Hello, this is Reza Swisabi and with my colleague, Chuck McCauley, we would like to present our novel covered communication scheme that explodes broadcast signals in LTE 5G and other technologies. I would like to first give a little introduction about ourselves. The application research team lead at Keysight ATI Research Center. I do open research on 5G RAN security and develop algorithms to both make or break awesome things. I come from math and signal processing background, so I try to apply them to new problems as much as I can, and typically I happen to be at the right time and in the right place. So I have been breaking things and triggering rare events for fun when I become a dad, and now I love spending time with my toddler son. So I would like to turn to my colleague, Chuck. Hi, I'm Chuck McCauley. I'm a principal security researcher at the ATI Research Center at Keysight. My hobbies include skiing and breaking my land Rover and fixing it pretty frequently. At Keysight, I'm involved in new product initiatives and bring a long 20-year cybersecurity background to everything Keysight works on and touches. I really would like to expand on the ambitions and the thoughts behind this research, to encourage future research. I believe this is as important as the research I'm presenting here. As my father always put it, talking about fishing is more important than talking about fish itself. So I had some past academic research experience in wireless security. I published my work on IoT security in IEEE in the past. So most of my work was deep in theories and math. So I decided joining industry to explore more practical problems out there, and I was offering R&D consulting services to mobile operators and was a 5G system engineer a while before joining Keysight in 2018. Without being officially in infosec, I always had the tendency to break things around for fun and curiosity. So my new job at ATI enabled me to explore new ideas that are known in wireless community, most notably protocol tunneling techniques that are used for data exaltation. I was converging kind of my past and present experiences that one day in fall 2019 or cool bus, I invited me to take a lead in a 5G security research project and got me a lab with a super expensive baseband emulator in there. So with that level of trust that he vested in me, I decided to go after an all-day vulnerability discovery other than simulating existing ones. So I discovered this vulnerability in 5G and LG standards the following winter and we successfully disclosed it with GSMA. Things kind of went slow due to pandemic and my parenting leave, but after watching this interesting talk in last year DEF CON on eavesdropping satellite signals, I got really excited and pumped to put this work together and present it for DEF CON this year. I took a holistic approach of organizing the existing work in the biggest possible picture or call it a box and then discovered a hole in it. So I realized that covered communication is the biggest umbrella that I can put all techniques for data exfiltration, command and control and other means of communications, unauthorized communications are together in it. So it usually regarded as a potential threat and taken seriously in the context of defense in depth. When I serve a literature related to covered communication or topics related to it, I realized there are two dominant viewpoints that are coming either from hackers or wireless engineers. So people with hacker mentality, like Jack, have targeted software protocol stack most of the time. So like message tunneling in L3 to 7 protocols such as ICMP, DNS and et cetera, a lot of cool techniques there. They have barely looked below IP layer, in fact. As we know it, the security industry has actively been monitoring the research in this area. So they track and block malicious IP traffic using boxes like IPSs, IDSS and lawful intercept. On the other hand, wireless engineers such as myself are really fascinated with the beauty of radio systems, internals and physical layer. So there is a huge literature on coding and modulation techniques to build optimal radios for covered communication. These techniques usually involve low-power communication and avoiding spectral monitoring systems. So devices such as like Loravan, Hamradios and other low-power technologies can be kind of retrofitted and used for covered communication. But their operational range dramatically degrades when both sender and the receivers are at low altitudes. Where the signal in fact is blocked by buildings and foliage. Looking at the protocol stack, I thought of a new viewpoint, come up with a new viewpoint that combines both mentalities. So I come up with this question, how about exploiting the Mac layer protocol weakness in existing wireless infrastructure? This was the big question that inspired this work. It leads us to a new scheme that can be more effective than existing ones in many aspects. At this point, I was almost certain that I can find some simple example quickly in LT and 5G standards because I was very familiar with them. So very related to the theme of DEF CON 29, I developed a framework to exploit the unestoppable signals from cellular base stations that are everywhere. So height is what makes the RF signals unestoppable and operators spend big money to mount antennas on tall com towers. Or recently, some companies are trying to apply them on lower bidding satellites. And this is all about getting more and more coverage to as many users as possible. So let's look at this scenario that we're gonna be using moving forward. So Trudy has intruded a secure air gap building with a programmable device. So she would like to send a message to her friend Ricky with a passive snipping device sitting somewhere a few miles away. Like these anime geeks that we have down below this frame in the picture. There is no radio signal path between them due to buildings and foliage. So however, both can send and receive signal from a nearby cellular tower. So what if Trudy send a special low power obliq signal that triggers high power broadcast signals from the tower that then are received and decoded by Ricky. So simple, right? So this will create a virtual covert communication channel between Trudy and Ricky. And this is basically the description of the technique that we are going to present here. Putting it simple and memorable for you, we are creating in fact a reflection that are observable everywhere around the cellular tower. That's the key idea. So think of a Batman movie. They did not know where Batman is, right? So they were reflecting this light beam of the sky to make it visible everywhere so that they can see. So I would like to go and start talking about the example that I discovered in LTE and 5G standard. So let's take a look at the importable stack. What is the Mac layer? What does that mean, exploiting Mac layer? So in protocol stack, some initialization or handshake steps always happen within each layer before it starts responding to data from the upper layers. This is how protocol stacks crank up always from bottom to the top. So this work is related to the layer two in OSI model, often called the Mac layer. And from operating system perspective, this layer is whatever layer that enables devices to send IP packets so they don't care what happens in it. They just look at it as an interface or gateway to send IP packets. In order to understand what we are talking about today, it helps to understand the analogous version of what happens when you connect Ethernet cable to a switch. Right when you plug in your cable before you get a green light on your switch indicating your link, speed, and duplicate sync, a protocol negotiation has already taken place. The radio signals have synced up and found a signal in both directions. So there are some messages such as like a RAID auto negotiation that happened very early that people normally do not care about them or observing them in their packet captures. So let's now talk about the LT and 5G Big Mac layers. Something more delicious, right? So this Harry, our man is searching for signal in the middle of nowhere. So when he finally gets a signal before he's allowed to send a selfie to an Instagram about his situation, it tries to attach to a cell tower, right? And see if it allows to access it that mostly involves SIM card, voodoo stuff. The apps running on his phone only care about sending IP packets to the internet, right? So the apps do not care about whether it is WiFi or LTE or what happens inside these protocols, neither. So they see all these voodoo stuffs happening below IP layer as a big Mac layer. That's what they call it, the Big Mac. They do not care what's in it, they just enjoy using it or what it delivers. The commercial wireless infrastructure has many components such as cell towers and a bunch of core network servers whose job is managing millions of users across a wide area. This Big Mac layer that we're talking about in cellular standards has several soft layer protocols in it like a Big Mac, right? They define the interaction of user device with various components of the operator's network but not the internet. So this is Big Mac is called control plane as well or sometimes the people who built this network, they call them layer two and three. In the context of LTE and 5G in particular related to our talk today, the standards are made by a global organization called 3GPP for your information. It uses a protocol known as the RRCO radio resource controller, which is an access protocol that is the toughest layer of this Big Mac or you can call it the bun layer, that works more like a radius or messages in it looks more like a SNMP. But this is not what this talk about today. This talk today about is the link establishment for RRC protocol, the very initial Mac layer handshake that happens very early on before establishing an RRC connection. This is what this call is about. Think of it like a handshake between a phone and a cell tower before all other handshakes. And it has some interesting features to it that we're going to explore. And in fact, it does not travel to the operator's core network making it suitable for covert communication. Some simple terminology notes in here. So essentially in the context of LTE and 5G we call all the devices that interact with the cell towers, UE or user equipment whether it has a SIM card or doesn't have a SIM card doesn't matter. And there is another more important terminology notes that I'm going to talk about here is that the story of a node B. So in LTE they call these cell towers or base stations E node B in 5G. They start calling them G node B. And actually when I was talking about 5G with Chuck Chuck said that what happened to the F node B and I said interesting nobody uses F node B. So I decided to use F node B here throughout our following presentation to refer to both LTE and 5G. So random access procedure is a common functionality in wireless Mac layers. So there is a small set of signals called RATCH that are reserved for the UEs connecting to an F node B for the first time. See F node B. All the F node Bs respond to the signals regardless of device type or identity even if it doesn't have a SIM card. The diagram here shows the normal RRC connection procedure. There are four plain text messages exchanged between the UE and the F node B before the UE creates an authenticated session with the core network. These messages serve similar purpose to the Ethernet auto negotiation handshake which is setting up synchronization. First UE randomly sends a scramble signal from the RATCH set and then F node B responds with more RRF parameters that helps the UE to fine tune its framing synchronization. But these are not the important ones. The important ones are the message three and four. They enable the F node B to resolve resource contentions between UEs that are simultaneously attempting RATCH. Per standard, the UE should send a 48-bit string that contains a 40-bit random ID in it. Then wait for the F node B to broadcast message four. This string is called CRI or Contention Resolution Identity. If the F node B replies with the same string in message four, it means that the UE can proceed with the RRC connection. Otherwise, it knows that someone else is supposed to go ahead and this one has to stay and retry later. I think probably by now you've guessed what's wrong with this broadcast ping pong with the message three and message four. So coming to the Trudy and Ricky's covered communication scenario, Trudy and Ricky can have prior agreement under target F node B and Trudy's RATCH signal selection. Then Ricky is passively scanning and decoding message two and four from the F node B using its low power radio. Instead of including random 40-bit identity in CRI, Trudy can encode a short message in it and sending it up in message three. This message can include a signature byte, indicate that it is made by her, not by other users in the cell. Then Ricky can pick up and decode the same message from the F node B's message for broadcast that happens immediately after. Simple, right? This is a kind of like an illustration for the unidirectional channel, but essentially Ricky can repeat the same procedure to establish a reverse link to Trudy to kind of send information like acknowledgement. Looking at the history of this procedure, we believe that this vulnerability may exist in other wireless MAC layers as well. This particular example has been in LT and 5G for over a decade, but no worries. I will share at the remediation before these talk ends. So, exploiting a little bit, expanding on how, what they can gain by using Sparrow. Sparrow UI can break long messages into chunks of 40-bit messages and send them in multiple Ratch attempts. Succesive Ratch attempts do not have much impact on other users in the cell. And there is a back-off also timer that's built into the standard document. As you can see the snapshot right below, that the UIs have to basically pick up a random value as a back-off timer, but it's all been left to the user's discretion and the E-NodeBs or F-NodeBs do not have any way to enforce it. So picking the back-off time like a 10 milliseconds, usually the message one to four exchange takes on average up to like a 30 milliseconds. So in total, this can give Trudy one kilo BPS throughput link to reach messages to Ricky. Very limited, but it's still comparable to other low-power technologies like Lora. Outdoor LT and 5G base stations operating at lower frequency bands, particularly below two gigahertz, are more suitable for Sparrow technique, mainly because their signal can reach up to five miles and also they can reach indoors very well. 5G new radio, and you'll reduce some new frequency bands above six gigahertz that they involve lots of out-of-wood stuff like beamforming that making it difficult for Ricky and his fellas down below to decode and broadcast his signals. There is also a new satellite-based 5G standard called 5G NTN, which is in development. That might actually give the Sparrow UIs 10 times more mileage. Hopefully we can get our remediation built as a secure Ratch option for that stand. Also, benefits of using the Sparrow are really great. So you can get really super stealthy with it. No network footprint because messages are low-call to the FNOTB and nobody is going to log the Mac layer messages at the edge of their network. Also, the Sparrow UI activity is indistinguishable from the other UIs, so no radio spectrum footprint that's going to be there for external passive monitoring systems to geolocate the transmitter. These are the reason I call them Sparrow's. So no need for expensive equipment, right? So 100 bucks low-power SDR can do the job. They can also leave off rechargeable batteries or solar power. No need for high-gain antennas since they get the rebroadcast power from the FNOTBs, right? I will also show some more range expansion techniques further in the presentation. So they can get higher range per RF wattage in a cluttered environment. And that's a very key point compared to the other complex commercial radios like Wacky Talky or Laura. Who cares about the Sparrow's? I mean, really there are Sparrow birds everywhere. They're among us, right? Nobody cares about them. I know historically, sometimes they cared about them for crops, but nobody cares about them. And this is the same with the Sparrow with regards to cellular operators because they do not see any immediate impact on their network. So they do not care about it. And as a matter of fact, any temporary solution to block the Sparrow's kind of lead to some performance degradation to real users and we'll talk about that. But the remediation is that we've developed has to go be implemented at the standard level. So far, Sparrow's are unstoppable. So here, I'm going to actually turn the presentation to my colleague, Chuck, to talk about our demo and show the demo and also talk more about the use cases for Sparrow. Chuck. Thank you, Reza. So one of the benefits of working at an organization like Keysight is we get to play with a lot of cool tools. Even though we were in the middle of a pandemic, we were able to work with a lot of our peers in different parts of the world and we're able to convince the GSMA that we'd actually found a design flaw in the Ratch contention messaging structure. So what you see here is our demo lab that got set up for us by our peers in Italy. At the bottom, you see something that we call a UXM. Now this device allows us to emulate a E node B, a G node B, and hopefully in the future, even an F node B. And what you can do with this device is emulate a cell phone tower effectively and at the top, you see what we call UE SIEM which simulates whatever's going to connect to a mobile network and allows you to play with the messaging structure and validate a F node B or G node B or E node B, right? But what you can do is if you take both of these two test validation systems, you can put them together and build effectively a cell network in isolation and test out some theories. In the lower right-hand corner, you can see sort of a screenshot here of our test script that enables our UXM to pretend to be a E node B doing the Ratch contention messages. And in our next slide, well, not really a slide, in the next video that's coming up right here, we're going to introduce our friend, Befacuda. Befacuda works out of Italy and he has put together a quick video demonstrating Sparrow working for us that we then presented to the GSMA. My name is Bofgaro Dabur. I'm an application engineer at Keyside Technologies. In this video, I am going to demonstrate the proof of concept for the Sparrow project. With this Hermodic Graphical User Interface, we configure UE on ELSUA that's with an IP address of 1048870 as a TX. Therefore, we set the mode as a TX and the random access parameter ID 28. And the plain text message to be sniffed by the receiver UE is set to welcome to the DEF CONF. Similarly, we have set the UEB on ELSUB with an IP address of 10488157 as an RX. Therefore, we set the mode to RX and the random access parameter ID 28. On the current worksite, the priority script activated the 5G NR standalone cell where the synchronization signal block is broadcasted via the eXM platform with a periodicity of 20 milliseconds. If the master information blocks is decoded with success on both UE so the cells will get synced and in service if the system information block type one is decoded. Since both UE are in service in sync and idle, we can connect the GUI to the Layer 3 Test Manager and verify if the CV is decoded then the cell should get in service. We can run the scenario from the RX site first now and from the TX site. It seems that the transmitted message is with success on from the TX site and let's verify if the receiver UE site decoded the message successfully. So from the scenario logger, here we are decoded that the message welcome to the DEF CONF France. From the TX site, it can be verified that the message two is decoded with a valid RAR. Also on the RX site, we can check. The message two is decoded with the valid RAR as of TXUE. This is the case we can also verify the message through three is decoded with success. First from the TX site. So here we can confirm that the UE Contention Resolution ID decoded with success on the TX site and let's see also on the RX site. So the RX site message three is also decoded with success. So since we have implemented a CRC decoding if the message is decoded, we can see the message on the RX site. So you can see the message is decoded successfully. Welcome to the DEF CONF. So there you saw a buffet showing us how you can bounce a message between two UE's across a cell phone tower, which is pretty wild. So let's talk about what you could do with this sort of technique. A lot of the applications are pretty obvious from the get go, but one that we thought was pretty neat to highlight would be the ability to exfiltrate data out of a secure site. There are cell phone towers that are doing these Ratch procedures all the time. So it'd be very hard for you to notice an additional Ratch procedure occurring with a cell site from a specific UE at a specific location. When you start thinking about the application layer and digging in the data in there, you can either have a service provider or a government entity intercept that communication layer and prevent it in multiple different paths, but at this low layer on the Mac layer, this is happening before any of those things occur. You could also use this to easily trigger events remotely like opening a door and more drastically triggering a bomb to occur. And you can be well within say five to 10 miles away from the site in the event that you're triggering, right? So that's a long distance to cover and figure out the source of the message. And lastly, this could also be part of a supply chain attack where you actually bake in some kind of remote control process into the device and then access it at a later date, right? Which is also a big risk these days with our vast and multiple country supply chains that occur. But there's also good applications for this that are used for good. If a tower loses its uplink to the rest of the data network, it still can provide some use whereas before it might have been just a thing that just sits there and waits until the connectivity is reestablished. So this could be used for broadcast messages in case of disaster or emergency. It could also be used to connect emergency personnel themselves to each other and tell them where help is needed or what needs to be done, which we think is a really neat application of this in general. And then lastly, we think that there's a lot of opportunities for mischief here instead of using lower WAN or other IoT based low bit rate protocols, you could use someone else's cell phone tower to provide the overlay network for your IoT devices and then simply have one device that picks up all the signals and transmits them on an internet uplink somewhere. You could also use this to help improve a pager network. This device here, this doesn't use it. This uses lower WAN right now, but it's made by natural Freck and he uses it to pass messages back between different devices at Shmoo and Defcon. You could easily hijack a cell phone tower and then instead of having a mile or two of distance or a giant ugly antenna, you could just be passing messages with something a lot smaller and a lot neater. And now I'm gonna bounce it back over to Reza who's gonna talk about increasing the signal boost and some remediation. So in the case of LT and 5G, the Sparrow UIs can exploit kind of like multiple F-node piece except the very rural areas. It is common for a Sparrow to have access to multiple LT or 5G carrier signals in any area within range of a few miles apart when the UIs are not that much far from each other. So this can help them to essentially establish catalog communication channels and enhance their throughput above like one KVPS that we estimated. Another cooler way actually to use multiple cells is really to expand the range beyond a single cell radius coverage like a beyond five miles. So for doing that, in fact, the Sparrow you would need to use Sparrow relays. So Sparrow relays are dropped basically where they can listen and transmit and interact with multiple cell towers. And their job is being rekey in one cell and being acting like Trudy in the other cell as you can see here. So Sparrow relays can be small, kind of like a solar powered devices that are dropped in random places. So to be more specific, LT cells are deployed in kind of like a hexagonal pattern to cover an area. So this picture that I'm going to show in the next slide is going to show how the relay nodes can be placed. As you can see in here, so you have a multiple ways in here to place them. So you can actually place many of them in where the actual sector coverage areas overlap and create a mesh network. So every node can talk to every other node and relay messages or you can actually create a specific chain to expand the range between two endpoints. But what is the remediation here?  So let's just start before I get to the remediation. I think there is a value to learn in case what is the general weakness model that has enabled the Sparrow in LTE and 5G and potentially it can exist in other protocols. So I kind of spend some time and have formulated this and possibly I'm going to be publishing all this work following the DEF CON but to kind of give you a general idea about it, a wireless Mac layer protocol I found is vulnerable to a Sparrow technique. If any of these procedures allow forming two sets of uplink messages that I call M and a downlink broadcast message I call in B that satisfy the following conditions. So the first one is a passive reception. So every signal in B or should be receivable and decoded everywhere. So it should be kind of like an omnidirectional broadcast that any passive device anonymously can decode it. Another key feature is basically we call it by activity but it's a one-to-one relation between them. So essentially if you have a set of 10 messages and each of them, each message B can only be triggered by a specific message that is in the set M. In other words, when a receiver receives B it can almost surely assume that its intended transmitter has transmitted a specific message. So that way they can have less error during their communication channel. Another one which is a key important thing but it's kind of like optional but it is a good important thing to have and we have it right now in the example that I showed you in a spiral is that anonymous uplink. So essentially the transmitting device doesn't have to attach to the network or authenticate to the network to be able to send those messages which actually we already constructed a message set which is actually the CRI and that for the beta strings that they can pick are going to form or superset for set of messages that they can transmit. Another key feature down here, number four is to bring a stateless uplink. It is important that the transmitter or Trudy can successively send any messages from M, set M without protocol violation as we talked about it sending successive messages and not caring about much about the backoff in between them. So all these four conditions together if they apply in any specific wireless microportical that means that some similar techniques to this spiral can be formed around it for covert communication. Any remediation to should preserve the purpose of CRI. So why we have this here, why we have that selective message three, message four, ping-pong. So as you can see, it's for contention resolution. So there's more details about that. So let's assume that two of these are picking up the same Ratch signals to attempt to innovate. So essentially at this point, E node B doesn't know there are two messages coming because of the properties of the Ratch signal, only one of them is going to make it to the E node B. So E node B is going to send additional basically fine tuning parameters for one of them. And but the point is the message two, both of them are going to receive message two. So at this point, both of them think that they are succeeding. So at that's the point that F node B actually has to have a way to signal only one UE to proceed and the rest of them to back off. And that's the point that it requires every UE to send a 48 bit CRI message. So, and then it's just going to rebroadcast the one that it has received. That is going to surely indicate that one UE is going to know it can succeed and the rest of the UEs are going to basically back off and retry. So before I get into the solution that works, I know maybe some of you already are thinking about some solution ideas. So let's talk about them and talk about why they do not work. So what about like pre-setting CRI phone? Why the phones have to randomly select them? What if we hard code all the phones to like make it like a Mac address? So they have to use the same thing. There are actually some privacy concerns with that. There are already attacks in LT and 5G on privacy and we have lots of techniques for catching people phone numbers and MZ. So any tying up, any fixed identity that can be broadcasted everywhere that can lead to privacy issues for the users. So this is not like a Wi-Fi which is a local network. It is a global network. Another one is shared secret note. There is no shared secret between the UN if not be at this point because all the cell towers are required to do this interaction with devices even they don't have any identity or SIM card. So what about like a crypto hashing and salting, right? That's a to-go thing, crypto, the fun stuff. That in fact doesn't work because first of all, if you think about message three and message four broadcast, if the F not be tries to basically hash what it puts in the message four so that the designated UE can just check the hash or we compute the hash and compare them, proceed and the rest of them are going to back off. It has to basically, even if it starts like using like a salting technique down here with hash some most sophisticated way to put even if it is using salting, it has to ship the salt string with the hash all together. But does it really prevent Ricky and Trudy from exchanging messages? Not that much. It just makes adds a little bit computational complexity to the mix. But in fact, the Ricky can still recompute because it's going to have the hashing algorithm is going to have the salt and it's going to be able to compute these values for any set of known code book messages that they decide to use and they can just stick to that code book. So it can slightly slow them down but it's not going to solve the bigger problem. Also, the F not be cannot distinguish between the Trudy and the other users. So any attempt to blocking some of the signals if they repeat successively, it is going to have a performance impact. So the actual users have to pay the cost. And as I've mentioned before, the operators are reluctant to take such necessary steps. So what is the real solution? This is the solution I put together to be proposed to the standards or the remediation has to come to the standard level which actually might have applications in other field.  What it does is just adding one layer of entropy over that salt thing and hashing that we were talking about it. The first few steps are very similar. So we do some salting. So once the F not be receives a message three is going to apply salting and apply the crypto hash. Right there, I kind of come up with a new salting algorithm called random multiplicative salting. It's a kind of new algorithm that helps reduce the collision probability when you're using crypto hash functions with shorter strings like CRI. And then after that, it starts applying some random erasure to the output of the hash function. So it decides to not transmit all the bits that come from the hash digest but send randomly select a bunch of them and send them out in message four so that the intended you can, you know essentially has to have all the information to repeat the same process and compare the output. And if it matches, it can process if it doesn't match as it has to back up. So that means that the salt in addition to the salt we have to also ship a basically a bit of string that indicates that which bits we have selected and which bits we have not selected from the output of the crypto hash all together to the UE. So that's what I call it bit mask. As you can see in this case there are two advantages to this that makes it impossible for Trudy and Ricky to communicate.  But the point is that layer of the erasure that we put in between they cannot create a code book that both can be recomputed by a hashing algorithm at the same time have error correcting feature and capabilities in it. So that kind of that having enabling those erasures and errors in there in their communication is going to totally reduce their chance to correct those errors. So that way their whole communication scheme is going to fall apart. Another key point in here to mention is about the cost, right? I mean, always there is no free launch out there. So that's the whole point in engineering is that whenever we're trying to improve thing we have to pay the cost but is it the cost we are paying is the right cost. In this case, as you can see, significantly increase the number of the bits we are replying in the message for in stuff like playing by 48 bits. So in the example of like a MD5 hash instead of playing back 48 bits we might be playing back about like a 200 bits. But that's not a problem with LTM 5G and the amount of like the bandwidth and resources that are available for this. This is not going to be a big cost to pay really for preventing this. So as a matter of fact, what we are proposing here is going to be more of an optional secure latch. So it doesn't have to be implemented everywhere across the network but maybe the operators want to implement this near some critical facilities and areas where they're requested to do so. So I would like to kind of get to the wrap up points in here. So I'm going to turn quick to Chuck to share his concluding bits about the story and he's been all along observing me working through this. So I would like to also share him to share his feedback with you. Chuck. Thank you, Reza. When Reza came to me and he talked about I think I figured something out in the Mac layer and we can like smuggle messages in and out of a cell phone network. I was like, no, there's no way. Mac layers are boring. You know, the best way you can do with anything like that is, you know, get from port one to port two on a switch. But just because it's layer two doesn't mean that it's localized. And I think that's something that I really sort of took away from all of this. We also really don't think that LTE and 5G are the only systems that are vulnerable to these types of attacks. If you just start digging around some of the Mac layer protocols that are used by satellites, there seem to be about 10 to 20 of them. And that would give you a lot farther reach than anything that's terrestrial based. There's a whole host of other radio broadcast signals out there as well. Formato 211 to Bluetooth to lower ran to other things that can probably be abused in similar fashions. Also, just to note, LTE and 5G is now for everyone. With a budget of about the same as a gaming computer, you can buy enough equipment now to build your own LTE network and even the FCC's granted spectrum for you to go and play around with it in your own sort of private space, which is pretty wild. So yeah, we'd like to also say thank you to many people in our team, including Befe and Luca, and Resid would like to say thank you to a few others too. Yes, thanks Chuck. I think I'm going to thank Chuck for all the work and support that he offered me during the CFP process and putting all this talk together. Also, the ATI management staff, Chris, Steve McGregory, the cool boss I mentioned early on that who kind of like inspired me to go through this all day discovery. Also, I would like to thank for a Keysight IB program coordinator, Pete Marisco, that he did a great job of sticking to a very fast timeline so that I can share the remediation bits here with you to him. And in general, I really thank Defcon. It's been a really great experience for me. I really love to continue being engaged in the community. Thank you.


There are many ancient sites which upon exploration create an air of doubt surrounding the academic explanation as to their origins, raising logical questions within the minds of the astute, with Iran being a place littered with such structures, one of the most famous of which known as Persepolis. Found upon the banks of the river Pulvar, this plateau of mythical carvings simply baffle the modern man. According to permitted academic study, Persepolis dates back a mere 2,500 years. I say mere due to several reasons. First, the lack of ability of those who were living at this particular time, the advanced techniques used within the creation of the site, and the laser-like stone cut precision, demonstrating techniques utilized by a civilization far more technologically capable than those currently claimed as having been responsible. Thus, I must conclude, they predate the academically claimed culprits and are, in fact, the work of a lost civilization. The site possesses claimed, acclimated styles of architecture, although we feel these claims are a misconception and are, in reality, the work of someone else. Declared a World Heritage Site in 1979, the ancient Persians claimed it as their own city, naming it Persa, which means Old Persian. However, it seems, like so many other inexplicable sites found around the world, it was simply re-inhabited. Yet unlike these many other sites, inscriptions found upon buried treasure at the site actually possesses an inscription left by one of the oldest rulers of the Persians, openly admitting this re-inhabitation as a reality. Treasure found still successfully concealed at the site, a sign of the people's loyalty to their king, not discovered until modern times, presumably protected by them and its secret location, until their death at the hand of Alexander the Great's invaders, solid gold and silver tablets preserving the king's account of the site's origin. Quote, Darius, the great king, king of kings, king of countries, son of Hytaspis, this is the kingdom which I hold, from the Sacchi, which is beyond Laghdia, to Kush, from Sindh to the Indus Valley of Lydia, and the oldest of Persia, Sparta, this bestowed upon me by Ahura Mazda, the greatest of gods. May Ahura Mazda protect me and my royal house. An inscription I perceive as an explanation that the ruler himself, due to the site's incredible nature, believed it had been built by the gods and by divine right, had been bestowed upon him. Archaeological evidence accumulated by the French archaeologist André Godard, who excavated Persepolis in the early 1930s, believed it was Cyrus the Great who chose the site Persepolis was built upon and that Darius I built the terrace and the palaces. These conclusions, I assert, were due to Darius and Cyrus reutilizing such structures as their places of burial. This, due to their divine perceptions, explained upon these once hidden treasures. However, these rulers, dated well within permitted archaeological timelines for man, are accompanied by the countless archaeological artifacts, predictably left over by these cultures who never experienced cataclysm. Thus remained perfectly preserved, excavated, and flaunted to the many inquisitive people who visit these museums each year. However, the contradictory inscriptions still reveal very little regarding origins of the ruins in which they were found within. Ruins which are simply unexplainable. When one visits the site, they are initially confronted with gigantic megalithic stones, not only within its foundations, creating the platform used as a stronghold for many years, but also, somehow set aloft, forming still existing trilithons which, regardless of the demolition efforts undertaken by Alexander, still litter the site. A 125,000 square meter terrace artificially constructed, partly cut straight out of Rahmet Mountain. An additional factor which supports my argument of a highly advanced builder are the Lamasu. These mythical animals reminiscent of Santars are many tons in weight, and in a previous video we showed the tremendous challenge a mere 150 years ago transporting such megaliths was. Not to mention the tremendous artistic achievements these stone carvings would have been, along with countless other intricate, masterfully carved artworks throughout the site, which mystify all who gaze upon them. Furthermore, and perhaps most interesting, are the far more primitive looking versions. Some argue were incomplete, others argue were attempts by future primitive cultures. These attempts, although in some areas share tool markings reminiscent of patterns like those of the stone cutting technologies we have recently been studying in depth, may just be mere coincidences due to the random hacking that seems to have been undertaken upon the stones. Due to the positioning of the Persepolis Plateau, it was logically not constructed as a military stronghold, but rather a temple devoted to something else. A build surrounding this ancient civilization's belief systems, or possible observations of many alignments in relation to precessions, only just coming to light. Due to its location, far away from any strategical placement, found within a remote and mountainous region, although it was an inconvenient residence for the ruler of the Empire, it was still chosen as a discreetly positioned capital of the Persian Empire. Yet clearly not a position chosen by the Persians, but merely reclaimed as their own work. Far away from the melting pot of developing Persian culture, the country's two capitals were Susa, Babylon, and Ekbatana. With the Greeks completely unaware of its existence throughout their own reign, only plundered by Alexander the Great's eventual far-reaching invasion. It is a site full of compelling features, most of which in direct contradiction to that which is claimed by modern academia and indeed their institutional cohorts, Iran's museums. It is a site we find highly compelling. In our last video, we covered the enormous artificially created platform known as Persepolis. Claimed as the work of the Persians, I believe, however, due to the astonishingly advanced nature of the stonework present at the site, and also the inscription of it having been an offering by the gods, given to the previous Persian king, that regardless of academic assertions, it is a surviving relic of a civilization far older than they would ever admit to. Found upon several gold and silver tablets found buried within the site, inscribed with a message left by these more modern inhabitants thanking the gods for the creation of said site, concluded by many ancient civilizations all over the world, who, due to the rigidity of the protected paradigms regarding the chronological timeline of man, are claimed as the builders of said sites, regardless of whether these same institutions' archaeological endeavors prove them incapable, sites that these so-called builders must have been perceived as only ever being able to have been built by the gods themselves. For even to this day, they remain astonishingly ancient achievements, undoubtedly the work of a highly advanced, technologically innovative lost civilization. Naqsh-e-Rostam, for example, an ancient necropolis located about 12 kilometers northwest of Persepolis, is in a set of rock-cut structures, hewn from the mountainside with such precision, they are simply unexplainable as the work of any ancient civilization academia has permitted the study of. Clearly made by the same civilization that once created Persepolis, as within this area there are countless enigmatic and astonishingly precise stone structures, some created using enormous megalithic blocks, while others carved directly out of solid stone. My own recent research, which has differentiated two ancient civilizations, the Cyclopean and the Polygonal civilizations, is solely based on the separation of their technological prowess, differentiations and similarities with the Cyclopeans, although not displaying the same capability of building walls as that of the Polygonals, were still linked to astonishing builds, such as Petra. These astounding structures also carved straight from bedrock, extremely similar to many of the rock-cut structures found throughout Iran. However, Persepolis possesses some techniques that although no one has seemingly looked at closely, is a strange, unique method of linking the stones of some of these structures together. Not only an enigmatic structure, predictably claimed as the tomb of Cyrus, but they are also present within the impressive, yet seemingly demolished fortress, possibly destroyed during an invasion which can be found nearby. Known as the Fortress of Pasargode, this building is not only constructed using Cyclopean's signature blocks, but it seems the same clamping techniques was used within its construction. Intriguingly, however, although these mysterious clamping features are still within the tomb of Cyrus, they are all seemingly missing from the fortress in Pasargode. The questions these anomalies raise are many a number, yet unlike academia, we do not claim to know the answers. We are merely in pursuit of them, slowly compiled from our gathering of the inexplicable sites worldwide. Eventually, we hope to decipher not only why they were placed there, who built such structures, but indeed, how. Nakash-e-Rastam is not the only rock-cut structure of astonishing precision found within Iran. Many other precision-cut artifacts can be found littering the area. Mada and Salah, for example, being a series of structures also claimed as tombs, created from single enormous rocks. To claim such work as that of primitive tool-wielding ancestors, I find absurd. Yet the more I look into these sites, the more confusing and thus enigmatic they become. Not only does academia claim that the plateau of Persepolis was completed, which is clearly not only an obvious misconception, but also the unfinished sections seem to have been attempted to have been finished with primitive tools. But certain places within the area possess the stonework of the Cyclopean civilization, yet with unique clamping techniques found only in Iran. With additional structures, which are located near the rock-cut structures of Nakash-e-Rastam, seemingly having been cut and built with blocks of a deliberately opposite type of cutting style. Several alternative scholars who have explored this site have hypothesized that many areas were attempted to have been renovated and reconstructed by a later civilization. And although we know that many of the surviving columns toppled during Alexander the Great's invasion were indeed re-erected, the enigmatic chisel marks found throughout the site and also the Cyclopean style blocks found within the fortress on the hill, to us, seems to indicate that whoever attempted these finishing works were far less capable than those who originally created the ancient ruins found throughout Iran. Furthermore, evidential features found within the area of Persepolis, one such feature, known as the Great Staircase, is seemingly the most highly advanced precision work of the Cyclopeans, this pinnacle in architectural design indicating the nearing of the end of their legacy upon our planet. Did they merely rediscover these incredible rock-cut structures? Were they the builders of such? For regardless of the fact that I have indeed linked their work to the astonishing feats of Petra, the similarly astonishing rock-cut temples of India and also Myra, which we have confirmed through the identification of the stonework and tool marks as having indeed been the work of the Cyclopeans, were these ancient sites their final creations left unfinished due to their demise? If so, the question remains, why do so many structures contain enigmatic techniques of clamping found nowhere else on earth? And why are these structures near Nakashi Rustam seemingly built in direct opposite methods to their signature-cut stones, reliefs, and stad? Were they the work of the same civilization? Or possibly a third as yet undiscovered group, who clearly accomplished an astounding degree of skill in stone carving themselves? We find ancient Iran not only perplexing, but incredibly compelling.


But today, this session, the emphasis is not just China, but really China in the context of globalization. As we all know, globalization is nothing new in the world. Historically, it goes up and down. Sometimes it is stronger, other times weaker. I'm reminded that 2000 years ago at the Silk Road, which is today, if you want, the Chinese called them Belt and Road Initiative. I don't know what's the difference about the same. The Silk Road 2000 years ago was when there's a lot of trade interactions between China and the other East Asian countries, as well as a lot of Middle East and even all the way to Europe. Historically, 2000 years ago, globalization was with us. Over time, it absent flow. The next event I will mention is perhaps 1401. What happened in 1401? A Chinese Admiral who, by the way, is of Islam background. He went all the way to East Africa and to the Gulf States. That was 1401 something. So that was another sign of the globalization of this world. 1453, when the Ottoman Empire took over Istanbul or Constantinople, the land link was somewhat cut, and hence the sea route began to flow again. And in 1492, when Columbus went to the New World, there was another step in the globalization, except that the ship that Columbus has was only about 20% that of Admiral Zheng He's from China 90 years before that. While the West of the world was globalizing, China decided to go the opposite direction. And that was perhaps the beginning of the waning of the Chinese Empire. It caused me to think, I cannot help but think, today who is the most anti-globalized world, country in the world? It is no longer China. China, after being part of globalization, close up itself and now finally globalize again. China is today very much full globalization. It was only 2001 when they joined WTO, the rest of the world welcomed China to the globalized world. So this less than 20 years ago, little did we expect at that time that today, the West, in particular, the United States, which was for sure the leader of the globalized world, at least starting with the end of World War II, should be today perhaps the one that is the least open to globalization. So these are all factors that are affecting us today and I find it very, very amusing. Here, let me just say one other point, two other points. The first one is, a lot of people assume that America is for multilateralism, America is for globalization, America is a country that is for internationalization. Not so. Read American history. America, for the first hundred years, if not 200 years, was close to 200 years, was very much an isolationist. It was really World War II that brought the United States to become the leader of the so-called globalization world. And so today, what we are seeing America, America first, as somebody mentioned earlier in that last session, what they are doing with the trade war, is America in some way going back to its old habit of isolationism rather than open to the rest of the world. So these are all issues that are confronting us today. And what will the world be like if America indeed moves more and more toward isolationism? What will happen to Europe? What role will China play? And that is the topic of our discussion here today. Will China, together with EU, perhaps also India, maybe Japan, become leaders in the globalization process? These are very interesting issues for us to address. So with that, I will first, I have two very distinguished guests here. You all know Mr. Sibai Leng. He is a professional in his earlier life. And then he was very much involved in the drafting of the Basic Law that governed the return of Hong Kong to her motherland China. And eventually he became the chief executive of Hong Kong for five years, ending about two and a half years ago. And to my far left is Eric. Some of you may know Eric, but I doubt. If you watch Ted Talks, you will see Eric because Eric is a pretty hot Ted Talk guy, educated in UC Berkeley and then MBA from Stanford and finally, his talk trip from Fudan University in Shanghai. He is a venture capitalist. He also is the founder and chairman of the biggest internet platform, a media platform in China called Guancha Syndicate. So we have some very interesting persons here. So with that, can I first invite Eric? Eric, you have a background in the West, you have a background in China. Tell us, what does that mean in today's day and age for China to be part of the globalized world? Okay, well, thank you, Ronnie. I'll be brief. It shouldn't take me to tell you that globalization is in deep trouble. It's not going anywhere. In fact, we may be, I think we're also going to face the globalization as Professor Blanchard pointed out this morning. And globalization in the last two or three decades has had great successes and many beneficiaries. China obviously is one of the greatest beneficiaries, but so are the U.S. and much of the developed world. And that's obvious if you just look at the data and how people live. So why is it in trouble? I think globalization, this round of it, has also had many great failures. In fact, most of the developing countries in the last 20, 30 years of globalization had not really benefited that much, not as much as they should. At least the peoples of the many developing countries have not benefited. Poverty persists and inequality is increasing. China succeeded in lifting 700, 800 million people out of poverty in the last 30 years. But if you take China's number out, the world had gone backwards on poverty alleviation. There's even more poor people after this round of globalization. And the same is in developed countries. In America and Europe, inequality is increasing tremendously. That's why there's a backlash. Interestingly, China joined the WTO in 2002. From 2002 to 2018, Chinese GDP went from 1.4 trillion to 13 trillion, so huge increase. But the U.S. made just as much money, if you will, in terms of absolute dollar amount. U.S. GDP went from 10 trillion to 20 trillion, obviously from a higher base. So absolute dollar amount increases are close. Yet, Chinese medium income in the same period went up 7x. The U.S. stagnant had declined. So why is that? What's the problem? And also globalization in the last 20, 30 years have shattered many communities. If you go to most developed countries in America, people are opiates. They've lost hope in Europe. 20, 30-year-olds are getting on the streets to fight for their pensions. So globalization has had many failures. And why had globalization failed in so many respects? I'd like to suggest that this last round of globalization has been run on a universal vision of neoliberal doctrines. Which essentially has consisted of political liberalization with endless elections that don't produce good leaders, total marketization, privatization of businesses, a retreat of the state. In fact, I'll let Mr. Liang speak to Hong Kong, but Hong Kong is a separate economic entity. In China, had very much suffered from neoliberal approach to economic development in the last 20, 30 years. They have left, they have enriched the elites, but left so many people behind. That's probably, you know, I see the current situation in Hong Kong is very much a Chinese version of Zhezhen in Hong Kong. So what do we do? Do we turn back and say no more globalization, or do we find a new approach? And I think the Chinese proposition is that we need to find a new approach to revitalize globalization, but we have to abandon what we've been doing in the last 30 years. And the Chinese proposition includes a few main aspects. One is to dramatically increase interconnectivity among the countries and economies that have been left behind in globalization. And in concrete form is in BRI, the Belt and Road Initiative, where China has been investing a tremendous amount of money and resources into building infrastructure to connect previously disconnected economies, improving interconnectivity. Second is to reject ideological imposition. I always say that, you know, China has engaged globalization in the last 30 years on its own terms. That's why it's being successful. It's important to point out what China said no to the last round of globalization. It's just as important to what China said yes to. China said yes to rely on market to allocate resources, but China said no to giving up national sovereignty to political liberalization, to total marketization and the retreat of state power. China said no to many things. And therefore China's proposition for a new round of globalization would be a reliance, a revitalization of national sovereignty to give different countries their own room and space to pursue their own paths, to choose their own models. And on that basis, third, is that we create a more networked world. So it's a networked way of networked pluralism as opposed to a hegemonically led universalism. And that is, I think, what China's proposition will be. And it's still a nascent stage. And I think the world should be open to it and work with China with this. Thank you. Thank you, Ari. Mr. Leung, there's been some questions about Hong Kong today. So you can talk about both. I suppose we should answer part of that question raised by several people in the earlier session. So you can say a word about globalization if you like. Or you can talk about Hong Kong. He being the one who is perhaps most qualified to address the issue of Hong Kong today. I'll stand up. Just in case I might fall asleep. I had prepared something to address the theme of this session, which is China's Chinese position on globalization. I'm throwing this away now because I heard a theory in this opening remarks mentioning Hong Kong a couple of times. And so did Eric just now. We have had four months of nonstop troubles in Hong Kong. And it's going on. As far as the violence is concerned, it's turning down. The number of rioters and peaceful demonstrators have been going down together. In this trending down motion, we might, if we are not careful or lucky, see some spikes in the degree of violence or the scale of casualties. The police and other authorities in Hong Kong have exercised a maximum restraint. And that's why I listen to you. And that's why we are not seeing the kind of casualties in the streets of Hong Kong as we have seen in other parts of the world. Democracy. Hong Kong is not a sovereign state. Hong Kong is part of China. When we look at democracy or the process of democratization in Hong Kong, we shouldn't compare Hong Kong to a sovereign state. We should and could only compare democracy and democratization in Hong Kong to those in cities, Paris, London, New York, Tokyo, Washington, D.C. But Hong Kong is not an ordinary city because under the basic law and under the terms of Hong Kong's return to China, and this was propagated in 1990, after five years of intensive and large-scale consultation in Hong Kong and also in the rest of the country, the basic law was propagated in 1990. Under the basic law, Hong Kong was given not just one country, two systems. It was given one country, two systems, Hong Kong people ruling Hong Kong, with a high degree of autonomy. Not complete autonomy, but a high degree of autonomy. And this high degree of autonomy is well defined in the basic law. And they are all together 160 articles in the basic law, the second white, which has been practiced for 22 years now. So when we talk about one country, two systems, when we talk about democracy, these are no longer abstract concepts for Hong Kong. They are part of our constitutional and legal arrangements. Now, China, if I have to make a guess, could straight away say to the people in Hong Kong that you could have your way of electing your chief secretary, the head of Hong Kong government, if the result of the election is to produce a chief secretary that has the same degree of autonomy and the same scale of authority as the mayors of London, Washington, DC, Tokyo, New York, Paris. But speaking as a former chief secretary, I can tell you, and you can look at basic law, basic law is available in both languages, English and Chinese. It's on the website. You can do it now. The chief secretary of Hong Kong is given a much high degree of authority and through the exercise of this high degree of... It's given a high degree of authority and through the exercise of this high degree of authority, Hong Kong attains its high degree of autonomy. Local democratic processes do not produce mayors of chief secretary in the case of Hong Kong that has this high degree of authority and local cities do not have this high degree of autonomy. So where does the additional authority come from? It comes from a top-down process. So it's not entirely bottom-up, meaning the delegation of authority by the electorate to this elected person. In addition to this process which we have in Hong Kong, the central authorities in Beijing, through the appointment of the chief secretary, devolves a certain power that normally belongs to central governments to the chief secretary and therefore Hong Kong as a whole. And therefore in our electoral system, and it's in the basic law again, we have so far election company elections, a election committee of 1,200 drawn from different sectors of the Hong Kong community. And at the end of the election process, the person has to be appointed by the central government. And this appointment is neither ceremonial nor nominal. And it's a real authority to appoint, meaning the central government in law can appoint, or not appoint the elected candidate. So that's democracy in Hong Kong. The basic law also says that universal suffrage election is the ultimate goal in the democratic development of Hong Kong. A universally elected chief secretary of candidates still has to be appointed by the central government. And to change from the present system of the election by election committee to universal suffrage election, it is in the NX1 to the basic law. Again, you can look it up. The approval of the standing committee of the National People's Congress of the country, not Hong Kong, of the country in Beijing is required. So these are the constitutional and legal arrangements. As I said, if the chief secretary in a democratic society representing people of Hong Kong, as if like a mayor of Hong Kong, has only that kind of power, Beijing would have said to universal suffrage straight away. And I could look at the flip side of the question. Now, would cities in other democratic countries, including those in the west, have this kind of high degree of autonomy just through the election of the local mayor by the local electorate without the central government or the federal government having any power and say in the process? Question mark. So these are the manifestations of the principle of one country, two systems that have already been enshrined in the basic law. And it's a legal document. The five demands of the protesters and the rioters in Hong Kong include universal suffrage in Hong Kong. And to them, universal suffrage is not universal suffrage according to the basic law. They want Hong Kong to do it by themselves without the involvement of Beijing. So we are stuck. When our chief secretary actually went through a process, a so-called constitutional reform process in 2014 that led to Occupy Central. In the end, the whole movement died down. Beijing actually offered the opportunity of the election of the chief secretary by universal suffrage. But some of the young students in certain quarters of the Hong Kong community will not have it because they did not like what's written in the basic law. And they wanted open nomination of the chief secretary candidates. So it's a complex, complicated issue, technical, but I thought I should seize on this opportunity. I'm sure you have your concerns about the future of Hong Kong. We do, too. But we have to go by the basic law. Hong Kong is a law-based, rule-based society. We have to go through a rule of law. Again, one country, two systems, high degree of autonomy. Hong Kong people ruling Hong Kong. Democracy in Hong Kong is no longer an abstract notion. It's all in the constitutional arrangements. Thank you. Okay. I'll open it very quickly, very soon to everybody. You're going to ask anything about globalization or Hong Kong. But let me just say one last thing. And that is, I find it very interesting sitting here in Africa in the presence of many of my European friends. That Europeans, when they went to Asia, when they went to Africa, they plundered those places. And coming from Hong Kong, I should know. And they colonized those places and took natural resources. While the Chinese today, they are paying for natural resources. They are buying them instead of plundering them. I remember 20, some years ago, I bumped into New Gingrich in Davos. And he was the first one that told me that, Ronnie, pay attention to Africa. There's a lot of potential there. So I began to come to Africa. And I cannot help, 23 years later, ask the question, what has American done in Africa? Is that what Eric called hegemonic globalization? Or what is China beginning to do today, what he called something like connected globalization, such that at least to begin with on an economic basis, where all the countries that can begin to share the economic benefit of globalization. So Eric, if you have anything to add now, if not I'll open the floor. We have plenty of time. Five seconds. What I mean by hegemonic universalism is to have one hegemonic leader that applies the same set of standards and rules on everybody, as opposed to what I call network pluralism, is to allow different countries to engage globalization on their own terms. Thank you. I was in London the last few days. Five people told me how that the Hong Kong police was so restrained in the streets, compared to Paris, Barcelona, New York, Los Angeles, Chicago, London. So I encourage all of you, I don't want to debate this issue, just watch the full footage rather than the one snapshot picked by the media. Watch the whole thing and then we'll have a discussion on that, okay? There's several people, the two gentlemen here in the front, back there first, and then the gentlemen here, and then finally our friend from Ethiopia. Thank you. First a quick question to Eric Lee. Well, a statement in a way. In the way you described political elections in the West as often tight and complex process. Indeed, and you're right on that. But maybe we prefer tight and difficult elections to no elections at all. Second question actually to the whole panel and the moderator indeed. Don't you believe, dear Chinese friends, that actually the attitude presently in Hong Kong would rather draw most of our countries, I'm French, in more liking towards the US in the evolution of globalization. Globalization could be a multilateral process, as was stated previously in the morning. Europe could stand in a way between China and the US in the idea that there should not be a US domination or Chinese domination. But since we believe that many of our values are presently challenged, maybe we feel more of a community of values with the US and the Western world. I just want to say again, as indeed Mr. Long knows, and his statement was very interesting concerning the basic law, that it is guaranteed by an international treaty and the scrutiny of the UN, and it is not, as indeed you've not stated, and that was very honest from you, sir, it is not a purely internal affair. Thank you. Harry? Well, I mean, if you like elections, by all means have as many as you want. And as often as you want. Maybe every day referendum is better than elections. Eventually you'll produce some good leaders, I'm sure. But don't force other people to have them, or have them in your way. That's my point, that's all. Okay. The Chinese don't force their system on others, right? Okay, thank you. See why? On the question... Can you hear me? Yeah, it's on. Thank you. On the question of the international treaty, I presume you're referring to the treaty known as the John Declaration signed in 1985, or rectified in 1985 between China and the United Kingdom. In so far as the election is concerned, the election chief sector is concerned in the John Declaration, just in case a few of our friends in the audience might buy the allegation that China goes back on its commitment to democratization in Hong Kong, set out in the John Declaration. Let me read this to you. The chief sector of the Hong Kong Special Administrative Region shall be selected by election or through consultations held locally and be appointed by the central people's government, period. In other words, if China wanted to do away with election, come to the election which produced me as the last term chief sector and replaced it by consultations, through consultations held locally and then upon the person at the end of the constitution process, China would not have breached the John Declaration. My comment to you, sir, is when you talk about the community of values, that's wonderful. I think the West has really brought some very good value to the world. That is, frankly, common to human nature. And you do it one way, you enshrine them, you codify them, which is very good. But I asked Angela Merkel one time about six, seven years ago in Berlin. I said, Madam Chancellor, you keep talking about shared value. I said, I come from Hong Kong, which is now part of China as an ethnic Chinese. Am I supposed to share your value? By saying so so many times, you draw a line on the sand and say, I am on this side, are you on my side or are you on the other side? I don't know what is the experience of the African friends. They have tried democracy since World War II. I wonder how many of them have been very, very successful. Perhaps there are other ways. Why should we fashion ourselves only after one way of achieving the common value, right? So shall we not allow others to do it their way as well? Mind you that Europeans and Americans only account for about a billion of the world's people. There's another six and a half billion out there that are they supposed to share your value and do it your way? It's just a question to be left for the audience to answer yourself. Let me quickly chop in a tongue-in-cheek. When I was a young child, I had this idealistic view of ultimate democracy for mankind on this planet. And this is let all people in this world elect one leader and one government, a global leader and a global government. We now have 7 billion people on this planet. 1.4 billion Chinese, 1 billion Indians and so on and so forth. Share values, democracy, ultimate democracy, one government, one leader, who that leader would be. What value would that be? Question mark. Now, that was when Xi Jinping was a young child with a rather simplistic view of life, the world. Now, I know the world is more complex than that. I don't hold that view anymore. And I know the realities and the practicalities. Thank you. Sir, the gentleman in the second row. Thank you. I'm coming from Israel. He said in the beginning when you spoke about Hong Kong that something which contradicts the election. You said there will be an election and after somebody had been elected, then the government of China had to appoint him. It's a contradict election, which we know in the West, of course. I admire the possibility and the power of China to control 1.5 billion people. It's unbelievable. I see what happens in most very small countries. We have a lot of problems and not with 1.5 billion. But still, I'm afraid that what happens in Hong Kong today is not good for China because of two reasons. One is the fact that they prove that it is possible to make achievement by protests. It could move. It could be export to China itself, to mainland. Secondly, I'm not sure that this kind of action against the idea of sending the prisoners from Hong Kong to China to be judged is really important for China compared to this riots that you have in Hong Kong. Aren't you afraid about what we call the Maslow Leather, which now in China are coming up? You know, Maslow Leather say that the first stage of people is they want to have security. And then second stage, they want to have food. And only when they have security and food, they want to teach, to study. And after they study, they want to put their opinion. They want to be involved in politics. I said that according when I follow China, I see that people are now standing in the fourth stage, which means the people of China would like in my opinion in the future to see themselves much more with an appointment to bring their opinion to the government, which means in my opinion China will face in the next future a lot of activity of Chinese people which would like very much to be involved in the political process and elect their own people. And maybe you will face in China what you are facing today in Hong Kong. So can you please relate to that? Thank you. The experiences that we have in Hong Kong, internet-based so-called B-Water approach to rally as many people as possible to disrupt normal lives of ordinary people and ordinary businesses big and small in Hong Kong. It's not patented. The first trial is in Hong Kong, whether it's going to be successful or not. And I do not wish this on any country in the world. I do not wish this. But my guess is it will replicate itself in other countries. So Hong Kong is not an island. Other countries are not islands either. No man is an island. If we succumb to these violent and destructive movements for unlawful demands on our basic law, other countries and other governments would suffer. That's point one. Point two, the central government of China, Beijing, has no role at all in the proposed amendment of the fugitive ordinance. It was initiated by the Hong Kong government. Nearly all laws except certain national laws such as nationality, national emblem, national anthem and so on. All laws enacted by the Hong Kong government. That's part of the high degree of autonomy to enjoy. So it wasn't initiated by Beijing. Beijing has no role in that. Point number two. Point number three, this is not the first time Hong Kong annexed a piece of legislation or amended or entered into a treaty with another jurisdiction to send fugitives back. Now it's been withdrawn formally. In the proposed amendment, we have put in more safeguards into the proposed amendment. There are already 22 jurisdictions in different parts of the world. I shouldn't name them. If I wanted to be discourteous to some of these countries, I should so that you know that the record of rule of law in some of these 22 jurisdictions is actually not as good as the mainland of China. And I do ask the question, if people living in Hong Kong are so scared of facing trial on the mainland of China in Shanghai and Beijing and Shenzhen, why would these cities on the mainland host millions of foreign business people living there? So these are the points that I would make. But let me just repeat what I said earlier. I'm beginning to see signs of people. Now we're right or wrong as Chinese people. We don't try to poke our fingers in other people's pies. We are seeing the so-called extinction rebellion movement in parts of Europe copying the Hong Kong protestors, so-called B-Water approach. So be careful. I can't let that one go without two quick comments. One, the situation in Hong Kong happens to be the greatest birthday gift God has given to President Xi Jinping for the 70th anniversary of the People's Republic. Let me explain why. It's completely unified. It's the opposite of what you are predicting. It's completely unified public opinion in mainland China. It's unbelievable. It's showing the Chinese people liberalism's failures and why they shouldn't have it. So it's the opposite. And to your second point, elections all are great and democracy is great when we're all for it. But the fact is liberal democracy is no longer producing governments that respond to the will of the people. Everywhere in the world, almost. I mean, you see that in public opinion poll, after poll, in nine out of 10 liberal democratic countries, the elections don't deliver governments that respond to the interests and the will of the people. So maybe it doesn't work at this time. And all of you have a problem. There's four hands. Two gentlemen from Africa. One gentleman here and then a lady over there. We'll run by five minutes. Yeah, I know. We're already overrunning. So, Terry, tell me what to do. Sir, please. I would like to raise two, three questions. While Hong Kong is important, but I would like this panel to focus on the other important issues also. I represent Africa. I want to know, to listen to them, questions that affect our continent. So if I may ask on the BRI, the Belt and Road Initiative, I believe it's an important project and program. And the way I see it is there has been three infrastructure miracles in this 20th century. The Swiss Canal, which connected Asia and Europe. The Panama Canal, which connected, changed the trade pattern. And the Euro Tunnel, which connected UK and Europe. There might have been some geopolitical impact of this infrastructure. Maybe the British had bigger role benefit on Swiss Canal, the US on the Panama Canal. But ultimately, it was an important forced connect. So my question here on the infrastructure is, as it appears now, the BRI primarily focuses across Asia, Europe, and even the maritime or silk connectors some part of Africa. How can the BRI be designed in a way that it doesn't exclude Africa and Africa benefits from this connection? The second point, we want to see more productive investment to Africa. Ethiopia has benefited from Chinese manufacturing investment. And of all investments in Ethiopia, 67% of companies are investing in manufacturing. We want to see more because we need employment. Africa needs to create 20 million jobs every single year. And that's why the G20 countries developed compact with Africa. We are not seeing sufficient relocation of Chinese investment. They are mainly focused in Asia, which I would say a backyard of China. So how can the private sector, the Chinese government, give special attention to this idea? The last point, there may be differences in political view, but we need to work on the common ground of the United Nations principle. For African countries, we don't want any big powers to intervene in internal affairs. Non-interference is one of the basic principles of the United Nations. And I believe we have always to be reminded of this principle. Thank you, sir. With that, can I ask the gentleman at the back also to ask his question, and then we'll answer it together, where I'm really in trouble. Eight minutes over time, there's still two hands over there and more. Yes, sir. I will give my answer in the form of a question. You have raised the question of human rights. And I ask the following question. Is it human being? The only fact that it is human being, whether it is black, green, yellow, white, red or chocolate, as you wish, is it not common rights with all the entire humanity? That's the question. What are the ways to put it into work? The second question is about democracy. Is the concept of democracy not debunked or not founded on common parameters with all humanity? What are the ways to put it into work? Because in Africa, if we examine the instruments that have been adopted in terms of human rights, in terms of democracy, by the African Union and by the regional economic community, we find something very strong. But when it confronts it with the field, we encounter specificities where we will say that democracy is not made for Africans. We have heard that. Thank you. Thank you. This gentleman, and then the lady at the very back, and then we have to call it quits. We are already in 10 minutes over time. I want to get out of this country tomorrow. I don't want to be detained here. I need to go to work. Yes, sir. Thank you. Always in Africa. The former minister of Algeria. I would like to quickly address a question that seems essential to me on the debate on globalization and development approaches. But before that, I would like to make a link between the session of earlier and the one now. The essential actor of democracy is society. The major actor of the economy is society. What we notice in current crises, Iraq, Libya, Mali, Sudan, are major territorial fractures. Kurdish, Benghazi, northern Mali. That means that the question of territorial fractures and the question of social fractures is an element of major conflict and development and democracy. With regard to globalization approaches, behind the big question of financing and the implementation of infrastructures, the infrastructural development is essential for sustainable development and development of a modernization of territorial societies. But the approaches so far, you said, have been different. For the people, we estimate that it is not profitable. So we don't finance it. And so there is the question of lending, even though the United States, over the last few years, has completely changed their approach and their legislation on the financing of infrastructures in Africa. And so when we say to Africans, attention, such a country is in your summer, we forget to say that the countries in question who raise this question have done lending in the approach of their development is a major issue. Europe is one of the most endangered countries. We have 325% of lending at the global scale and many of the greats, including the Vice President of the Bank, the former Vice President of the British Bank, say that lending threatens Europe. But behind all this, there is not a question of approach. When we see our Chinese friends or our European friends on the big questions, the road to the sea and the road to globalization, for the people, they estimate that they have to structure the periphery to modernize it, to make it reach a certain level to be able to continue in space. And you said it, it's the time, you said there is a billion in front of 6 billion. You estimate that the structuring of the periphery, putting it at a level is a major issue. So in part, the question of the financing of infrastructure is other than the question of lending. So my question, is there no totally divergent approach in this famous debate about globalization, this debate about democratization and this debate about growth? Thank you. Thank you. The last question from the lady at the back there, please. Unfortunately, it's not a lady. I'm sorry, it's fine. No, it's fine. It's a school age. It's better. Your hair is beautiful. And I have hair. Beautiful. Thank you, Chairman. I'm Stephen Erlinger from The New York Times and I was in Hong Kong the night of the actual handover and I tried to follow it. I've been very struck by the defensive tone of all of you mixed with an aggressiveness which I find striking and common now when I hear Hong Kong Chinese and mainland Chinese speak to Western audiences. Actually, I don't think anybody cares whether China has democratic elections or not. No one's forcing you to do it. What I would like to know is do you think Xi Jinping announcing himself as emperor for life and creating Xi Jinping thought as an equivalent to Mao is a good thing for China or a bad thing? Okay. I'll leave it to Eric and Mr. Leung. Well, emperor for life, certainly he didn't pronounce that and that sounds like to me a lot more aggressive and defensive on the part of New York Times than anything that we've ever said. I don't think that deserves a good, you know, a sensible response. Of course he's not emperor for life. We had a constitutional amendment that got rid of term limits for the role of the presidency. The role of general secretary never had term limits but we have retirement customs so they are supposed to be followed so he's not emperor for life. And let me come back to our friend from Ethiopia. Of course Africa is an integral, important part of the BRI vision. The Eurasian mass being united through infrastructure and Africa being linked into the Eurasian mass I think creates tremendous opportunities. Now China is a new kid on the block. We haven't been at it for very long so we're going to make plenty of mistakes. Our companies don't know what to do in these new countries. Our companies don't know how to work with local communities because in China we have county party secretaries like a CEO who helps the company in these different countries and the situation is completely different. So we need help. And what Africa could do and I hope it will do is for African countries to produce great and strong leaders like Mr. Kagami who will be speaking tonight like Mr. Ahmed perhaps is on the way of becoming and only with strong leaders can you take advantage of what China has to offer. So that's that. I've forgotten the questions there. Okay, you're right. Let me just very quickly respond to the Belt and Road questions. If we in Hong Kong or we in the rest of the country, China will do anything to promote better mutual understanding not just of investment opportunities in the various countries in Africa but also what Africa is about. Please let us know. We'll be quite happy to oblige. I founded the Belt and Road Hong Kong Center for example two years ago and this center sponsored young school children and the Hamas and Hamistresses to go and visit excuse the term of the beaten track countries along the Belt and Road and they all come back with new vision of life and so these are the next generation of collaborators. Now if you want to take a shorter term approach if there are certain sectors or industries that you're open to Hong Kong or mainland Chinese investments so you have my name card. Let us know. China and Hong Kong included often gives people the impression that we have unlimited ambitions under the Belt and Road initiative or unlimited appetite under this initiative. Realities are of course not. We do have capacity constraints and one of the constraints that we face at the moment is not so much capital but human resources and that's why it is important for us to send people to your countries to see what opportunities are. Thank you. There's another question about human rights that I want to address briefly. Of course there are universal aspirations for all mankind as part of the human condition but those aspirations don't have to necessarily be liberal and if you ascribe rights to men these rights may be in conflict. If you read the UN Declaration of Universal Rights or whatever the document is called every right in there is in conflict with every other right. So what are our priorities? What we've got to do? So to me equality is a universal aspiration and equality and to me in every country there shouldn't be in today's modern world with this abundance of material wealth we shouldn't have people living under absolute poverty line. We just should not, it's not unconscionable. So to me that's a universal aspiration but liberalism is not delivering on these universal aspirations. In China's socialist system I think it's doing a little better job. We don't make a lot of mistakes, we have a lot of faults but we don't have these liberal elections but we are lifting hundreds of millions of people out of poverty. In fact we're two years away from eradicating poverty below the absolute poverty line. About 20, 30 million people left. That's a universal aspiration.  I think being over time I've now come in, Harakiri go outside but last sentence is I think that it will be very important for all of us whether you are from Europe, from Africa, from China to bring America back to become part of the globalized world. I think the best world forward is where one, the US, Europe, China and many other countries should work together rather than having any, especially a major country like the United States moving increasingly toward isolationism and that to me is my biggest worry. So shall we just leave it at that and we'll be happy to talk offline. Thank you.


I am going to take a numerical example on cantilever slab. Learning outcome. At the end of the session, the learners will be able to determine the effective depth of the cantilever slab, the main and distribution reinforcement required for cantilever slab and they are able to sketch the reinforcement arrangement. This is their example, design a cantilever balcony slab projecting 1.2 meter from beam, adopt a live load of 2.5 kilo Newton per meter square, use M20 concrete and Fe415 steel, sketch the details of the reinforcement. Solution. Step 1, depth of the slab. We have to find out the effective depth of the slab. As per IS 4562000, it is one-seventh of the span for the cantilever slab. Span is 1200 mm divided by 7, it works out to be 171.4 mm. The effective depth, let us consider effective depth of 175 mm and the overall depth by considering the diameter of the bar and clear cover, it let us take it as 200 mm. The depth D may be gradually reduced to 100 mm. That means on one side it is the 200 mm, on the other side it is 100 mm. So effective depth it may be around 175 or 180 mm. Then step 2, we have to find out the design moment EMU and the design shear VU. So for calculating EMU and VU, we are supposed to find out first the self-weight of the slab. The self-weight of the slab it is given by average load taken as UDL, average load because we are having thickness on one side as 200 mm and on the other side as 100 mm. So therefore it is 0.2 meter plus 0.1 meter divided by 2 that is average thickness into 1 meter. So into 25 kilo Newton per cubic meter. So that is our density which will give us 3.75 kilo Newton per meter. It should not be per meter square it should be per meter. So finishing load is 1 kilo Newton per meter square again it is 1 into 1 it is 1 kilo Newton per meter. Now can you please tell me what will where will be the maximum bending moment for a cantilever slab. So the maximum bending moment for a cantilever slab it will be at the face of the support. It will be at the face of the support because cantilever slab is fixed at one end and or continuous at one end and on the other end it is free. Therefore maximum moment is at the face of the cantilever slab at the face of the support.  So then we have to find out emu that is design moment it is W into L square upon 2 because it is a cantilever slab. So therefore it is 1.5 is your factor load into 7.25 that will give you W into 1.2 square divided by 2 it was out to be 7.83 kilo Newton meter that is the value of emu. Emu is design moment. Next VU is equal to W into L by L because entire load will go towards only one end because other end we do not have support it is a cantilever. Therefore it is 1.5 into 7.25 into 1.2. So 1.8 into 7.25 that will give you W into L is 1.2 it is 13.05 kilo Newton is shear force. So this is design shear is 13.05 kilo Newton design moment is 7.83 kilo Newton meter. Then we have to design the main reinforcement. So we have to find out first what is XU limit it is 0.488 for Fe 415 0.48 into 175 it is 84 mm. Then we have to find out emu limit either we can find out by equation C into lever arm this is the equation C into lever arm 0.36 fck b XU limit into lever arm is d minus 0.42 XU limit or you can even simplify this because this is already known 0.48. So therefore XU limit is 0.48 it is already known from IS for 562000. So therefore here you can if you simplify this calculation you will get a constant into fck into bd square. So that constant for the Fe 415 it works out to be 0.138 fck bd square or you can find out by using C into lever arm. So this is this works out to be 84.5 kilo Newton meter. This is emu limit the emu value which you have calculated it is less it is 7.83 only here you will find emu. So emu limit we have calculated 84.5 so the emu is less than emu limit hence it is under reinforcement. Then we have to find out the area of steel required we have to find out the area of steel required main reinforcement. So by using equation G 1.1 b of IS 456 2000. So it is emu is equal to 0.87 fy astd into 1 minus ast fy upon bd fck. So emu is 7.83 into 10 to the power of 6 equal to 0.87 into 415 into ast into d is 175 it is 1 minus ast divided by bd that is 1175 and fy is 415 fck is 20. So ast works out to be 125.8 mm square. So the minimum reinforcement also we should check it for minimum reinforcement whether this 125.8 is less than the minimum reinforcement. So if I check it for minimum reinforcement it is 0.12 divided by 100 0.12 percent of b into d b is 1000 d is 200. Please remember for minimum reinforcement you have to take overall depth it works out to be 240. So therefore this is greater than ast which you have calculated. So therefore you have to provide this particular steel minimum reinforcement you have to provide steel provide should be always equal to or more than minimum reinforcement. So therefore 8 mm diameter bar spacing area of 1 bar into 1000 divided by 240 that is 209 mm. So hence provide 8 mm diameter bar 200 mm center to center. So this is your main steel. The main steel for cantilever it is at the top then step number 4 you have to design the distribution steel you have to design the distribution steel. So distribution steel is equal to the minimum reinforcement you have to provide ast is equal to 0.12 percent 0.12 by 100 into b into d b is 1000 d is 200 it is 240 mm square. Therefore provide 8 mm diameter bars 200 center to center. So that means main steel is also 8 mm diameter bar 200 center to center distribution steel is also same. Now you have to check the anchorage length because it is a cantilever slab. So for the anchorage length you have to check whether the embedment of bar main reinforcement is up to LD or not LD is given by LD is called development length development length of the bar to transfer the tensile stress to concrete. It is 0.87 fy into diameter of bar divided by 4 tau bd as per IS 456 2000. So 0.87 fy is fy is 415 Newton per m square and diameter of the bar you can take 8 or 10 whichever we are having. So then if I take 8 it will be less than this then 4 tau bd tau bd you have to take from the table of IS 456 2000. So that is bond strength it is bond stress it is 1.2 for fe for mild steel it is 1.2 Newton per m square for mild steel if you are having HYSD bar this is to be increased by 60 percent this is to be increased by 60 percent that is therefore it is multiplied by 1.6. So we get LD as 470.12 mm. Next we have to check it for deflection you have to check it for reflection that is L by d provided is 1200 divided by 175 it is 6.85 which is which should be less than L by d max L by d max is calculated by using IS 456 2000 the cantilever for cantilever slabs L by d ratio given is 7 and which is to be multiplied by constant F1 F2 and F3 F1 is determined from figure 4 F2 is F2 and F3 are 1 for cantilever slab. So to find out F1 from figure 4 you have to find out the percentage steel it is 0.196 percent and the FS you have to find out it was out to be 240 Newton per m square and from figure 4 of IS 456 so F1 was out to be 2. So F2 and F3 are 1 so therefore 2 into 1 into 1 into 7 it was out to be 14 which is greater than L by d provided that is 6.85 hence it is safe against deflection or defense deflection control is satisfactory. Now this is the reinforcement detailing so since you have tension at top for cantilever beam this is free end and this is fixed end. So therefore the tension is at top your main reinforcement is at top and that main reinforcement should have a development length should have a development length to transfer the stresses to concrete Ld and the main reinforcement is 8 mm diameter HYD bar set 200 center to center and the distribution bar again it is perpendicular to the main reinforcement and it is again 8 8 mm diameter bar 200 mm center to center. So this is the beam and this is the development length from face of the support so maximum moment is at face therefore maximum depth at face and minimum depth at free end. These are the references used for the preparation of this particular presentation thank you Thank you one and all