the internet is the way that the problem is framed so when they hear things like the stop online piracy act they think oh that's people downloading music in movies and we're against that so we're obviously for this bill but what they don't understand just by the title and maybe by reading one news article about it is how broad the bill is and how it could affect millions of people who have never even thought about copyright infringement and could censor thousands of websites that could have just gotten caught up in a broad sweep of whether it was the attorney general or corporations doing the censorship so it I think it's important to kind of explain to people in more detail about how bills work rather than what they're called another example is a the data retention bill which actually just got dropped in Congress there with the author of soap a Lamar Smith had this bill it was called I don't remember the exact name but it was sent essentially stop child pornographers act but what and so what it would do it would force ISPs to keep your data for a year or 18 months so the law enforcement could access it whenever it wants and now you know this would have applied to everybody not just investigations regarding child pornography so often they use these buzzwords that people will just attach to without thinking much when in fact they actually affect a far broader group of people and so it's it's tough to get past that but that's that would be the lesson is to try to explain to them how a bill works rather than just what it's called or what it's trying to stop yes so the question is how do we respond to people who think where are all tinfoil headers you know I mean we try and make sure that everything that we do is backed up and sourced and is quite reasonable and I would say you know one of the things where this was coming up a lot was in the question of whether the NSA was engaged in in massive surveillance and it was very very helpful to have a whistleblower who could say that they were actually involved in installing the splitter in a secret room and in the Folsom Street facility but in the early stages of that there were some questions as to how we could make that information public and originally it was all filed under seal and so there were some awkward times in the beginning where yeah we were one of our staffers was on Fox News and was getting interrogated by Kovuto you know where's your proof where's your proof and of course we we did have the proof but at that point we couldn't make it make it public so the the question is whether EFF has experienced intimidation or shady experiences and I mean I have not you know I've not had any particular screening problems at the TSA or you know strange vans outside my house or anything like that but I guess is anyone I've never experienced anything like that and in fact I tend to think that just maybe maybe logically maybe we're even you know more protected from that kind of thing than other people because if anybody did intimidate us or you know you know try to make us feel uncomfortable I think that would be a really big press story most likely and so I tend to not have worries like that you know largely because I work at EFF. So I was just given the the one minute warning so we're gonna halt the questions from now but they will continue in the Q&A session which I believe is across the hall in a small room setting so if you have further questions I come there we'll also be around for the rest of the weekend we have a booth over in the vendor area where many of us will come by to hang out there's also another booth over at the Hackers with Guns shooting game so you can support EFF, shoot guns and and see us at the booth there so we hope to see you all around the conference for the rest of the weekend and thank you so much for coming it's been wonderful that we've been doing this for eight years thank you


Ukrainian drones attacked two oil refineries of Russia. Each explosion disrupts fuel supplies. On the morning of March 16th, two drones attacked two oil refineries in the Samara region, according to Telegram channels Baza and the city of Saisran. According to information from the Telegram channel Baza, a drone attacked the territory of the factory in Saisran, a fire broke out covering an area of 500 square meters. Currently, the area of the fire is 500 square meters, the channel reported. Additionally, a drone attacked the Novokuy by Shevsk refinery. A fire also broke out there, but firefighters managed to extinguish it. At the same time, several other drones attacked the Novokuy by Shevsk refinery.  The Baza channel administrators reported that, the local administration of Saisran has confirmed the information about the fire. Telegram channels report that the refinery belongs to Rosneft. The local Rosneft refinery in Saisran is on fire after a drone attack. AVT-6 is under attack again as one of the video's authors says, this is a unit with two rectification columns, the heart of the plant, where oil refineries are located. Andrey Yusov, spokesperson for Defence Intelligence of Ukraine, said that every explosion at a Russian oil refinery disrupts the supply of fuel to Russians in the combat zone in Ukraine. Yusov has neither confirmed nor denied that the strikes on the Russian oil refineries were the work of Defence Intelligence of Ukraine, but he specified the types of facilities at which explosions occurred. These are both storage and production capacities. Every such incident that has disrupted the operation of some facilities over the last few weeks or months also disrupted the pace of the supply of fuels and lubricants to the occupying forces in Ukraine. It gives our Defence Forces extra time and opportunities and helps save civilian Ukrainian lives. Tanks cannot function without fuel. Resurrects the supply of fuel, tanks cannot function without fuel. Recent events clearly show that the process is ongoing and will continue, Yusov added. He said that the explosions occur at military facilities which cover the needs of the Russian forces. Russia awakes to biggest attack on Russian soil since World War II. The biggest attack on Russian soil since the Second World War continues as waves of attack drones continue to fall on Russian oil refineries, military bases and security services. At least 60 drones were spotted over not less than 7 Russian regions overnight on March 13th with at least 7 more in a morning wave Russia's Defence Ministry announced. A major oil refinery is a blaze in Ryazan. Military bases were targeted in Voronezh and an FSB building was damaged in Belgorod as multiple waves of drones continue to fall in regions across Russia. A missile threat was also reported by the Governor of Kursk Oblast. The waves of drones are a continuation of attacks on March 12th that saw Russia deal with at least 25 drones over 9 regions that struck at least 2 oil facilities. A Russian air force base in Butulinovka and a military airfield in Voronezh were targeted in the mass wave of airstrikes an informed source told N.V. on March 13th. It is believed that the strike was organised by Ukraine's security service with other representatives of the Defence Forces the source told N.V. The consequences of the attack are being clarified. Part of the city of Voronezh was blocked including the south-west market after a drone attack while another community in the region was left partly without electricity. Some districts in Butulinovka are experiencing power outages following a drone attack local outlet Astra reported. Major oil refineries in three Russian regions were the main targets of the overnight attack organised by Ukraine a source told N.V. Our task is to deprive the enemy of resources, he said. Large oil refineries in Ryazan, Kostov-Ovnizy Novgorod Oblast and Kiryshev of Leningrad Oblast all among Russia's five largest were targeted in the mass drone attack, he said. The attacks are a continuation of a series of special operations against enemy refineries that the Ukrainian army had previously launched, the source said. We are systematically implementing a well-calculated strategy to reduce the economic potential of the Russian Federation, the source added. Our task is to deprive the enemy of resources and reduce the flow of oil money and fuel that Russia directs straight to the war and the killing of our citizens. Our task will be continued, pledged Andrey Yusov, a representative of Ukraine's military intelligence.