So we can get started. Hi, everybody. Welcome and thank you for coming on what I think is the last block of sessions in the conference. So yeah, we've been using Hyperledger at Corsa for about three and a half years in production now. And we're really excited to share what we've been working on with the community. My name's Alex. I'm Corsa's head of infrastructure. So I handle things like our infrastructure's code and building containers and everything, sort of of that nature. And today I'd love to discuss some recent work we've done as part of sort of a venified development partnership with CERT Manager. So we'll start off today by discussing why trust is so important and why we went to such lengths to sort of do this integration. We'll briefly review how fabric manages trust today and the current off-the-shelf sort of options. We'll double back a little bit to talk about why we at Corsa care so much about this in particular and why we use a blockchain to accomplish our business goals. We'll briefly review how we use and deploy fabric and then move on to just a quick sort of overview of what CERT Manager is, how it works, what it does, and how we use it in the context of our application, essentially. I look forward to demoing just sort of a quick poke around our Kubernetes cluster. We can view one of our staging clusters and view CERT Manager in that context.  So we talk about how we push CERT Manager to the fabric network edge and then conclude with some lessons learned. So fundamentally, it's all about trust. Why are we all going through all this trouble of using a rather complicated distributed system? It's about a way to sort of programmatically decentralize trust.  Initially used it for currency, a fairly straightforward application. And Hyperledger is here sort of building on that use case and extending it to support arbitrary data sets. Fundamentally, fabrics implemented by flowing trust through a PKI, which is a very mature and well understood technology. And it allows us to achieve massive scale. Bitcoin measures its transactions per second tens of transactions per second. Hyperledger, I mean, people do 20,000 plus. So we basically achieve this massive scale by using this PKI technology. So just sort of a quick high level overview here to give us some context. Components are usually booted up with a certain set of certificates provided to them at startup. So this is sort of called certificate pinning. And when a component comes up, it says, basically, OK, I've been instructed by my operator, my trusted user, that if a request comes in or I'm presented with a signature, if it is signed by something I trust and it's not expired, fundamentally, then it's considered good right now. I know we can get into like no to use and some more nuanced sort of ways and the way fabric uses X509 inserts. But at a high level, right, that's how things are working. So in the official fabric documentation, there are two primary ways of provisioning these certificates when you bootstrap your X509 PKI and start up your fabric network, right, via the Cryptogen tool, which is a binary command line, and then via the fabric CA. And throughout fabrics documentation, right, they refer to concepts you can extend when using other CAs, but they sort of say, well, we support this, you can use them, but there's no documentation on them. And so we'll explore another one of those today. So to sort of go into each of these sort of off-the-shelf tools that it does document quickly, the first one is Cryptogen, right? This is sort of what people are pushed to when they first start getting involved with fabric, right? It's a binary program, runs on your local machine, and it generates a full PKI, right? It just sits on a directory structure on your machine. And then it's basically up to the operator to manually distribute this PKI to all the different components, right? Sometimes it's Docker shared volumes, sometimes people are manually copying things over. It's very simple, right?  It comes at a pretty steep cost, right, in weak term, this trusted setup. So specifically, right, it's all in one place. So if I'm an attacker, right, all I need to do is basically somehow intercept this bundle of certificates and private key material and I own your network, right? We have our little attacker here, maybe you could spin out phony components, right, using legitimate PKI or you could swap out your legitimate certificates with their corrupt or otherwise bad PKI and just one of many examples, right? Beyond like the sort of Byzantine implications of this, it in general makes maintenance difficult, right? How do we handle a certificate rotation? How do we swap that out, right? It's a lot of manual steps in transferring these certificates from where they're generated out to where they're actually used. And it raises secondary concerns like how do we securely store these certificates well after they're out in the network, like where do we make backups, destruction of data, right? If I rotate out certificates before they expire, do I have legitimate certificates floating around on a hard drive somewhere that are still valid? So the fabric sort of community, I think, acknowledges this, right? And has implemented the Fabric CA and this is sort of the officially recommended route for production deployments according to the Fabric docs. There's a Fabric CA container infrastructure that's distributed official for Hyperledger project and everything like that and the CA binary integrates with either an LDAP that you bring or it integrates with the Postgres off the shelf. So the way that this works at a high level again is clients submit a certificate signing request that is signed by their private key, right? So there's a huge benefit here in that the client generates this key pair on their own device, right? And the secret key never leaves the client for the entire duration that the client interacts with the network. So we get a green check mark here. That addresses probably the biggest drawback of CryptoGen, is that the certificates are generated in a distributed fashion. And the way that a client sort of authenticates itself to the CA says, please sign my certificate. It says it provides a username and password, right? And it counts on someone else to say, okay, it will be a time in the future where a client will present this username, password, combination. You are allowed to sign a client certificate or a peer certificate for them, right? And that sort of puts then the responsibility on the client for actually reaching out. The client is provided from an administrator, CA administrator who is ever setting up this account with these username, password, combination, right? And then it interacts with the CA either via REST, there are SDKs, right? There's a Fabric CA client binary. It reaches out and obtains the certificates it needs. So this is a graphic that I took right from the Fabric CA documentation itself, right? Fabric CA is designed to be run as a separate service and it's pretty much a standard two-tier web app, right? You have your application tier which runs the business logic of the CA, performs the actual cert signing and then that's backed by a persistence layer. So we can see that at the extreme right of this diagram, right? So you can back it with either an LDAP database or various RDBMSs. Fabric CA has its own configuration format, right? It has the concept of a bootstrapping. So if you have a root CA as in this diagram, the intermediate CA can contact root CA, get its own CA cert signed and then participate in the network. And again, this is all handled sort of asynchronously through a config. So what does this mean that, you know, if you're deploying this and you wanna use this in prod? Well, you have to follow traditional, you know, service deployment best practices, right? Do things like load balancing as they sort of reference in this diagram again in the top right. And you have to address concerns like RDBMS scaling, right? It could become a scaling bottleneck. And again, these are all well understood technologies, but again, it is just sort of things that you need to keep in mind and keep in view. So what does this all mean? I mean, we've discovered that this is hard, right? Running a CA is hard. There are many large companies that make an entire business out of doing this like Verisign, DigiCert, right? Challenges, there are always challenges around RDBMSs, right? Right, replicas and that sort of thing. And just scale in general, right? Do you provision for peak? Do you auto scale? How do you implement that? You know, it depends a lot on your workload, sure. But it's again, it's all of these concerns around running a CA that doesn't really have anything to do with blockchains or fault tolerance or any of those sort of core fabric offerings, right? What we also found is a challenge with the CA is it has its own RBAC system, right? It uses attributes encoded in JSON and X509, V3 extended, right? Attributes and certificates to allow, you know, okay, you're allowed to sign certs for this type of a client, you're allowed to sign certs for this. Who can create usernames passwords, right? And it's basically you have this whole other layer of authentication, right? In that who's allowed to sign certificates on top of your existing fabric enrollment certs. We found that, you know, the bootstrapping process can't really be extended well to third-party CAs, right? The concept of a bootstrapping sort of necessitates the ICA be talking to another fabric CA at the root, right? The bootstrapping is sort of a unique thing here. So you can't talk to Venify or you can't go out and talk to like DigiCert or anything like that to get your certificate using the bootstrapping process specifically. In terms of longer-term maintenance concerns, right? We use a separate CLI to interact with fabric, right? Either even if you're interacting over rest, right? Using Curl or something or the fabric CA client, it's on the client to implement this and invoke it in some way to get these certificates. So that begs the question, well, what happens upon cert expiration, right? We never went through with implementing this but just sort of a quick thought experiment, right? You need to detect your certificates expiring soon, perform the CLI client call, right? And then somehow swap that into your node. And that's tough, right? We did it manually. So it's truly a hard challenge. And we had to tackle it because we care a lot about trust, right? So what we fundamentally do is we offer a security product, right? We built a cybersecurity solution on top of Hyperledger fabric. And essentially what we offer is an MFA solution for APIs. So we have a little diagram here of the DLN is again top right. And what we do is generate unique identities per API client that we then validate down low at the service, right? And then go from there. What this means is that our deployments are typically mission critical, right? If you're a customer who is looking for this level of security for your API clients, a lot of government users and that sort of thing. So we need to drive the attack cost through the roof, right? We can't have one RDBMS because, you know, there are some well resourced adversaries here that will attack any single point of failure. So we care about trust because our customers in turn must trust us. So just a quick sort of a side here to give a little context, we deploy fabric on a Kubernetes cluster using a tool called Helm, right? So fundamentally we use one Kubernetes namespace to deploy the core fabric components along with some license management stuff. And again, we have our fabric maintenance jobs scripted some to some are Kubernetes prod jobs, some are just one-off jobs. We have rebased all of the fabric containers on Department of Defense iron bank containers to minimize our attack surface there. And all of this to deploy multi-tenant deal ends. So we have on the left a distributed ledger namespace that will be shared between and many customers. Again, all separated out. And these are fronted by certain small microservices that again we implement as a company to sort of facilitate this interaction with fabric. So on top of this, you know, by using Kubernetes, right? We gain cloud agnosticism, right? We run equally well on-prem. There are customers that run us in a totally air-gapped environment on virtual machines and that sort of thing. GCP, AWS, Azure, we run on all three. Within the last year and honestly within even the maybe the last four months. So yeah, this is sort of what we're trying to protect, right? And we have so many challenges with scaling out the CA in particular as we scale out like we've done some research work recently where we've deployed like 49 peers out, right? And it's like, how do you handle that scale and manage that trust, right? So, you know, how do we scale a CA without needing to deal with the operational headache of running this big, scary, very powerful web service exposed to the internet basically? And our answer to that was to adopt CERT Manager. So just for those of us who aren't familiar with it, CERT Manager is a open source project and what it essentially does is it signs X509 certificates using pre-configured backends which in CERT Manager parlance is called an issuer. Here in this graphic like we have, we have multiple different types of backends we support, right? The ones I've listed here are the ones that it supports out of the box. There are tons of third party plugins for Cloudflare or most of your other issuers honestly. You know, if your DNS system supports the ACME protocol, right? You can issue CERTs that way. It works with HashiCorp Vault, right? And it works with all of these simultaneously. You could be running 50 of these. And again, it's a form of indirection, right? And on the bottom, it's issuing CERTs using this to it can issue it to peers, fabric clients themselves will get into specifically how that's done later or just your typical web service that needs an FKDN CERT sign for to serve its web UI or something like that. The way they accomplish this is CERT Manager uses the Kubernetes API exclusively, right? So in Kubernetes, again, it's declarative infrastructure, right? Resources declare, I need a certificate. And they specify what they need. And again, we'll get into the specifics here. CERT Manager is always watching the cluster effectively subscribes the Kubernetes API server. And as soon as that request is put on the cluster, it does the backend work, right? It says, okay, you know, this peer wants a certificate signed by this CA and it goes and it handles the interaction and it just gives it back to the peer. All of the authentication authorization is done by the Kubernetes RBAC API, right? So none of that is implemented in CERT Manager. Kubernetes gives us so many features here that they just sort of delegate that out there. So if we can add a little depth here, this is an actual certificate object that I pulled off of one of our clusters, right? So this is a, it's a custom resource definition, right? And just sort of going top down, we specify to CERT Manager how long before the CERT is typically expired should CERT Manager handle the renewal. Right beneath that, I'm sure we'll all recognize these standard X509 fields like organizational units, common names, expiration dates, right? These are basically all copied verbatim into the signed CERT, assuming the CA doesn't modify anything like that. It allows us to specify the private key type. Obviously, Fabric requires ECDSA certificates. So we manually override that here. I think it defaults to RSA. CERT Manager, of course, supports X509 v3 extended attributes. So for an enrollment CERT, right? We need the digital signature usage. And then finally at the bottom, this is the linkage to tell it which CA we actually wanted to get signed, right? We tell it, okay, I want the issuer CA, the issuer one, this is a local key pair, but this could be Vennify, right? Enacme provider, whatever you'd want. And that's it. You just kubectl create this object and it works. So this is sort of a architecture diagram of how trust flows now through one of our production configurations using this sort of paradigm, right? So we root all of our trust in air-gapped root CAs. So this is just offline key pair that never sort of leads, that never hits the internet and is never live in the cluster. We manually sign intermediate CA CERTs from those. We use a little go binary we wrote internally, but you can use open SSL or anything. And those are what are given to CERT Manager in a secret, right? As a key pair and it is then registered as a CA. And then from each one of those, and we have three orgs in our production networks and those all flow down into the peers. We run our orders in org one, so the trust flows from there. And then towards the bottom, we have our CORTRA off server, which is how we again run our back and authorization on clients. And if a client earns its trust, basically, we issue a CERT there and the trust flows through there. And just a quick aside, our consensus policy is two of three, right? So we can tolerate the loss of any one org. Cool. So yeah, now I think we have time for a quick demo. We're just going to explore a cluster, one of our staging clusters. So hopefully this will be large enough. All right, so first I'm going to just get the pods and we can... So first we'll look at one of our production clusters. Actually, this is in staging, right? So this matches a production cluster topology, but we're not in prod right now. What I would like to point out too is that at the bottom we have our nine peers all running. We use external chain code. So this is all the chain code that backs up each peer. What else? There's our orders here, some of our maintenance jobs and what we use to set up the fabric network. I'd like to point out that there is no CA running here, right? We don't have any Postgres, there's no CA. That's because they're here, an issuer. So an issuer is a custom resource introduced by cert manager. And here are three CAs backing this cluster now. They don't exist in the traditional sense, right? It's just sort of a group of keys that tells cert manager, okay, when someone wants to cert for org zero, use this key pair, sign it and get it back to them basically. So if we want to go look at cert manager itself, we store those in our ingress, all right, we got a bad rap here. We store those in our ingress namespace and basically cert manager consists of three main components. There's the logic itself here. This is the CA injector. So this configures the Kubernetes API server to basically trust cert manager and to send all of its objects that it's creating to cert manager to see if it needs to be signed or there's any action. And then these web hooks are listening from Kubernetes. So a cert manager configures a subscriber essentially on the Kubernetes API server. And as soon as anyone creates a certificate object or certificate request or anything else that's associated with cert manager, these are waiting there and they are listening and then they make changes to the object, invokes cert manager itself or whatever else is sort of needed to get taken care of. This is in an HA configuration. So we are scaled out and we can sign several hundred certs per second, I think, honestly in this configuration. So if we want to go look at the certificate objects themselves, we'll go back to our demo cluster here. So here we have all of our certificates that are back in the cluster, right? I'm sure a lot of us recognize this. So here is our enrollment cert for a peer, for example. For mutual TLS we have a client cert, right? Server certs and then this is just replicated for everything. Cert manager is what's actually modifying these statuses, right? So we have a real time update of whether the certificate has been signed and it's available and ready to be used. And then we finally point to the actual Kubernetes secret object where the cert data itself is stored. This is just more of an abstraction. So if we dig in, we'll grab this, or we'll grab an enrollment cert. Grab one of these enrollment certs at the bottom. Actually we'll describe it. So we get the full sort of range of Kubernetes API commands. Again, this is all implemented in a custom resource definition. So we get basically real time status on all of our certificates in the cluster. Cert manager has let us know the last message was okay, I've signed the certificate, it's not expired, it's continuing to check, right? We have the time it expects to renew the certificate. We have the maximum age, right? We see all these sort of fields that we declared a few slides earlier in our definition. And yeah, again, our usages. So this is sort of the abstraction that Kubernetes holds and that the cert manager binary itself is watching to know when it's time to renew if anything's up. Yeah, so the benefits of cert manager aren't just in this sort of automation here, right? There are other add-ons that, again, work with this binary. It's an indirection point. So one of the things that we utilize at Corsa is, it's called JetStack Secure. So these are the makers basically of cert manager itself. And what this is, is this is an additional sort of add-on that we've put into our cert manager object. And what this does is it synchronizes our cluster certificates. Now just the certificate portions, right? No secret information leaves the cluster. And this is a SAS. So now we and our security team can get a full sort of insight here into every certificate that's in our cluster, right? So if we dig in here to one of our certs, right? We could see it makes some recommendations, right? In terms of certificate health, how we can better utilize these some of them might not apply, right? Like we sort of have to use ECDSA for fabric. But again, we can view the cert metadata. We can sort of trace through who issued it, right? So here are our cluster issuers, right? We looked at these a little earlier. So it provides us with this sort of all-in-one monitoring tool. You can configure Slack alerts to alert you if something's up. But again, it's one place. You can just sort of find the status of everything, right? You can find the renewal. And you don't need to be digging into the cluster to get this sort of thing. Right, yeah, so standard production deployment. Yeah, this DLN, just for your information, we sustain about 100 transactions per second, right on this, 2,000 transactions per second, read, give or take. So to sort of carry this forward, right? How do we sustain this over long periods, right? So CertManager gives us a lot of benefits like automatic rotation, right? We support a number of CAs. It completely abstracts CA management from the application code, and in general just improves security hygiene. One sort of trap that we fell into, right, is that if you spin up your fabric network all at around the same time, CertManager in general is very fast, right? So it will sign all of your certificates at once. And so if all your certificates are signed at the same time, they'll all expire around the same time, right? And so this could be very bad in that your entire cluster essentially goes down cryptographically, right? Because all your certificates are expired, and sure, I mean, CertManager can, you know, reprovision them quickly enough, but you might have lost consensus, and you're in big trouble. So I just wanted to include this little bit of pseudocode that we have implemented where we essentially hash the name of every individual component, right? Strip out anything that isn't a digit to get a pseudo random number, and then normalize that so that every component has a different lifespan that's somewhere in the last 50% of the certificate's life so that different parts are, you know, maybe they're getting rotated more often than they need to, but, you know, one peer goes down at a time, then maybe some days later, another peer will get its certificates renewed and we sort of spread this out and, you know, we can easily tolerate that sort of behavior. So as we sort of wind down here, I just wanted to go over some concepts around extending CertManager outside of the Kubernetes cluster, right? So, you know, CertManager's power and capability, a lot of that lies in the fact that it runs inside of Cates, right? But it is totally dependent on it, and that's nice in a way, but the question is, and that we faced was, well, you know, a fabric network isn't just peers and orders, right? People are using it, right? It's how it delivers business value. So how do we basically push this capability to sign certificates out of the cluster? And our answer to this was, well, we handle it in our app, right? So a client, when it's first booting up, will generate its own CSR and will submit it to our services, right? So that's this inner dashed line, right? So when it's first booting up, it supplies CSR and then it runs through our control plane, microservices logic, fronting this, where it goes through, sort of our business logic, our back checking, right? We check that it's allowed to get a certificate signed. And then we pass it right into Fabric, right? Our chain code has a CertManager client, really, it's just a Kubernetes client in it. This chain code is responsible for submitting this certificate request onto the cluster. The chain code then waits until the signed certificate is ready and then it follows this green path back out, the signed certificate. And then at that point, we have a signed enrollment cert, we can interact directly with Fabric services. And we did not have to expose a public CA. So I'd just like to conclude here with some lessons we learned through this effort. We have been running this CertManager integration in prod for darn close to a year now, maybe 10 months. So we found that Fabric components read there, certificates once at start, right? So it's not like an Ingress controller or something where you can swap the contents of the file system and it will immediately get used in the logic. This makes automated cert rotation challenging, right? You need to figure out how to basically get this, get this application to read its updated certs, which are just silently updated in the background by CertManager. So to get around this, we just use an off the shelf tool called the Reloader Helm chart. And what it does is it watches all the secret information that's attached to a pod. And when anything changes, it bounces the pod and restarts it. And then that solved that problem. CertManager is a best effort service, right? They don't really do a blocking operation or anything like that when you want a certificate signed. So what we have to do is sort of a two phase here. We submit the certificate and then we pull or we submit the certificate request and then we pull until the certificate is signed and ready to come back. CertManager supports raw PEM, right? You can, if the API doesn't support exactly the fields you need, you can just give it a raw certificate request PEM and that'll get signed. And lastly, if you manually create certificate requests, so it's not matching a certificate object, which is what we do in the slide before for outside clients that are outside of Kubernetes, make sure to clean them up. CertManager will dutifully monitor them and keep them up to date, even if the client has long since come up, done its business and stopped existing. So we eventually wind up with thousands of these certificate requests knocking around. So just make sure to clean those up. We implemented just a tiny little cron job to take care of that. And that's it from my end. Happy to handle any questions and yeah, thank you again. The patient processes are chained in the media CA and the root CA and maybe you can have it in the more layers. Just to also handle that. Sure, so yeah, the question was about chaining different tiers of CA's essentially. So this currently does not, it's a really interesting question. I don't see any reason why CertManager, you couldn't use it to sign an intermediate CA from a root CA. We just sort of do it manually. That is a deliberate business decision to keep that a manual process because the root is sort of the root of everything, right? And that way we don't have a root CA that ever goes live on the cert. But I mean, it's an incredibly flexible tool, right? And at the end of the day, it is signing X5 on Ion Certificate. So I'm sure you could chain it. Yeah, cool. Well, if there are no other questions, I'll be up front here if anyone wants to chat. But yeah, thank you again.


Rhaid i'r ddechrau. Fel ydych chi wedi gweithio i'r yrwng. Ibaug. Rhaid i'r ddweud i'r ddim yn gweithio i'r ystod o'r argynno a llwythol i chi. A ydych chi'n gweithio i gael y cyfnod o'r cyfrifiadau gwirio'r cyfnod o'r 2023 ac yn y llwythol y dyma. Rwy'n meddwl y cyfnod o'r ffordd ac yn ymdangosol, Ac oeddwn i wedi gweithio'r lleidol hwnnw i'ch gwneud o'r ffrif o fynd i gweithio'r holl yn ysbyt i Wales. O'r ffocos yn y ddyfodol, yma, ar y ddweud y bydd ymgyrch, yw ychydigau'r ysgrifennu hefyd, ac oeddwn i'n ddweud yn ei chyfydig ar yr oedd y gweithio. on rated also won to say slightly down about the very important work that we'll preoccupious as a government over the immediate未 yet months ahead during this spring term. So contrary, we will begin the next phase in rolling out free school meals to all primary aid children across Wales. And this month, we'll答 as well the next phase yng Nghymru, o'r llyfrgellau cyfnodol, o'r 2 yw'r yw. Yn Febrwyr, rydyn ni'n gweithio'r rhagleniol, o'r rhagleniol hefyd, o'r rhagleniol hefyd, o'r rhagleniol hefyd, yn ymgyrchol i'r ffordd yw'r economi. A'r hynny, ychydig yn ymgyrchol yw'r rhagleniol hefyd, than Wales's first-ever satellite, Cardiff-based Spage Forge's Forge Star Zero. Due for launch in Cornwall later tonight, it's designed and built here in Wales. Designed and built by a team of talented engineers, scientists and technologists and all of us will be looking out for a successful launch this evening. February as well will see the introduction of our new net zero skills action plan. We know that the jobs of the future are bound up in our effort to create that greener future for Wales. Those will be the jobs and skills that will be required in a successful modern Welsh economy. By the time we arrive in March, we will have a budget to pass. This has been the most difficult budget round since the start of devolution and we will be working hard with others to secure the votes needed to confirm the budgets on which our public sector partners and others rely. In March, we anticipate that the social partnership bill now in front of the Senate will complete its passage onto the statute book and that's a real sign of the sort of progressive government we provide here in Wales and a stark contrast with the ongoing attacks on workers' rights which continue at Westminster. Over the whole of this year, we'll be supporting schools as they phase in the new curriculum for Wales, a curriculum which will see children learning about Welsh history and the history and diversity of communities here in Wales and particularly the stories of Black Asian and minority ethnic people. The climate and the nature emergency quite certainly have not gone away and this year we'll see fresh action to preserve and restore Wales's natural habitats and to stem the loss of species and we'll be working hard with Plaid Cymru to see if there are ways in which we can further stretch our ambitions and bring forward the date for achieving a net zero Wales. As part of that, our clean air bill will be introduced in March of this year and later in the summer we'll implement the ban on single use plastics which the Senate passed just before Christmas. Now last year we were proud to welcome thousands of refugees to Wales from Hong Kong, from Afghanistan and from Ukraine and those efforts will continue right across the whole of the coming year. We remain determined to provide a warm welcome to all of those who have chosen to make Wales their home. I want to say something about the cost of living crisis which continues to heat pressures on families and on businesses with very little sign that this will get easier anytime soon. All the indications point to this year being another tough one for families right across Wales. The UK economy is now in recession. Inflation remains in double figures. Food prices are rising fastest of all and energy bills will go up again in April of this year. We know the sacrifices that families are having to make to help to get ends to meet and this year and the next according to independent experts are likely to see the biggest falls in disposable household incomes ever since records began. That is the background against which the Welsh Government will continue to do all we can to help people providing targeted support where we can and by putting money back into people's pockets through our universal schemes and programmes free prescriptions free school meals other things that we do here in Wales to leave money in people's pockets to deal with all the other demands that they face and at the same time we will continue to put pressure on energy companies to reduce costs for those who have the least. It's a scandal that people who rely on prepayment meters should have to pay for energy before they have used any energy at all and we call again on the UK government to put an end to the daily standing charges for prepayment customers and to move to a social tariff a social tariff that would offer protection to those for whom energy costs are now such a significant drain on their weekly incomes. I want to say something about the health service and the continuing difficulties which this winter poses for our health and care services. A combination of high levels of flu a return of coronavirus circulating in communities over Christmas together with a rise in cases of Strep A has led to unprecedented levels of demand right across the whole of the services which the NHS provides. The 27th of December was probably the busiest day the NHS has ever experienced in the whole of its more than 70 year history. Here in Wales 550 people were admitted to hospital on the 27th of December alone and at the same time we have a very large number of people who are in hospital but medically ready to be discharged. They may be waiting for tests or assessments or for some elements in a care package but while you have that extraordinary demand at the front door of the hospital it's right that we take action to free up bed space for those whose needs are the most urgent. That is why Wales's chief nurse and the deputy chief medical officer recently issued advice to support clinicians safely to discharge some people home where they can be supported while they wait for those tests while they wait for those assessments. You don't need to be in a hospital bed waiting for that to be carried out. Now the pressure on our hospitals over the Christmas and the new year period has meant that some people have waited a long time to be able to access care and I echo the apologies of the chief executive of NHS Wales to anyone who has experienced such a weight but at the same time I want to thank all our NHS and care staff who have worked incredibly hard once again over this Christmas and new year period to treat and to look after the great many people who have turned to the health service for help. Now the weeks ahead will continue to be challenging ones for our NHS. On Wednesday members of the GMB trade union employed by the Welsh ambulance service will hold a second day of strike action. Ambulant staff will also take part in coordinated strikes called by the GMB and UNISM in large parts of England on the same day. Last week the UK government announced plans to introduce new draconian anti-strike laws which will make it even harder for workers to take part in industrial action in the events of disputes over pay or terms and conditions. Unlike the UK government, the Welsh Labour government does not believe that the response to strikes should be to bring forward such restrictive and backward looking laws. Laws by the way which would trample over the devolution settlement as well. We recognise and respect the strength of feeling demonstrated by members in these ballots and through the industrial action taken. We know that these are never decisions which have been reached lightly and we remain committed to working in social partnership with our trade unions to explore a way to resolve current disputes. It was in that context that on Friday of last week the health minister wrote to health unions in Wales to invite them to discuss an offer to try and resolve current disputes. We have worked very hard across the government and across the Christmas period to bring together the resources which underpin the offer. An offer which has three elements for discussion and for negotiation. A one-off non-consolidated pay ward paid for from this financial year's budget. Secondly discussions on ways in which we can move forward on staff welfare issues and on reducing agency spend. And thirdly ways in which we can work together to restore confidence in the pay review body process. Now I hope of course that we will be able to find a resolution to this dispute in social partnership and I look forward to those meetings happening with our trade union colleagues later this week. All in all then we have a very busy year ahead, a year in which there are challenges but as ever opportunities for us here in Wales. The way we will face them is the way we always face challenges here in Wales by coming round the table and facing them together so that we work hard in partnership to build that stronger greener and fairer future for us all. Diolch yn fawr i chi gyd. As ever, I'll now take questions from our journalists colleagues, some of whom are here in the room and some of whom will be on the screen. And first this morning to Felicity Evans from BBC Wales. First Minister, thank you very much. If you could answer bilingually I'd be very grateful please. Are you able to give us more details of the nature of this one off pay award offer? How much are you offering? To whom is it being offered? Are you now treating health workers as a special case in all of the potential industrial disruption that we could be facing this year? Well we will begin discussions this week with our health trade unions because there are actual disputes and actual strikes taking place in that sector. That does not rule out of course continuing to discuss with trade union colleagues in other sectors the issues which they are facing and potential solutions we could offer here in Wales. I anticipate that I am lucky to disappoint you during the next half hour by not being able to share specifics over amounts of money or how it might be used. These are negotiations with our trade union colleagues. It will be disrespectful I feel not to put those issues in discussions with them first. Once we've had those discussions we will of course share more of the details but it's right and proper that the people who we are directly in discussions will get to hear some of those further details when we have the opportunity to be around the table together.  Diolch. A again with the second question please are bilingual answers if you would. Ff y UK Government we are hearing reports that the UK Government is also planning to offer a one-off payment to striking health workers and also offering talks with trade unions, is it just a coincidence that your government and that government seem to be adopting this common approach and are you expecting i'r rhaib amgylchedd arddangos bwysig iawnion er gynnwys ar gyfer gweithio'r gwyprws uchydigol? Mae drosgu rhaid serodd, rhaid nhw'n pryd yn rhaid gweithio yn gweithio'r rhai gwasanaeth yng Nghymru. Felly mae'n rhaid i'r gweithio'r gweithio yn gweithio'r gweithio'r gweithio. Yr hyn, mae'r Gweithdoedd afterno, i'r gyfrifoedd cyffredig yn gweithio, new year period I will have lost count of the number of meetings I will have had with the finance minister and her colleagues looking to try to draw together the sum of money that we are now able to discuss with our trade union colleagues and the timetable for our letter and for our meetings was entirely within our own hands and not influence at all by whatever may be happening at Whitehall. Well, quite certainly if there is new money available to pay staff in England that should lead to a Barnett consequential here in Wales. That is straightforwardly how the rules should operate. I'm afraid we've become more used than we would wish to be to the UK government finding ways of avoiding the Barnett formula but we will certainly be looking very closely indeed at anything that they do put forward and if it involves new money then the system is absolutely unambiguous that should lead to money for Northern Ireland, for Scotland and for Wales and if money did come to Wales for those purposes I'll say again what I've already said to our trade union colleagues and money that came our way as a result of pay discussions in England would be devoted to a better pay offer here in Wales.  Diolch yn fawr, Chrissie. Over to Adrian Masters in ITV Wells. Thank you, First Minister. In England, the UK government has announced extra money to commission extra care home beds. Is that something you're looking at here in Wales, at least are you looking at a similar scale? And related to that, a lot of people have raised this with me as an idea. Why not something similar to field hospitals as a way of taking some of the pressure off hospitals? Well, first of all, Adrian, I am not certain that the UK government's announcement has any new money behind it at all. They announced the identical sum back in July of last year. Had we created a population share of additional beds based on what the UK government said was provided for England back in July, we would have had to found 350 additional beds in Wales for this winter. We have 508 at present confirmed, so we have already far exceeded any equivalent figure for Wales. And there is money in the system to go further. So it's not a money problem. The problem here is much more to do with capacity and particularly to do with staffing. And in many ways, that is one of the answers to the suggestions of field hospitals. First of all, let's not forget, field hospitals didn't appear out of thin air ready to go. They took building, they took creation, you know, it would be many weeks before any field hospitals would be up and equipped. But the real challenge to field hospitals is finding the staff to operate them. So we are 1000 staff down in the Welsh NHS today as a result of COVID. 800 or so people directly experiencing COVID and over 200 others not able to be in work because they've been in very close contact with somebody who has. And of course, you know, members of staff in the health service and the social care services are more vulnerable in many ways to catching influenza and other diseases because they're constantly in contact with people who are suffering from them. So I'm afraid the issue, it's not just as simple. And I've heard it put by people who are very well meaning and you're looking to help us with solutions that we could go back to field hospitals because even if we could create them really rapidly, staffing them would be a real challenge. And that's part of why we haven't yet been able to commission at least another 300 beds beyond the 508 we already have in place, which we've got funds for for this winter in Wales. Thank you for that. And I wonder whether it's clear that you see this as a very severe situation, very serious situation for the NHS in Wales. Do you recognise it as a crisis for the NHS in Wales? Well, look, I think there are days in which hospitals and the people working them absolutely would have felt that they were dealing with a crisis. Thankfully, the most difficult days around the 27th of December, those pressures eased a little last week. So it's not a perpetual state of crisis, but there have been moments and days with the pressures in the system would have felt very much to people managing it, responding to it, as though they were dealing with a crisis. So I'm not seeking for a minute to underplay those pressures or to suggest that they've not been exceptionally difficult, but it's not a chronic state of crisis. As I said, mercyfully, things improved. So things are still very hot out in the health service. The demands in January will continue to be very, will demand a lot to the people who work in the service, but it's not a perpetual crisis in the way that some people suggest. Adrian, thanks very much. We're going to go to Laura Clementson, Wales Online, who's joining us on the screen. Oh, sorry. We're not going to. We're going to go to Andy, who's here in the room. Andy Davies from ITNs. Just picking up on that theme, First Minister, when you look at the state of the NHS in Wales in particular, the times people are having to wait for treatment, the frankly awful conditions that some people are having to endure while waiting for that treatment. Are you embarrassed? Well, I wish things were better for people. I wish people didn't have to wait the length of time that they do. And I wish that other physical conditions under which staff work and people sometimes have to wait could be better than they have been while the system has been under such pressure. I do think it is important and just fair to people who work so hard in the system to step back just for a minute. We published as we do every month the latest figures for the NHS in Wales on the 22nd of December. They show that waits are down at every point in the system that we are seeing more people within 21 weeks from the start to the finish of their treatment than we have at any time since the pandemic. We have 20% fewer emergency admissions in the Welsh NHS this winter than we did in the winter before the pandemic because of all the extra things that we have put in place. A record number getting on for 15,000 people in a single month learned that they did not have cancer in Wales because the system had carried out the tests necessary and come to that conclusion. And the standard wait for triage in a major emergency department in Wales is 20 minutes and the standard wait to see a senior doctor is one hour 40 minutes. So while the system is under huge pressure and I'm keen to emphasise none of this is to minimise that, the system goes on managing to see hundreds of thousands of people every month and to do that successfully. In the context of being fair to those people who work within the system, as you just mentioned, do NHS staff in Wales deserve bigger pay rises than those currently awarded? Yes, I've always said that. Do people deserve that? They do. They deserve to be fairly rewarded for the vital work they do and it is no surprise to me that a decade of austerity followed by runaway inflation has the impact that it has on people feeling that they have no alternative but to express the disquiet they feel, so the action they are taking. The amount of money we are able to put on the table for recurrent pay awards is absolutely linked to the level of pay awards that are struck in England that then gives rise as we heard earlier to a barmy consequential for us. That is why when we meet our trade union colleagues later this week, I'm not in a position to offer them a higher pay award that will build into their salaries and go on creating a platform for the future, but we have managed to find a sum of money that would enable us to make a one-off payment to our NHS staff before the end of this financial year and that's what we will be discussing with our trade union colleagues when we meet them hopefully as I say later this week. I'm going to carry on, I think, talking to people in the room, Simon. I'm just checking that that's the case which Hannah Thomas is here from LBC. Thank you. So the Royal College of Nurses says a one-off payment won't end strike action and I know you say you can't give us detail but you said there are discussions that will be taking place this week. Can you just enlighten us as to what is going to happen and whether you can meet their demands? Well, I saw that the RCNA Wells had said that the letter that they'd received was a step in the right direction and they looked forward to those further discussions. I entirely understand that trade union colleagues would much rather have an increase in the offer that has been made to them for this financial year that would then build in as a new platform for whatever award will be made next year. Of course, I understand that. I've carried out many trade union negotiations myself on that side of the table. We are simply not able to do that in Wales but what we have done as I say it has required an enormous amount of work involving in the end every single one of my ministerial colleagues to look at plans that we have for the final quarter of this year and to amend those plans to release the sum of money that we can put on the table which we can then talk to our trade union colleagues about how that sum of money could best be distributed amongst their members. It will not be and I recognise that from the outset what trade unions would ideally be looking for but it will be a sum of money that would not otherwise be available to their members during a difficult period with all the cost of living pressures that we have faced that could go directly into their members' pockets and no trade union would not be willing to talk about that even though in the way that we've heard you know we know from the outset that it would not be their preferred solution. Thank you and just a few days ago Plaid Cymru have accused Welsh Government of hypocrisy so you know obviously Welsh Government have hit out with the UK Government at all these strikes and yet so far you haven't had talks with unions. Is that going to change? Well it wouldn't be true because we talk to our trade union colleagues all the time. I had a series of discussions with trade unions myself last week as we worked our way towards the letter that we were able to send to them on Friday. There have been further discussions with trade union colleagues this morning on the Welsh Government and there will be a formal meeting as I hope by the end of this week based around the letter that Elinod Morgan was able to send. So I think it simply wouldn't be true to say that we have not continued in conversations drawing on our long history of social partnership here in Wales that has led us to the position that we reached on Friday. Hannah, thank you very much indeed. I am going to go back to the screen now and I see Laura Clements from Wales online as the first person. No no I'm so sorry we have some technical problems here and so it's Elid, Elid gwawr of BBC Cymru. Diolch yn fawr, os o'ch chi at y pein yn ddweud eistaf byddwn ni'n rili diolchgar. Ddech chi ddeud cyn rŵan a does na unrhyw arian ar gyfer cyflogau yn y sector gyhoeddus fe sydd i newid yn yr hythnos y dweudau fel y gyfo'ch yn gallu gwneud y cynnig yma ar gyfer gweithwyr yn y sector iechyd? Wel pan oeddwn ni'n ddweud does dim a fwy o arian beth ond yn gyferio ato oedd y ffaith does dim arian ddani ni'n gallu rhoi i wneud fwy nag oeddwn ni'n dysgwyl wneud dros y timor hi'r beth i wedi digwydd dros y wrthnosau dweithau yw a gwaith ni wedi wneud i trili ten ni arian digwydd i roi fwy o arian just am mewn un pekin a bydd hwnna ddim ar gael yn y fwy arianol nesaf. So mae hwnna wedi digwydd ac aros y gwaith gale ni wedi wneud i edrych ar y pethau o'r flaen ni yn y cwaterola o'r fwy arianol hon ac ail trefni pethai. Fy f Tinder ei arrian. Gw Before I said previously about there being no further money for pay awards, asked what has changed in the last few weeks. What I explain was is that when we talked about there being no further money, that was in the context of a consolidated pay award in which we would have put extra money into pay packets this sy'n dwi'n meddwl yn ysgrifennu. Yn y ddechrau, ond ond rydyn nhw'n ei wneud i'ch gweithio yng Nghymru. Mae'n mynd i ddweud i ddweud o'r grifennu hwn o'r rhaid fathion, yr adnodd iawn i'r ddweudio eu cwm yw ddweudio. Yn rhaid i gael eu cwm yw'r pan fydd yn gweithio'r ddweudio, rydyn nhw'n meddwl i'ch gweithio'r gweithio'r gweithio'r ddweudio. I'n fwyaf i'w ddifwng ar gyfer amddangos yma ac yw'n fynd i'n dweud yn fan hynny'n ymwysig hynny... ...eg yn ddifwng allan o'r amlwg i'r dda i chi'r gwneud yw i'r ddweud i ddweud am ddangos o'r gweithio... ...ag am ddweud ar gyfer amddangos ymwysig hynny, ar gyfer amddangos ymwysig hynny. Mae'n ddweud wedi'i ddweud ar gyfer amlwg i'r ddweud i'r ddweud... ...y'r ddweud amlwg i'r ddweud. That means that that one-off sum of money is available, and that's what we will be discussing, we hope, by the end of this week. Diolch yn fawr. Ych chi'n debygau na chi ddigon o breth ydw i'n mynd i'r dda i mwy o bobl asian o rispytyn, dyf y staff i'n ei dyn nhw. Ych chi'n deud ydw i'n mynd i'n cael mwy o'r staff, dda chi'n mynd i'n syni fel atebion ta mor ber i problemau ta mor hi'r iawn. Wel, wrth gwrs, ni'n bysoddi fwy o arian mewn hyfforddiant, mewn unrhyw a amser dros y cyfnod, o dwi'n just ddech yn oly, dros y cyfnod o'r agwasanaeth iechyd i gyd. A ni'n bysoddi 2,62 miliwn o bynnoedd yn y flwyddyn arian o hon fwy o bobl yn cael a hyfforddi'n a unrhyw amser. A ni'n hyderus nawr a bif 12,00 fwy o staff yn dod mas o'r y proses hyfforddiant erbyn 2,00 pedwar ar y gain. A ni'n siarad nyrsys, doktoriad a pobol eraill sy'n gweithio fel cynnigwyr yn amais. Dyna pam hefyd a ni'n wedi yn barod a dachre talu a cyflog byw i'r staff sy'n gweithio yn amais gofal. A chos lot o'r bwlchau sydd anu, dydy'n nhw ddim i gyd yn amais iechyd, mae nhw'n yn amais gofal yn y gymuned a hefyd. A chos i'n ddim i'n gweithio yn y dyna'r gweithio, mae'n gweithio'n gyfnodol ar gyfer y staff sydd angen eu cyflogol a'r cyflog. Mae'n gweithio'n gweithio'n gweithio'n gweithio'n gweithio'n gweithio'n gweithio a'r angen i'r staff yng Nghymru a'r NHS yn ystafell, £262 miliwn yn y cyfnod o'r ysgol, a'r ysgol 2024-25, rydyn ni'n meddwl 12,000 yng Nghymru. Mae'n meddwl o'r dros, oed, oed, oed, oed, oed, oed, oed, oed, oed, oed, oed, oed, oed, oed, oed, oed, oed, oed, oed, oed. Ni'n credu rŵn i'n meddwl i'u troflol, a'i'n meddwl o'r oed, oed, oed. Rhyw hwn ni'n codi an sighch amser yna'r gwybod â'r cyngor, i'w meddwl, i'w meddwl, i'w meddwl. Ynod y ffawr, yma, yma, mae'r c miesaid, iawn yn y cyfnod o'r rhes i gaelio'r cyffredinol, ar y cyоюledd, a'u gwneud oherwydd, a'u gwneud yma yng nghylch ar y priodydd. Do you also apologise to those patients as First Minister ? I think I did that in what I said at the start of this afternoon. I echoed the apology that was made by the chief executive of the NHS. Nobody wants to see people, faced with those sorts of experiences in the Welsh NHS. Nobody worries about them more than the people who work on the front line. So of course, I echo that apology and you congalhwch y register. I echo that apology and you can be sure that we are doing everything we can together with those people who are responsible for the direct running of our health boards to try and make sure that the position improves. Just my second question sort of following on from that. Can you guarantee that enough work will be done this year to prevent those stories being headline news this time next year? Well, the word guarantee is a very definitive word, isn't it? A huge amount of work went in the advance of this winter to try to prepare for it. I explained earlier, we've got over 500 extra bed and bed equivalent services for this winter and can do more again and there will be more staff recruited in advance of next winter as well. But the story of the NHS is always a story of supply on the one hand, but demand on the other. As I tried to explain in the beginning, I may get these figures not absolutely exactly because I'm trying to remember them. I think on the 4th of December there were 65 admissions for flu into our hospitals in Wales and it was over 300 less than three weeks later. We saw the extra impact of COVID on the NHS. We've got nearly 1000 COVID related patients in hospital beds in Wales on Friday just gone and you are always trying to manage the supply that you can put in place against the demands and the demands are not always predictable. On the 27th of December particularly, we saw that confluence of extra flu demand, extra COVID demand, the pent-up demand that's always there over Christmas. Some parts of the system still dealing with the impact of the cold weather that we'd had earlier in the month and all of that came together to create those very difficult moments. Thank you. Going to go back on to the screen, I think, and to Yvan, Yvan Jones, es pedwrech. Hello, Diolch yn fawr iawn. Rwy'n fy nid o'r gymryd. Rwy'n dweud bod y pwy serig mwy sy'n rhaid i chi'n gwladol yn cael ei eich osio lef yn rhanol gan y cynnydd yn ei fyrwch osio'n COVID ar fliw a strep hei yn ystod mi'n swydd y ghef. Ydi'n bryd, el gyflwyno rhai ar gyfyniadau levelu sellofos ni'n ystod y pandemic er enghraifft i'w sgwstio, masgau gorfodol mewn shopau a gysgolion, ac aws le'n rhyw fesu rhai o'r fath dan ystod riaeth.  Diolch i'r cangor ddim wedi dod at o ni fel gwneud o gion i'n mynd nôl at hynny ond ni'n ystyried bob othnos. Yn ystod, rwy'n gweithio'r prysgau o'r system, rwy'n gweithio'n gweithio'n gweithio'n gweithio'n gweithio'n gweithio'n gweithio, drwy'r prysgau o'r cymryd, oherwydd rydyn ni'n rydyn ni'n throses sydd wedi bod ddod yn ddod i pa ddech o'r bwysig, felly rydyn ni'n ddechrau'n gweithio, felly mae'n ddod i'r lleiddo'r gweithio, fel mae'n ddad o'r gyngharaff anghos nesaf, ac oedd y clínau sydd yn cael ei chael. I'r bwysig, i gyda'r prysgau, felly mae'n ddod rwy'n licio'r gweithio'n ddod i'r gweithio, hen here in Wales, we would certainly take that very seriously. Diolch, Faryon. Rwy'n rheswun â'r gwedig ffonyau chi'n rhaid ffian ar ôl calibnod i'n brifunidog mewn cyfarbyniad gyda'u ragfleinu lystras. Ydi hynny wedi gosod pactrwm ar gyfer ffagor, gyfa threbu drwng llwodraeth Cymru a llwodraeth y Deynau Senedig, dos Davies Dwythau, a beth bynnag y gwahan i ddabarn a dir berthynas gwythio yn wel na gydaeth dan Boris Johnson a lystras. Wel, fel wedi o chi oedd galwad ffón ar y dyw yn nod pan gawsodd Rysi Sunach a'u apwyntio, a dwi wedi cael cyfarfod Davies ar ôl hynny, aeth y brifunidog i'r cangor a British Irish Council. Ac oedd hwnna'n rhywbeth dda dwi'n meddwl a'r ôl hynny dwi ddim ydy'n meddwl mwy o gyfleo'n isiara neu cwrddave. A'r efel Sredogion mae'r gwaith yn mynd ymlaen bob dydd a'r cyfan dwi'n meddwl mae pethau wedi wella peth bach. Fel wedais i'n mwynhag unwaith yn ystod y pandemic, be dwi'n isia weld yw nid just pethau sporadau, fan mae cyfarfodd iddyn digwydd heb cynllunio offline dwi'n isia weld patrwm o pethau. A nai le el i ni'n gallu dibynni ar y patrwm isiara digwydd am y problemau ni'n wneud bydd dros a dynes yn edrych. Yn ystod y Prif Weinidog, mae'r Prif Weinidog wedi'u prif Weinidog wedi'i gwneud y ffonchol i'r Prif Weinidog yng Nghymru, ac mae'r Prif Weinidog wedi'i gwneud i'r Prif Weinidog yng Nghymru yng Nghymru yng Nghymru yng Nghymru yng Nghymru yng Nghymru yng Nghymru yng Nghymru. Mae'n ff Davun o gyfodd o'r mewn gweithiau a'r mewn gwirioneddau ar gyfer y dyma, a'r wych sy'n ei gynnal ar gyfer y gweithiau, a'n ymgyrch yn gyfodd o'r fawr o'r ddydd. Ond mae'n brif yn amlwyntio'n gweithio, a'r mewn cyfodd o'r hefyd, ac mae'n gweithio'n gweithio'n gweithio'n gweithio'n gweithio'n gweithio'n gweithio'n gweithio'n gweithio'n gweithio. Unwyr i'r pethau yw yw ymgylch yn hynny, dym ni'n mynd i'r gwirionedd yr aelod fuddiadol a hynny yn hynny. Felly hynny'n fawr oedd yw peirledd yma bod hynny yn siŵn i'r gweithredu. Rhyw i'n bwysig ar gyfer cyffrous – Strategannau wedi'i gwirionedd yr aelod. Mae Llyfrgellion yn ei wneud gwahanol i'r cyfwysig ar y methu, gyda i'n fydd ymryd ymlaen o'r byddai'n gwirionedd arlawn. i'r berthynatio gan llwybabodn digwydd. Mae gynhyrchu nhw i gefnodd rhaid i'r cymhwyno gwybod ar gyfer y Cyflawn Gweinwch. Mae gwidthio'r gweinwch mwyfant fyddwyl yn ddiolch ar gael gweinwchiaf yn march oes yn ingwydd. Mae gennym ddu llyführyr i'r gweinwch sydd yn ddiolch fel ardal a llwybrau. Dwi'n golygu o hyn i llawer o'r eu ddefnyddio, o bobl ysgol y gallen nhw ar gyfodaeth, felly we now need to see that carried through to a fuller conclusion. Ifan, dych yn fawr, over to Tom Magner at Carersworld Live. Thank you very much indeed, First Minister. You've spoken earlier of priorities, which I assume you've considered to be matters of the greatest importance, and also referred to challenges which seem to imply more difficulty with hurdles to be clear. Can I ask you to keep that in mind? My first question is on the subject of hospital-acquired COVID deaths. Your government revealed in August last year, some four months ago, that the most accomial investigation has been completed into 1,619 cases. You said then, I think, there was no reason why considering the number of completed investigations that you could not publish a report at that time with no one expecting personal data. There were presumably no privacy issues. Now it appears that the Welsh public have to wait until the end of March for the outcome of this investigation. Why wait even longer? Why delay? Is this not critical to maintaining and improving infection control standards? And of course, it's not just about recommendations. You've still got to implement them afterwards. You seem to be treating this more like a challenge than a priority. Well, Tom, I certainly think hospital-acquired infections is a really important issue. It's been a really important issue over the last few weeks with a number of patients suffering from communicable diseases like flu arriving in hospitals. It continues to be a real challenge for staff trying to respond to the numbers of people who need their help in the circumstances that they have to work. The reason why a report will be published a bit later than we had hoped is simply because we want to make sure the report is as good as it can be. The delay is to do with making sure that the information in it is accurate. It involves every single health board in Wales having to report on individual cases. We want to make sure that the report that is published draws that information together in the most accurate way. But the lessons that can be drawn from it have had a chance to be considered by clinicians and by the people we rely on to provide services at the front line and therefore that the lessons that are in the report are as usable and as useful as they can be to frontline workers. So I don't dissent from anything you said about the importance of it. And in a way, it's paradoxical, I know, but it's the importance of it. That means it's taking a bit longer than we first expected. Again, thinking of priorities and challenges. Can I ask you about the promised national unpaid carers register for Wales? Around about this time last year, in answer to one of my questions, you promised that it would be published in October, but it's yet to see the light of day. Again, perhaps are you seeing this issue faced by unpaid carers as more of a challenge than a priority? Well, I want the register to be taken forward. I think, Tom, you raised this question in a press conference that I gave with a leader of Plaid Cymru. And following that, I went away and had discussions with our officials as to the progress that was being made in relation to the register. And it's not a challenge in the sense that you mean it. It's something that we want to see happen and you're prompting at that last press conference that has led to further discussions about how it can be practically brought about. Thank you. Thank you. And finally, I think for today, we're going to go to Alun Evans at Camarventia News Online. Thank you, First Minister. Y blwyddyn nhw wedi'u nhw'n edrych ar ffrom Sany Cymdiad yn Camarventia. There are some who are predicting that you will not be First Minister at the next Senate election. The NHS in Wales is in crisis. It's operating at worse levels than the NHS England, called in to Richard Sunach. The people you loaded for getting us through the pandemic have asked for a meager pay rise and have been forced to strike against their own ethical and moral standards. Do you take full or part responsibility? And if not, who or what is to blame? And in answer to that question, will you also be standing aside at the next Senate elections? I don't think it's that people have predicted that I wouldn't be the leader. I think I made it absolutely clear myself five years ago that I would not be. And my plans have not changed. And I've repeated them so many times. I don't think I need to repeat them again today. Of course, anybody who is involved in the sort of job that I does, that I do has a responsibility for the conduct of public services here in Wales. I'm not going to get drawn into a sort of it's worse over there than it is over here. Sort of discussion. It helps nobody who is waiting for treatment in England or in Wales. And it's often very inaccurately played out. So if you want a hard fact based simply on the information that is not published by government, but is in the public domain that in each of the last three months, the performance of major emergency departments in Wales has exceeded the performance of those departments in England. That is just a matter of the of the record. I take responsibility for what happens here in Wales together with my ministerial colleagues and with all those people who work in the health service in every part of Wales. And who, as I've said repeatedly this morning, work so very determinedly, sometimes under very challenging conditions to make sure that people in Wales continue to have a health service they can rely on. We feel from you on your ministers time and time again that the problems Wales faces economically and the knock-on effects of that can be claimed entirely on the conservative government at Westminster. Labour are ahead in the polls and the run up to the next general election. Can you categorically say that a Labour government in Westminster and a Labour government in Wales will make a difference, not just sticking plaster and restore the equilibrium and put an end to the excuses for the failings in government? Well, I can categorically say to you absolutely that having a Labour government to work with at Westminster would be a transformative experience for a Labour government here in Wales. Again, as I've said in the past, the history of the two decades of devolution is a game of two halves. In the first year, first decade of devolution, when there was a Labour government in Westminster, the budgets available to support public services in Wales grew in real terms every single year throughout the whole of the decade. The second decade has been a decade of austerity when the resources available for public services across the United Kingdom have been squeezed and squeezed and squeezed every time on the promise that provided we took that medicine, the promised land was just around the corner. It would all be over. I remember hearing George Osborne say before 2015, and here we are again on the same path, further cuts, further austerity, highest taxes for 70 years. That is the reality facing people in Wales. That explains why Labour is in the position we are in in the opinion polls and the chance to work with a government, even in those challenging circumstances, with a different set of values, a different set of purposes, of course it would make the most enormous difference to us here in Wales. Alun i chi'n fawr. Thank you all very much indeed.


Now, insha'Allah, we are going to go into the fourth response of the first doubt that was brought forward, that the Quran is not mutawatir. In this episode, insha'Allah, I want to be with me, respond and bring to your attention all of you that the great scholars of Islam have clearly categorically said that the Qiraat can be mutawatir to a people and may not be mutawatir to another people. This is a very important point, and no qad yatawatar rinda qawmin, ma lam yatawatar rinda ghayrihim, that the Quran may become mutawatir to a people, but not necessarily to another person. And this is a very important point that you keep in your mind. A qiraat is mutawatir to a people, but not necessarily to another people. Now, by the way, we're not saying that the Quran is not mutawatir, the Quran is a qadiyya musallama, it's an issue which is agreed upon. What we're talking about is a qiraat, like qawlu ta'ala an'amta aleyhimu. Is that mutawatir? Yes, it is mutawatir. But is it mutawatir to every single person? No. And this is something very important. And this is something very important. That's why we say Abu-Shamat al-Maqadisi and others who have fallen short in this issue, they thought that everything that is mutawatir has to reach them in tawatur. And that may not necessarily be the case. The qiraat is mutawatir to a people in a land but may not be mutawatir in another land. Let me give you an example. When the SARS flu came out, there were a large number of people who didn't even hear about it. Who didn't know what this is and only found out and read into it after COVID-19 came. But the SARS, its news, it reached haddut tawatur, multitude. Large quantity of people heard about it, were aware about it. But on the other hand, there was a good number of people who didn't know about it. That doesn't take away from it being multitude. But it just doesn't mean that it was multitude in every land and in every single country. And that is an important point. Let's say somebody never heard of COVID-19. 10 years later, they say, I existed at that time. What was that that happened that you guys are talking about? How come I never heard about it? And let's say those people are a particular land and they never heard about it. That does that take away that the COVID-19 has taken place, has happened, and it has been transmitted through mass transmission. People existed, people got afflicted with it. So the qiraat are mutawatir to a people and may not necessarily be mutawatir to another people. For example, it might be this qiraat might be mutawatir kufa, but may not be mutawatir in Mecca, for example. But is that qiraat mutawatir? Yes. A large number of people narrated from the Prophet to a large number of people, and it's only in a particular land. And another qiraat is also mutawatir in this land. So the qiraat are mutawatirah. And this answers a big shubah that they throw that the Quran is not mutawatir. Now I'm going to give you the statements of the great scholars of Al-Islam, saying this. Al-Imam Alamuddin, his name is Ali ibn Muhammad, Abu al-Hassan al-Sakhawi who died years 643 Hijriah. He's a teacher of Abu Shamet al-Makdisi. He has a qitaab called Jamal ul-Qurraa and Kamal ul-Iqraa. Al-Mushamah al-Makdisi transmits and narrates from him in his Murshadi al-Wajiz in some places. He quotes his sheikh, Inna. Al-Imam al-Sakhawi, al-Rahimahullah, Al-Muddin al-Sakhawi, he said, He said, So Muhammad ibn al-Saleh, he said one day a man said to Abi Amr. Abi Amr is a great qari from the seven Qur'an. He said to him, how do you recite the ayah? La yu'addibu adabahu ahad. How do you recite this ayah? And Abu Amr, he said, La yu'addibu adabahu ahad, but how do you recite it? So the man said to him, how do you recite the ayah? He said to him, how do you recite the ayah? What about the qira that came from the Prophet sallallahu alayhi wa sallamah? La yu'addibu adabahu ahad, this is a qira. So Abu Amr said, If I heard a man who said, I heard the Prophet, I will never take it from him. If a man came up to me and said, I heard it from the Prophet, I will not take it from him. Do you know why I will not take it? He said, why? He said, Because I suspect one individual who is alone. Especially when it is in opposition to what the mass number of people have transmitted, which is the recitation of La yu'addibu adabahu ahad. Alamuddin al-Sakhawi pointed something here. He said, The qira, he is saying it is not right because it came from one person or he is rejecting because it came from one person. If a one person was to say to him, it is actually a qira which is mutawatir. Abu Amr, he is saying I will reject this recitation. If a man even came up to me and said to me, the Prophet recited it. But this recitation actually is not one person narrated. It is actually a recitation of al-Qisai. It is qira of Qisai. And it is actually a multitude. It is mutawatir. And that is what he says. Alamuddin al-Sakhawi says, Mutawatir to a people, I may not necessarily be mutawatir to another people. Wa inama ankarabu amr. Mutawatir rejected this recitation because it never reached him in tawatur. It is mutawatir. But it didn't reach him. Abu Amr in tawatur. Ibn al-Jazari in his munjid al-Mukri'in, he said, after he brought the story as well. And he also brought the story. He said he brought the story of al-Sakhawi when he said Ibn al-Jazari said, Qultu, I say, sadaqa. He is right. Qira is mutawatir. It is a recitation of mutawatir. Because it is a recitation of al-Qisai. Because this is the recitation of Ibn al-Qisai. So what do we take from this quote? What's the lesson that we take from it? The lesson that we take from it is that the Qira may be mutawatir to a group of people in a group of particular land. It came to them through tawatur and they passed tawatur and so on. And it may not be mutawatir in another place. Okay? That's very important. Now I'm going to give you the second statement of a second imam. Al-Imam al-Dahabi. Al-Imam Shamsuddin al-Dahabi. Al-Imam al-Dahabi died the year 748 Hijriah. He has a Kitab al-Qusir al-Alami al-Nubala. When he talks about the biography of the great imams, he starts with the prophet, of course, and then he goes into the life of the great scholars of Islam, Abu Bakr, Umar, Uthman, Ali and the Sahaba. And then he goes into, he goes into the great imams of Islam. And he also mentions evil people as well in that book. When he came to the biography of Yaqub ibn Ishaq Zaid al-Hadramiyu, he said the following. He said, Yaqub ibn Ishaq Zaid ibn Al-Hadramiyu. He said, after that, he's a reciter of the people of Basra. He's one of the ten. He was born after 130. Yaqub ibn Ishaq al-Hadramiyu, he used to recite the Qur'an in the opening. He recited it to the people opening. In the opening, he wasn't private classes he had. He taught in public, in the open. He used to recite the Qur'an to the people in the open He used to recite the Qur'an to the people in the open the time of Sufyan ibn Uryayna and the time of Abdullah ibn Mubarak. He recited the Qattan. He recited it to the people in the open and Abdullah ibn Mahdi ibn Mahdi and Al Shafi'i ibn al-Adriest Al Shafi'i and Zaid ibn Harun Zaid ibn Haruna and a lot of religions. Yaqub ibn Ishaq Zaid ibn al-Hadramiyu used to recite the Qur'an in the opening. He used to recite in the presence of Ibn U'iyyina, Ibn U'iyyina lived at that time, and would you call it, Ya'qub al-Hadrami was reciting the Quran and was teaching the people the Quran. Ibn U'iyyina heard about it, Ibn Mubarak heard about it, Ya'hi al-Qat'an heard about it, Ibn Mahdi heard about it, Shafi'i heard about it, Yazid Ibn Haroon heard about it. And many more other people heard about his recitation. Min A'ima did deep from the scholars of Islam. He said after researching and looking into this matter, it has not been transmitted that any of the reciters, and any of the jurists, and the righteous people, and the khulafa, and the Islamic leaders, any of them rejected his recitation. It has not been transmitted to us. Anyone, no one ever said, Ya'qub, your recitation is wrong. Don't read like that. Ibn U'iyyina did not say that to him, Ibn Mubarak did not say that to him, Ya'hi al-Qat'an did not say that to him, Ibn al-Mahdi did not say that to him, Ibn Mahdi did not say that to him, Yazid Ibn Haroon never said that to him. No one ever rejected the recitation of Ya'qub Ibn Ishaq al-Habarameen. And they didn't even prevent him from it at all in the first place. And if anyone was to reject the recitation of his, it would have been transmitted to us. And it would have been so famous in the books. Rather, they praised him. And let alone him just reciting it in Basra, rather he was passing it on to his students, and his students were passing it on. So it was something that was being given on and it was being passed on. He taught this Quran to his students. And he continued reciting it in his recitation. His recitation was recited and it was read by the Imams that even came after him in the Mihrab. As Imams, they were reciting on the recitation of Ya'qub al-Habarameen. In Basra, they were reciting it. They were reciting it for decades. He used to recite it in the pulpit. He used to recite it as an Imam. His students would recite it as Imams in the Masajids of Basra. No one came out and said, What's this recitation? Where did it come from? Rather, the people all accepted it. Until a group of people came. People came later in Islamic history. They were not familiar with this recitation. They didn't know of it. They rejected it on that premise. Then the Habib said, If someone is ignorant of something, he shows enmity to it. One of the signs of knowing someone is ignorant in a particular field in Islamic knowledge or any sciences, whether it be academic sciences, is when he says that science is rubbish. There's no value in it. Why are people studying it? Remember this principle. If someone is ignorant about something, he shows hostility and enmity to that thing, that science, and the people who possess that knowledge. He doesn't show them happiness and doesn't... He's not fond of them, basically. So Al-Imam with the Habib, he said, People who were not familiar with the recitation of Ya'qob al-Hadlami, who were not acquainted with it, what did they do? They rejected it.  These people said, these late comments, they said that these recitation have not been transmitted to us in multitude narration. It hasn't been transmitted to us in mass transmission. After that, Al-Imam with the Habib, he said, We will say to those people who said that it hasn't reached us through a mass transmission. We will say to them, it has been connected with many creatures. This train, this recitation of Ya'qob al-Hadlami, has reached us. It has been connected with many creatures. Sorry, Dabi said, we will respond by saying that this recitation has reached mass transmission to a group of people. And those people are large in quantity that it reached. And it is not the condition of the creatures to reach the Ummah. It is not a condition of the creatures that it reaches everyone in the Ummah as the creatures. And it could reach a group of people in the creatures and may not necessarily reach another group of people in the creatures. Pay attention to that. The creatures, they have a recitation which is the creatures for them alone. And the fuqahah has issues which are mutawatir for them. But it is not known and the people of qiraat are not acquainted to it. And there are some issues that a fuqahah considers to be mutawatir to them. It is well known to them. But it is not well known to the Qur'an. And sometimes the opposite can happen. Something is mutawatir for the Qur'an but may not be for the fuqahah because this is not something they are into. Same with the muhaditheen. Where did this hadith come from? The same with the grammarians and the people of the language. There are some things which to them is clear cut, well known but not necessarily to the other scholars of other sciences. A person who is ignorant about something or a science or a knowledge, we shouldn't use him as a proof against the one who has knowledge of the issue. If the qiraah is being mentioned by some scholars that it is mutawatir and a group of people are saying it is not mutawatir, we say the ones who know are a proof against the ones who don't know. And other than them who say it is not mutawatir, they are negators, they don't have the knowledge to affirm. But the ones who have affirm have the knowledge for it. And the scholars, they say the one who knows is a proof against the one who doesn't know.  Hudayfa Ibn Uliyamanin, he said, Ba'ala nabi'u sallallahu alayhi sallam qa'iman, the prophet urinated standing up. Aisha negated, Hudayfa affirmed. Who did the scholars take? They said Aisha doesn't know. She negated him because she never saw it. Hudayfa saw it, man aalima hujjatun ala ma lam yaalam, the one who knows and saw it and has that extra knowledge is a proof against the one who doesn't have that extra knowledge. So the one who says that the Quran is mutawatil and says that it's mutawatil has a knowledge that the one who's negated doesn't have. That's what they'll be saying here.  That statement from al-imamu dhahabi itself is enough. We should stop the episode there, but insha'Allah wa ta'ala to make the issue even more clearer I'm going to bring you other quotes from other great scholars. Tadjudin al-subkih, Rahmanullah who died in 881 Hijri al- which is in the size of the Surah al-Fikr. He says Allahu Akbar wa rubba mutawatil it may be mutawatil and the qawmin to a people duna akharina not to another people wa fi waqtin duna akhar and it may sometimes even be mutawatil at a time but not at another time. It could happen. This is mutawatil in this land and it's not mutawatil in this land or it might be mutawatil at this time but not in this time it could happen. Al-Nuriyu al-Safa qusiyur Rahmanullah who died in 1118 Hijriah He said it is not a criticism and it doesn't it doesn't pass through that there is tawatur in the Qiraat just because the Quraat that some of the Quraat differed on this issue we don't say that this issue because the Quraat differed upon it that this is a criticism that shows that there is the Quraat and not the tawatur no Fakat tawatur al-Qiraat why? Fakat tawatur al-Qiraat in the qawmin duna akharina because tawatur can happen for people and not for other people Fakat tawatur al-Qiraat because the Qiraat may not read in the Qiraat but not in the Qiraat why? because it didn't prove or because it didn't prove it on the tawatur and that's why no one of them didn't like the other Qiraat the reason why some Quraat didn't recite in the Qiraat but not in the Qiraat is because that Qiraat of the other Qiraat never reached him in the tawatur like the Qiraat of Qisai he's saying to me it's not mutawatir but the Qiraat is mutawatir too al-Qisai so that's why they didn't recite on another person's recitation they didn't recite on another person's recitation because it never reached him in the tawatur this shows you something that each qari was reciting what was mutawatir to him Jalaluddin al-Suyutiyu who died in 911 Hijriah he has a Kitab called Alitqalfi al-Uloom in Quran he said he said exactly what al-Imam al-Tajaddin al-Subqi said which is that it could happen that it's mutawatir to a people and not another people and it is also mutawatir at a time and not at another time or not at a particular time al-Imam Abu Sa'id ibn al-Lubbin who died in 782 Hijriah he has a Kitab called Fatiha al-Bab wa Rafa al-Hijab he mentions that he said that the tawatur of the 7 qiraat it is something mutawatir to the quraat and it is also mutawatir to a particular land this qiraat is mutawatir in Islam this qiraat is mutawatir in Islam this qiraat is mutawatir in Islam and it's not mutawatir over the whole entire globe at one time it could even sometimes happen that a qari never even heard of the other qari's qiraat because of the land that does not negate that each person is reciting on a qiraat which is mutawatir last but not least Shamsuddin ibn al-Jazeera who died in 833 Hijriah ibn al-Jazeera he mentions in his Kitab he said after he mentioned that the 10 qiraat the 10 quraat 7 that Imam al-Mashat ibn al-Mashat and the extra 3 that ibn al-Jazeera mentions in his Duraa he says those 10 are mutawatir but he said ibn al-Jazeera he says i am not claiming and i'm not going to say that these are the only 10 which are mutawatir and anything other than that is not mutawatir why ibn al-Jazeera why can't you say that because he said because it could happen that a qiraat might be mutawatir to a people and not another people as for me ibn al-Jazeera i haven't looked at the qiraat in India because it could be possible but as a qiraat mutawatir in India i haven't he's saying and they could be qiraat which is also mutawatir and other than them and other than them it could be possible it could be possible that it's to them mutawatir that to them is mutawatir there's a possibility that this qiraat mutawatir to the scholars in India or the qiraat in India or even aqsa al-mashrik but it could be mutawatir for them so the statement of ibn al-Jazeera he's saying i can only affirm these 10 after looking at it they are mutawatir these qiraat anything beyond that anything other than that he said i can't because there's a qa'idah to the qiraat and the scholars which is what i told you i will stop there inshaAllah anything which i have said that was wrong or incorrect is from me as shaytan and Allah, His messenger are free from it i will see you guys inshaAllah i will see you in the next episode bless you Assalamu alaykum How can you do a two second action right now that will give you the reward of everything we're doing on this YouTube channel. Simple. Like this video and click subscribe. Why? It will allow YouTube to recommend our videos to other users and imagine the huge amount of reward that could be waiting for you on the day of judgment if you did that with a sincere intention of spreading the Deen of Allah. You'll be rewarded for every single person who benefits from one of our videos as a result of your like or subscribe. That's an easy two second action that you definitely don't want to miss out on. Do it now, click like and subscribe and don't forget to make that intention.