This is what's going on. I'm John Lee. Our guest this evening is John Mine, a candidate for the Davis City Council. John, I want to thank you for being on our show. My pleasure. Oh, good. I hope. Oh, well, we'll see where it goes. So, why are you running for city council? Well, I think the city needs to get its financial house in order, otherwise we aren't going to be able to continue to enjoy the things that make this Davis and the place we love to call home. And I have a concern about decisions that have been made at the city council level that don't seem to really have been for the benefit of the residents compared to one or another special interest group. So I thought the best way to approach dealing with that would be to be on the council itself. So you served on the Davis School Board? For four years, 1997 through 2001, it seems like a hundred years ago. Well, in some ways it was a hundred years ago because the dot-com explosion happened right at the end of that. We were in the process of trying to get computers into classrooms while I was on the board. The strategy at that point was that it was the teachers that needed the computers so that they could learn to use them and then teach the students. I'm not sure it doesn't go the other way at this point. I think it does. I think it pretty much does. Well, you know, I have a friend who's an eighth grade teacher and he teaches history and I gave him a cartoon where the father, the son says to the father, I'll help you with computer if you'll help me with history and what the kids are learning today, if it's older than two weeks ago, it's irrelevant to them and they don't understand a lot of the ways that society has come together based on our historical experience. Well, my experience right now has been primarily away from schools so I can't really talk about the way things are now in the classroom. Okay. Well, I do want to talk about one thing, which is you ran for a school board which is a nonpartisan office and there were two other people that were announced candidates, John Salie and Marty West and because you're a registered Democrat, somebody else, I'm sorry, ooh, because you're a registered Republican, now where will we go with that? Because you're a registered Republican, a Democrat ran against you because they didn't want to have any Republicans on the school board. Now my report is that at the end of that time period, the superintendent of school said it would be great if there could be five John Mines on the school board because John Mine comes prepared, he's ready to work and he's ready to make decisions. So it was a different time but the school board now is faced with some interesting challenges, some of which are their own making. And I think that part of the connection now is that the city council has gotten itself into some predicaments that are awkward at best. I think I'd like to follow up on what you were saying because I'm not sure that five John Mines would be a good idea anywhere because you need the variety in order to come up with the best solutions. When I was on the school board, I got to serve with really good people. I had John Salih there, Marty West, Don Saylor, and Ruth Asmans for a couple of years followed by John Polis. And they were all good people. We worked together and we were able to work as a team. The story that I tell all the time, so might have heard this before, is that although I was elected when I was the Republican Party's county chairman here in Yolo County and people thought, oh, what have we done? It's a crazy conservative. On most issues, I would say I was not actually the most conservative on that particular issue. We had instances where other members were more fiscally conservative or at least tighter with money, other cases where other members were a lot stricter with discipline. And in fact, I think if I had had to live under the rules that we were trying to enforce on our students, I never would have made it through high school. Different time, but you serve with good people. I got to be the third vote on quite a few, three, two votes because you get five people together and you never always agree on everything. It doesn't matter what the party label is. People come to an issue with their own experience and their own opinions. Well there is one issue that particularly motivated you to put your hat in the ring and that's measure P. So why don't you talk about measure P? Well, measure P really is about water rates because after we went through the measure I election and it became obvious that the city was going to go ahead with a surface water project whether it's a good idea or not, we're not going to re-debate that. Then it was the council's job to figure out how they were going to pay for the water project which is extremely expensive. And they came up with a rate system that put a disproportionate amount of the burden on to single family homeowners. And in fact we're going to look at situations if people didn't cut back on water use. If they still used the same amount of water that they had been using as they were going into the measure I or right at the time of measure I, city service bills might be approaching $3,000 for many of those people and that's annually by 2018 when we actually get to the rates that the council has established. The council was I guess politically astute but at the same time I think we're kind of hiding the P on the cost because they actually borrowed money up front to keep the rates down and then slowly raise the rates over a period of time that makes it difficult to argue that rates aren't out of control because in the short term they're being held down with borrowed money whereas in the long term they're going to go up very rapidly starting next year. So how important is P in terms of the future of the city as far as you're concerned? Well I think if the city were to continue to go on the same trajectory that has been headed with water rates and increases in other city service rates and increases in taxes, it's not just measure O and the city is already shopping around a parcel tax for November which they believe is needed for roads. The same time the school district has its variety of parcel taxes. My belief is that this is going to price out of town our middle income residents and those are largely the people that have children and families along with fixed income residents. It's going to change the character of the town in ways that I don't want to see. So if P were to pass, what impact would that have? Well unfortunately I can't promise that rates aren't going to go up because we have to pay for the water project. But what we can do is structure the rates so that the cost of the water project is more fairly apportioned among our residents so that we don't drive our single family homeowners out of town. So who would absorb that increment of increased cuts? Well in my view the way the rates are structured now is that primarily renters and people in apartments and in particular people who aren't in town during the summer would be paying a disproportionately smaller part of the cost of the project than I would say is fair. So we are going to be looking at people who are renters paying more. If measure P passes. If measure P passes and then the board redows the rates in a way that I would say equalizes the amount we pay per gallon of water. Anything else you want to say on measure P or the water project? I think measure P is very important to pass. Like I said we don't want to re-argue the water project. Well I think you do want to re-argue but you're not going to. Well it doesn't provide any benefit. It's not an issue at this point. It's not good for the community. I do want to point out however how fortunate we are in our current drought to still be primarily reliant, not fully reliant on groundwater because that buffers our water supply at least over a year or two against the kind of drought that we're suffering right now while other communities are going to be severely impacted by a lack of water. We aren't. So the idea of moving away from groundwater to surface water has some real downsides as well as upsides for surface water. So this year if we were under, if it was five, if five years from now we're in this current climactic situation, what would Davis' priority be in terms of access to the groundwater that we're counting on? We'd still be in better shape because what you're assuming is that we have a drought like we're having this year and it continues. There will be almost no surface water in five years. Groundwater would become more of a problem because it wouldn't be replenished. What we're doing is we're sitting on top of a reservoir. Unless that reservoir can fill up, all we're doing is drawing it down. And that is not a good situation either. Certainly we would be in a very... World of hurt. I don't want to call it a world of hurt, but we would certainly be working to conserve to a lot greater degree than is necessary at the moment. Or that we're willing to even consider. Well, some people are considering an awful lot of conservation right now, which is another problem with the rates that the council has established. The rates are put together assuming that a certain volume of water is actually going to be used, and that's the volume of water that gets paid for. If people conserve more than what the council has assumed, then the demand for water is going to drop and the amount of water that is sold by the city is going to decline. But the fixed costs, particularly these huge new fixed costs that we've taken on for the water project, aren't going away. So we're going to have to up the rates in order to pay the fixed costs. To generate the revenue that's been budgeted. Not just budgeted, that is due. Well, it's that catch-22 that the government is, according to 218 and whatever, that the government's required to only charge you what it actually costs, but they can't charge you for costs that somebody else didn't get captured. So you never get to 100% no matter what. Well, I don't actually follow that as being true because there are surpluses built up in the enterprise funds. So if you're running a surplus, you have to be at least caught up. Right, right. Well, I'm arguing for caught up. I'm not arguing for having a... You have to be conservative in the way that you do it to try to ensure that you don't end up short. You know, I gotta tell you, my current model for most things in life is a bladder. It's like two-thirds full to one-third full. I mean, when we live in an urban society, it's really an organic thing. And we need to think about ways that the limits are maximized. I'm getting off-field enough that I'll get in trouble. So there are other financial problems that the city of Davis is not doing a very good job with. What's your opinion about how to become more in control of the financial future of the city? I think getting control of the financial future of the city needs to start with actually figuring out what the city's revenues are, what they can be used for, and what its real spending and expenditure needs are. I get in some trouble with this when I talk to people because everybody wants a quick answer. And I don't think there are quick answers for where the city is, because we haven't done the work of figuring out where the holes are between revenue and spending. We need to go through the process of finding those holes, and then we can talk about whether these are holes we want to fill or whether we want to reduce the actual services that are being provided in that area. But I really think it's extremely important that we be able to have an open conversation with the community about that. One of the issues when I first came on the school board was a very large lack of trust between the employees, the public in general, and what was going on with the schools because it seemed like we would go through a process of doing negotiations for salaries or other spending, and then find money. And it's like there were hidden pots. Everybody thought there were hidden pots. And so one of the first things that we did as a new board when I came on, along with Marty and Joan was elected, was to open the books. And so everybody could see what the schools had in the way of revenue and what we had in the way of spending. And then we could have a rational conversation about compensation. I think we need to do exactly the same thing with the city. Now the city is more complicated. Schools are focused on educating our children. And that's their reason for being. And whatever else happens in the school setting is really designed for that. Now the city has lots of different activities that it's in charge of that are different. I mean everything from what we were talking about, which is water service and garbage pickup service, those kinds of services to parks and recreation and other kinds of services that are very different. So the city is a much more complicated setting. So it's not going to be a straightforward to open the budget, but it has to be done. Because if we're going to seriously talk about balancing a budget that's at least $5 million in the red and probably more because that doesn't really account for the long-term needs for pensions and health care and road maintenance, we're going to have to have the trust of the people that what we're doing and what we're asking of them has a real purpose. Something that they can understand. This idea that we can have a budget proposed and a red flag run up that, gee, we've got a $5 million budget deficit. Well why? What's causing that? Well I don't know, but revenues are $5 million short of spending. It's a bad way to do business in my mind. So at the risk of being facetious, that's called the budget process. Well that's the budget process I would envision if I didn't like it. I just want to say that five years ago I was on the Business and Economic Development Commission and I became the liaison to the Finance and Budget Commission and I read the budget. And the narrative in the budget hadn't been changed in the last five years. The numbers had been changed by the departments but nobody had actually read the budget. So I'm just telling you that we're in a similar circumstance now where people know what their part is but nobody's looked at the whole. We're in a transition now to a new city manager and it's a key point in time where everybody should be getting on the same page. I'll agree. City manager is going to be a key decision because our current city manager has gone on to other opportunities. The council is in the process of bringing in an interim manager so the next council, whether I'm on it or whoever's elected, is going to have the job of hiring a new city manager which is one of the most important things that a council does. As I see it, the role of the city manager is really to work with the council as we develop whatever the priorities for spending are going to be or any other program priority. And then it's the job of the city manager to implement that through the staff. I found it to be extremely important on the school board that you not be reaching past the superintendent because that undermines their ability to work with the staff. But on the other hand, you have to trust your city manager or your top executive, whatever the title may be, to actually implement the priorities that they're given. They can't come in with their own agenda, so to speak and kind of set the elected body over here while they pursue it. Won't work. I look at it like this where the manager is the interface between the staff and the governing body. The governing body needs to be holding the manager accountable and the manager's job is to make the staff do the day-to-day operations that are supposed to be done. In the school culture, there's a real strong relationship between the superintendent and each member of the board of trustees. They meet on a regular basis. I'm not sure if it's that comfortable with the city council. What kind of factors do you want to have in the city manager? I think I already pretty well described it. I know I did a great job of not asking the question and you answered it because I did such a great job. I really want a manager who will be responsive to the priorities of the council and will be looking to the council for direction at the same time that they know that they're in charge of getting it done with the staff. In case you didn't get the question the first time, that's the thumbnail answer. Parks and Recreation is a great example of joint use between the city and the school district. Where do you see Parks and Recreation going in the next five or ten years? I really think we need to go through the budget process to figure out what their current activities are and how they're being supported. I know that there's a multitude of special interest groups because a special interest group isn't just somebody who's out to get money from the city. They're also the people that are taking services from the city. Everything from swim teams to intramural sports teams or intramural sports that relies on the city to provide the setting for their activities and the support. I think we need to figure out how we can continue those services but yet have the city fiscally sound. A point I think I really want to make while we have the chance here is that a city going broke is not a city that is able to provide the kind of services that the community wants. If we go through a budget process that identifies holes whether they're in Parks and Recreation or whether they're in our streets which I think we can see with our eyes the question is going to be what do we do to fill those holes? That's the conversation that we have to have with the community to tell us what they're willing to provide if we truly don't have the revenue to continue a particular activity or service. That might be taxes, it might be fees but I don't think we can go there until we're able to have that conversation and we have the trust. To a certain extent that was a loaded question because Parks and Rec is the ultimate special interest group. I know that people that are taking advantage of the services can be very vocal. They've benefited from the services. I've been there in the past so it's not like this is foreign to me. Sure. What about law enforcement? What about fire and safety? How do you give people a sense of what your priorities are? I really think you start from the bottom up and you ask why does a city exist? What is the purpose of having a city government? Of course two of the primary purposes are law enforcement which protects us from each other so to speak and our fire protection and other kinds of emergency services that helps keep us whole when bad things happen. They are essential. We always make decisions about how much are we willing to spend to be how safe but certainly those are two of the primary functions of the city. You can't ignore them and they need to be there. So why should people vote for you? I think I have the skills to help solve some of the big problems that the city is facing both financially and structurally. I do know something about roads. I have an engineering background to go along with my soil and water science background so that I can speak to things that other council members whose backgrounds are perhaps in the legal area or the medical profession don't have the same experience. It's what I was talking about the team. When I was on the school board I was able to bring certain things. Other people brought other things and together I think we made a better package. I want to thank you for being on our show. Well thank you. For sure. This is what's going on. I want to tell you a secret which is that I'm voting for Rochelle and John Munn and I hope you vote on June the 3rd. Thanks for watching. This is what's going on. Good evening.


This is Think Tech Hawaii, Community Matters here. Okay, we're here. Global Connections, the four o'clock clock here in Hawaii, and we're talking by Zoom to our old friend, a student in Varanasi, India, Karnaki Mishra. It's nice to talk to you, Karnaki. Welcome back to the show. You're looking great. Yes, that's great. It's a long time, I guess. I'm glad we're together again. So you're a student. You're in the third year at a college in Varanasi, India, which is 350 kilometers from the northern border of India in the east. So what's the name of your school, your college? My college name is School of Management Sciences Varanasi. Okay, okay. And so you have, what, a year and a half to go, and you'll be graduated? Six months only. Oh, okay. Oh, that's terrific. So when you graduate with your business degree, you said you were going to take a graduate program. Where would that be? I think it's upon the exams if I qualify to graduate in different colleges, I guess. I will do my master's. Okay, do you mind sharing your grades with us, Karnaki? I imagine you have very good grades. It's fine, I guess. I have to wait for the results of the qualifying exam. Oh, we have to take an exam. Okay. So we don't know what's going to happen until you take the exam. Is the exam hard? Yes, definitely there. Is it business or is it all your college courses? It's business. It's business. Two years business courses, the MBA. And just to get the flavor of your career going forward. So after you take your master's, what's the plan then? Do you have a business plan in mind? Definitely not sure right now, but I will try to work for a private company first and then I will try, if I turn someone, I will invest in different things. Would you stay in India or try to go to another place? I will try to stay in India. So what is your long-term mission to make a lot of money or to do good? Both of them, because it's necessary in today's world. Touche. Okay, let's talk about the subject you had in mind and that's the G20 not too long ago with Buenos Aires. Mr. Modi was there, Donald Trump was there and the representative, the Prime Minister of Japan were there, Abe. And the three of them got together and then you have the JAI, Japan, America and India. What's so special about that? This is a trial action summit which took place around the sidelines of the G20. And this summit was special because it was focusing on the China and the South China Sea or the Indo-Pacific region that these three democratic nations cooperate with each other and maintain an independent free trade in this Indian Ocean and the Pacific Ocean. And the key center was how to help the prosperity of all the nations in that particular period. So what's the state of trade between the members of JAI, Japan, America and India? Are you having tariffs? Is Japan having tariffs with you? Is it a free trade group of three? What's the state of trade between you? It's not a free trade between any of these three nations. We are having surplus with United States by a few billion. In Japan, we trade largely in their side with surplus with Japan. So it's a mixed trade. We have few advantages with United States and we have few disadvantages with Japan. So it's a mixed trade, I guess. You sent me a video which I'm afraid we really can't play because it's probably copyrighted into a station in India. And so I'd like you to just describe, if you would, what's in that video because it seemed to me that in that video we had a lot of footage of Japan, Abe, America, Trump and India, Modi together. They seemed very friendly. So tell me what was going on there in that video. That's interesting because it is the first time this trilateral summit is happening on any international stage. First time Japan, United States and India is coming together in such an informal or formal meeting, whatever you call it, for the various global issues because these nations are cooperating in various key areas and this will develop in the future. I would like to tell you that Japan, America and India also cooperating in the Malabar exercises, naval exercises especially. So this is the kind of expansion of that Malabar exercises you can see. So as far as India is concerned, that was a notable connection with Donald Trump and America, likewise with Japan. Is that group of three important to India's business and geopolitical relationships, that group of three? Yes, definitely. This particular group of nations promotes all the ideas of democracy in this region because in South China there are issues regarding China and China is being oppressive in that region. Three nations are acting as a balance against China in that region. India is going with influences in the Indian Ocean and with Japan and United States we will promote the trade and free, I would say, transportation and all the trade which are taking through that region is very important for us. I noticed that the JAI, it's not JAIC. Why is there no C on JAI? Why didn't Xi Jinping, why wasn't he in the video? Because it's like to come to China so that's why Xi is not involved. China is definitely the target of the video. Let's talk about relationships between these countries. I'm very curious to know how much you have been following Donald Trump's adventures here in the United States and how the Indian people feel about him. In the United States you must know things are very polarized and a lot of people don't like him at all and his base, they call it his base which is roughly 30% of the electorate like him a lot no matter what he does. I just wonder how you react. When we spoke about this before you mentioned to me that the Indian people they are attracted to Trump because Trump is a strong leader and I wonder how that's going now. Is it still the same? It's still the same. There are so many people who support Trump in India because Trump has taken some decisive decisions regarding China and Pakistan. He has shown his concern about these two nations and these two are the primary concerns for the Indian geopolitics and that's the reason India sees opportunities in Trump. Though there are some differences regarding trade with Donald Trump to the surplus we are having with the U.S. So he wants to reduce that surplus and bring the balance of trade with China also, with India also, with China I think the surplus of trade is around $250 billion and he's planning to increase the tariffs from 10% to 25% on those particular goods. Well okay so let me break it down a little bit there have been so much news and so much chaos I mean for example without discussing it with his military staff he took all the troops out of Syria you know about this and he took all the troops out of Afghanistan. What do you think about that? India is not that far from Central Asia not that far from the Middle East and that may have a destabilizing effect on the Middle East and I wonder what India, what you think about his actions in that regard? Firstly I would like to say Donald Trump thought as an American for the American soldiers he was not thinking about the geopolitical perspectives of this thing he took simply out the soldiers who were purpose-less in the Middle East because this fight with ISIS went wrong I guess the civil war was involved in Syria many other things were happening Russia was involved so I think it was a good decision other powers will remain in the Western Middle East I guess Russia will remain United States may move out of Syria but I guess it's definitely a good thing that soldiers move out of Syria because they were also losing their lives I guess What about some of the other things? He wants to build a wall I'm sure everybody in India knows about the wall and certainly the government is already in a shutdown because of an argument about whether the Congress will pay for the wall or not pay for the wall and the wall is all about immigration policy the wall is all about keeping Mexican asylum seekers and others out of the United States and Trump has consistently tried to avoid any entries limiting entries from any source and India has been a great source of immigrants to the United States there are millions of Indians here and they have done very well I'm sure you know in the United States they are an essential part of our immigration in general so how do you feel about Trump's policies on immigration? Basically what Trump is doing is he is stopping the illegal immigration from the side of Mexico because many of the criminals and other people as he said in his elections that he will make a wall and Mexico will pay for the wall that was his whole motive during the elections of the US so I feel that his approach is against the illegal immigration which is happening in the US and he is not against the legal immigration which is taking place and though he is hard on that also he is a bit against all the immigration policies I believe that and this Indian employees are still working in the United States though the terms have been difficult I think Karnaki we are going to take a short break and we will try to reconnect with you on Zoom and then we will be right back to talk further with Karnaki Mishra a student in Varanasi, India about various things that have happened there and the connection of India with the United States and other countries we will be right back so there was no woman who lived in a shoe she had so many children she didn't know what to do she gave them some broth without any bread and she shared her education with the United States and she was amazing it was a great experience it was a great experience it was a great experience I think that and kiss them all soundly and put them to bed. Hunger is a story we can end. End it at feedingamerica.org. Okay, we're back. We're connected with Khartakee Mishra in Varanasi, India. And we're talking about various points of contact between India and the United States and other contacts it has around the world, emanating from and relative to the G20 and other things. So let's go through the JAI a little more. Japan, how are India relations with Japan right now? Japan's a democracy.  You have an affinity for democracies because you're proud of being a democracy. Yay! So how is your relationship with Japan? With Japan we share an excellent relationship, I believe. I certainly believe that. Japan is a nation in Asia which is a free strategic ally for India. And Japan also gives that status to India, that privilege to India, being a very good partner and ally in Asia. And that's the belief of both the countries that these two democratic nations should cooperate with each other in all the key areas, trade, military and many other multiple fields of innovation and technology. And we are working closely with Japan. Japan's Prime Minister also visited Varanasi in 2015. He was on a visit with Prime Minister Modi in Varanasi. And we are having a very good overall relation with Japan. That's great. Okay. Are you trading with Japan? I mean, you have a serious trade connection with Japan? Yes, we definitely have a very good trade with Japan. And the circle is with Japan in this case. What are you trading? Are you trading high-tech equipment? Are you trading commodities? Both. We trade in raw materials, food products, technology. All these various fields in which we trade is possible. We are trading in Japan. Now, what about China? China, you know, it's clear that China is turning to more repressive government. I read just yesterday that they put rules on Christmas trees, Christmas trees, and Christmas lights and decorations. And in some parts of China, it's criminal to have a Christmas tree or a Christmas light and decoration. And there's all kinds of stories and news reports about how China is cracking down, that Xi Jinping wants control, much more control. And he, of course, is now the president for another term and more powerful. And he gets what he wants. And so, you know, if I were in India and I would say, gee, that's not very democratic of him. India doesn't have those kind of oppressive things happen. How does India feel about China's current direction? Two things I would like to add. Firstly, all these financial terms and terms of development, China has been going in 78. In 70 years, China developed rapidly and is far ahead of India. And that's what I believe. In terms of development, they have this way, exceptionally well. And there will be no second China. That's the thing the Indians admire about China. Secondly, being on, coming to the oppressive terms, yes, China has some policies regarding its own people and other issues, like we talked about the Christmas tree. I recently heard about the news in the U.S. that, regarding Tibet, some fireside and executive order that until and unless China provides the access of U.S. media personnel since Tibet will not allow the media personnel of China in U.S. identity. And that's the whole approach. There are areas in which we cooperate with China and there are areas we do not. And we do not share the beliefs of China. Well, okay. But things are, generally speaking, friendly between you and China then. Yes, they are. So let me go back to the G20 for a minute. So we have the JAI and we have Japan and America and India, you know, in this video you said, and they are very friendly. But question is, did they cut a deal? Did they make an agreement of any kind? Or is it just a matter of handshakes? It was a kind of a meeting. It was not something which we led to a declaration or a definite conclusion. It was just a meeting between the three great nations for the very first time. And that was historic in its time, I believe.  We had the informal BRICS summit at the G20. Brazil was there, Russia was there, India was there, China was there, South Africa was there. So we had a BRICS summit with China. We had a BRIC meeting with China, what we call Russia today. And China meeting which took place after the gap of 12 years. So India is on good terms with China as well and the United States as well. Well, you know, one of the players at G20 was Russia. Vladimir Putin came around. And Russia is a subject of a lot of investigations now. I'm sure you know in the United States. And Russia is playing geopolitical strategies in the Middle East and elsewhere and trying to re-emerge as a global power and trying to expand its influence in many places. Now I wonder how that plays with India because Russia is really not a democratic country. I wonder how people in India feel about that and whether they see Russia as a threat to Indian interests. That's very interesting. Let me begin with brief history of Russia and India relations. India got its dependence in 1947 and it's 2018 we have completed 70 years of our independence. And we have been on very good terms with Russia far much better than the United States. And this year, India was really close to the USSR till 1991. We've had different projects with the USSR, different deals with the USSR. We've had weapons being supplied from the USSR. So India was a very good nation as a great partner for Russia and it's now also India is having a very big deal with Russia. We had the S-400 deal which was worth around 5 billion US dollar and Donald Trump put sanctions on that deal. He said that whoever trades with Russia, the United States will implement a sanction on these nations. India took the deal, India did the deal with Russia and the United States did not put the sanctions on India and commented that these relations of India with Russia are strategic in nature and the United States will not harm the strategic interests of its allies in the Asia. So I know it's hard to answer this but so you have China vying for India's attention to do business and making loans and investments in Indian projects. You have Russia the same thing and you have the U.S. I believe although it's questionable with Trump he's different. The U.S. but traditionally wants to stay close and have a close business relationship with India. After all we have so many people who are connected with India. Which one is the biggest deal? Which one is investing more and developing more and doing more business? Do you have a feeling about the order of magnitude? Yes, personally there are stages of trade, different levels of trade with different nations. I guess China is the largest trading partner of India in Asia and on global terms also. We have 100 billion dollars of trade with China, surplus lying in favor of China and that's the key issue with India and China. India wants to reduce that deficit of trade which is lying in their favor. Russia will mostly have a deal with them in weapons. We have a deal with them in resources, minerals, natural gas, various projects are there with Russia. And with the United States we are dealing with weapons, IP sector and a few other things. So if I have to give a rank to these nations, first would be China and second would be United States, third would be Russia. Interesting. So Mr. Modi was certainly an important player at G20. It was clear in the video that he's a heavy hitter. He was there and he was making traction there. It seemed to me from watching it. And I wondered how he's doing politically in India these days. You mentioned that there are national elections in May. How does it look for him? What's upon a time when we started speaking actually, you were telling me he was pretty popular. Is he still as popular today or have things changed, Karnaki? Things have changed for Modi. There were elections in state elections, what we were like have federal elections in the United States, similar to that. So he got defeated in three states by the corporate party and in other two states by the regional party. So on the state level or the federal level what he called, the performance of his party has not been good. Certainly he'll be having such influence on international politics and on different levels of the areas of government. He has a chance that he will be with such competition with the allies in 2019. So it will be one of the most interesting elections as for the Indian interest and thinking over things in mind. The alliance, I guess around 20 to 25 parties will make an alliance against the BJP or the Indian government whom Modi belongs. So who is running against him, you think? Is it clear? Is the field determined already about who is going to be running against him in May for Premier? That's a very interesting question. I'd like to add these alliance for 25 parties have not decided and needed. They have not focused on a particular leader that who would be the finalist after if they win the election. So that's the whole confusion about which person from which party will be the leader of the alliance because they have different interests, different beliefs, different ideologies and they are working totally against one focus that somehow or the other they have to defeat the Prime Minister Modi. That's their whole huge issue. They do not have any ideology behind or development plan behind. Their sole focus is to defeat Modi in 2019. So that's a very big issue that they have not decided a leader yet. In terms of progress, how would you say people see his achievements? How is he done by the economy? How is he done by relations with other countries? How is he done in advancing his initiatives? I remember, for example, when we spoke earlier, you told me that he had changed the currency arrangements so that to discourage the use of cash. That was unpopular at first, but it seems like people got used to it and so it may not be a negative politically for him now. Tell me about how people see his level of achievement and popularity these days. Okay. When Modi got in power in 2014 and Modi now in 2018, late 2018, we are moving towards 2019, his popularity has been definitely reduced by some of the decisions made by the government. So may they have a chart that says 50-50 kind of 50 person favoring the decision, 50 person not favoring the decision. So it is a kind of mixed feeling about him that people were having much more expectations from Prime Minister Modi when he came to power and those expectations were, I would say, different from reality, what he performed, the actual performance, and the expected performance added to it. And that seems to issue that Modi is facing this crisis in India. How is the economy these days? The economy is just trying, the growth rates are stable, but people from the alliance, as I said, were opposing few of his decisions, few of his views which he did. Overall, the economy is performing good. There are no doubts about it. We have good rates. But on the ground level, there are issues which people are talking about, but issues should be taken by the government. Excuse me. I remember also that in the time you and I have talked, there were various scandals about people, about men raping women on buses and doing misogynistic things. Is that still going on or has that been dealt with? That's the issue that has been dealt with, I guess. And these crimes are something which are in society. These crimes can't be stopped by one particular government. Like crimes do take place in the society. Kinds do happen in the United States. Kinds do happen in India. It's difficult to stop them for one particular person or one particular government. Things happen, but there are decisions. There are laws against it, and people are trying their best to stop suggesting these. Have there been prosecutions and convictions? Yes, they have. One last thing is, we're almost out of time, but I'd like to ask you, we're here in the U.S. We're about to celebrate Christmas this weekend. I don't know if you celebrate Christmas that much in India, but then the weekend after that, we're going to have our New Year's, and I guess you do celebrate New Year's. And I wonder what your thoughts are about how things are going to be for India and for India's partners in the global community into next year. I'd also like to know how you see your own future next year. My answer is that our dreams are taking place in India. People are hoping for the best in 2019. And government is also taking decisions that will help them in that next year because the elections will be there. So I feel that things are moving forward, and it just depends upon time, how things will progress for India and for the international politics as well. So in the U.S., around this time of year, we take time off, Kartike. We don't go to school. We don't work. The offices are closed. And this year, the government's going to be closed pretty well because we've had to shut down already. But I wonder if you're going to take any time off. And if you are for the holiday here at the end of the year, what are you going to do with that time? I am celebrating holidays. My holidays are currently running. I would like to say that my college exam ended on the 15th of December. And I'm celebrating the holidays. There will be holidays for Christmas. There will be holidays for New Year's. And we celebrate Christmas in Varanasi as we are. A three-day fair or a first place at the church is Varanasi. It's very interesting. I only have one last question. It just occurs to me now, Kartike. Do you think there's ever a time for you in India you might run for office? It does depend. If I run for office, if I become the prime minister, I will definitely visit Hawaii. Okay, well, if you run for office and you win for office, will you still talk to us? Definitely. I will visit Hawaii. Okay. Diplomatic relations with Hawaii. Well, I hope we can talk to you in January and catch up with you on whatever issues are relevant at the time. Thank you, Kartike. Kartike Mishra, a student in Varanasi, India. We enjoyed talking to him from time to time and finding out how things are doing in school in Varanasi and in India and in India's relationships. Thank you so much, Kartike.


All right, we're staying on schedule with our next talk from Christian Paquin who is Cryptography Specialist at Microsoft talking about post quantum cryptography. So welcome All right Thank you very much Hello Montreal, it's good to be back in my hometown Open here. I live now somewhere south in the States and It's a great pleasure to come and and come talk about some recent work on the topic of post quantum cryptography if you've been in the previous talk, you know a little bit about that and my goal today is to to well my main goal is to to Have you leave with the idea that even though quantum computers might be a few years away There's some action items that the security community needs to take now to protect against quantum attacks because there's one important factor that Even though Attackers quantum hackers might be something of the future The attacks can actually happen today because data that can be captured today can be decrypted in the future So I'll be talking about that and I'm gonna illustrate my little hackers with the gnomes I don't know if you remember that if you've ever watched 20 years ago this episode from South Park and They introduced these really weird gnomes and they had a very interesting business model They would go around in people's houses and steal their underpants and then well and some Unknown and undecided fashion they had a plan to take this and make profit at the end of the day Turns out it's not a great business to be in the underpants model so Well, we'll see what's gonna happen with these guys later On a completely unrelated note 20 years ago something else happened I was studying right up the hill here at the University of Montreal in the gel bracelet lab These wonderful things that are quantum computers They were great on paper These mathematical magical properties that Philip explained that allow you with position entanglement To calculate wonderful things that are impossible to do with a conventional computer well, that was great and after my studies I needed to get a paycheck so I transitioned to a more practical a sphere of the industry became a applied cryptographer and Well now fast-forward a few years quantum computers start to look a bit more real and a bit more Not so much science fiction, but just a matter of time before they're gonna be built and they're like literally millions of dollars being poured into that a little bit more actually and now most of the world thinks that they're just a Decade away, maybe so that would be a big revolution for the feel of computing In fact, I have colleagues of Microsoft and MSR that are building the actual physical chips the physical hardware to run the quantum computing and The other side of the hall is Software team building all sorts of quantum simulation software to write even they release a plug-in this year A quantum a quantum development kit that you can plug it into visual studio and start writing quantum software So it's it's starting to feel really real and this weird machine that you see on the screen That's actually in the lab of one of our Partners in Copenhagen You know this it's very tiny little quantum chip That they're working on it requires this big machinery and needs to be cooled down to point zero for Kelvin Which is the coolest place on on on the planet. It's colder in deep space and yeah these guys really play with the coolest toys quite literally and So so that's all great and It's it's We'll revolutionize What what's gonna happen what we'll be able to do it has a tons of applications in chemistry to analyze molecular structures and come up with new compounds as a lot of applications in physics All is great. It's all great except for us security practitioners because as Philippe explained The shore algorithm totally destroys the basis for our modern cryptography So all the communications on the internet relies on this public cryptography that becomes essentially unusable if the attacker has a quantum computer and Also this this second algorithm that Grover discovered in 96 affects the the security of the symmetric cryptography the ash functions and the the symmetric encryption but We can deal with that. We just need to double the key sizes and the ash sizes. So not a big deal but okay, so just Just considering shore It basically breaks all the crypto that we use today and I Scratch the word most because you know, there were some old alternatives Back in the days that were never used never been implemented in our software but Essentially everything that we use today is gone. So that's TLS HTTPS that's signal messaging That's SSH. That's all your bitcoins gone Certificates software updates. They all rely on public e cryptography so Come the gnomes are coming back now There they'd like to adapt their business model a little bit So instead of stealing underpants what they can do now is simply collect ciphertext and just wait Just record the the internet traffic and now they have an idea for phase two They just have to wait for a quantum computer and then when they do they can just decrypt it of course It's quite an analogy, but there are a lot of adversaries That have this capability today to just you know every major country every sufficiently large organization can record Huge amount of data. So if you are working in a as a Hacker developer in a small community or in a big corporate environment The question is do you have data? That's encrypted transfer of the internet today that needs to be secure for the foreseeable future and If you do then How long is that data needs to be secure for because if There's a risk that somebody records it then decrypts later Then you might need to think about this post quantum cryptography today Not when the quantum computer comes So now it's a valid question of when is that's gonna be? Yeah, Phillips mentioned also the the the work of my M. Kelly Mosca that at a huge analysis, of course, it's to estimate the time of when this quantum computer will be it's it's a lot of guesswork there's like physicists involved in the How to build the hardware and then the mathematicians the best quantum attacks we could build with this model but there's a lot of very smart people that And then that look at the problem and they estimated you know Maybe a decade 12 years 2030 that there's a very large risk that there might be a quantum computer then so There's a clear need for the industry to move to this new type of cryptography that's post quantum cryptography and I want to make it clear here post quantum cryptography doesn't mean that you Need a quantum computer to do this cryptography That's just normal crypto that we don't know how to break with the quantum computer and There are if Okay, I'll just complete that sentence in one slide Just now the motivation of why again, I'm just to repeat a little bit of myself. Why do we care about this today? First because of this capture now the creep later problem. So data is at risk. Okay, great maybe I've convinced you of that maybe not but Second the other points are also very important If you've ever worked in a standard body before you'll you'll know that it takes a long time to change standards and get new algorithms and new designs adopted TLS 1.3 for example took you know quite a while to to go through and So if we need to update these algorithms and all these standards is gonna take a long time so we need to get started and Also, not just the the standards themselves the crypto stack also needs to be updated So all the the application libraries all the software Takes a long time and we need to know when we're gonna plug in these new algorithms Some of them will have bigger keys they have longer computational time Some assumptions are different than what we used before or elliptic curves and RSA So can the software deal with it as our code agile enough to be able to swap in RSA like how many pieces of software I've seen with just RSA are coded Directly in there and they'll be quite hard to to make a switch So these are issues that we can tackle now and start to experiment with not to be surprised when it's gonna be the time to switch And that's kind of what I hinted earlier So if you have data that needs to be secure for a long time then backtrack all these steps Then we kind of get we need to get started today Well, fortunately, this is happening in the in academia and in the industry It's recognized that we need this transition in fact NIST, which is the national standard National Institute of stances and technologies in the US that basically is the de facto standard organization of the world because most of their Standards get adopted around the planet They have started the standardization process to replace RSA note the curve public ecryptography with new algorithms We're currently in phase two round two of this multi-year process. It's gonna be six seven-year process and they're looking for all sorts of new ideas in all sorts of From all sorts of math families And round one there was 69 proposals. They're down to 26 now in round two and it's it's continuing So I Don't want to I'll go fast on this because if it represented about that, but essentially these new math proposals are not based on factoring and discrete logarithms like RSA and Diffie element where We're using instead they use lattices error correcting codes multivariate systems as base functions isogenes zero knowledge proves even My colleagues have participated in four of these proposals and they're still in round two So if you're interested you can take a look at these specific proposals Tweet out the slides afterwards, so you'll get all the links So okay, so now if you're a developer, I mean you can't deal with that It's like you just told me I need to replace RSA, but with what I don't want to I don't have I Don't know which one of the 26 proposals to pick. How do I deal with that and what if one gets? Disqualified in round three I'm stuck with that. What do I do? So One thing that that we did just asking ourselves all these same questions is to join this this group this open quantum safe project, which is an open source group With the goal of providing a unified framework for this post quantum cryptography and the idea is that Everyone with the schemes and this schemes we can plug it into this this library and Then when you want to experiment with it and integrate it into your higher level applications you just code to the We call OQS library and then if you want to try a scheme you just configure it this way and if you want to call this other scheme You just switch and gonna call psych instead of Frodo then you don't have to modify the application and Our motivation to join and do this work was to we're doing tests Implementing our algorithms in TLS and you know, we don't want to do it 50 times So do it once and then you can just switch the underlying algorithms and it's it's quite easy and Very efficient in development time so over the last Few years the OQS project kind of grew so now we have a Core library in C. We have a bunch of wrappers in C++ C sharp Java. There's some other coming and We also ship forks of a open SSL and open SSH That integrate this post quantum crypto And I'm gonna be demonstrating that in a few minutes What else is there to say there just yeah, it's a collaborative effort if you're interested And in participating and you have some expertise in some other applications you'd like to see Post quantum crypto integrated well, please reach out and and either offer here's a I've did this work And you integrate it in the project or submit pull requests Where it's a very cooperative effort and we're welcoming help from anybody Okay, now in the second part I'm gonna explain some of the integrations we did in the different protocols and You may be interested in that just as a developer or as a user if you'd like to hey, I'm using open SSL I'm using open SSH. Maybe I can try to just plug it some or use some of the post quantum variant In there to to protect myself and my services and project project, sorry products against quantum computing So Well TLS of course is Arguably the most used security protocol It's it's everywhere Open SSL is one of the main libraries implementing it. So that's why we targeted it for our experiments We've integrated in TLS 1.2 and 1.3 in two different flavors of open SSL 1.3 is really nice because the way it's architected The changes are very minimal. So we do the work in the in the key share message In TLS 1.3 the core spec that has been adopted assumes that everything is looks like elliptic curve elliptic curve Diffie Elman and the define the curves in the future is probably going to be extensions for other algorithms But right now we to integrate in this environment. We have to pretend that our post quantum algorithms are new curves so that's how we identify them in the code and We can just plug and play What's oh Yeah, so one interesting note is that we need to edge our bets right now It wouldn't be quite unsafe to just transition to a post quantum algorithm today. You don't want to do that because They've only been around for a few years. We need a decade at least of of Cryptanalysis of really deep analysis to make sure there's nothing wrong with these new ideas. Maybe There's no quantum algorithms for them because the right person hasn't looked at it For long enough or maybe there's a classical attack against these systems. So we don't know so to be safe what we want to do is Do a mix do a hybrid version between the classical Algorithms that we have today with the post quantum ones So how do you achieve that is let's say in a key exchange? In the Diffie element type of setting I'm trying to communicate with a web server So I pick a secret the web server picks a secret. We exchange a message They use a secret and then we can arrive to a common shared key that we use afterwards to protect the communication so we can do that in parallel we can have this conversation with electric curve Diffie element and Have another one in parallel with our post quantum algorithm And then we just mix the master secrets concatenate them and then that's fed into the key derivation and then we end up with a key that that depends both on the classical and post quantum one therefore if Somebody intercepts this communication decrypts it in ten years with a quantum computer. They'll be able to break the electric curve one Part but not the post quantum one because we don't know how to do that with a quantum computer And if somebody made a mistake in the design of the spec or the scheme and they break this new algorithm in five years Then our the analytic curve still protects us. So the hybrid is really The idea to to achieve that There are many subtle ways to do that and there's We're debating what's the best approach the one I describe is like the naive approach just do it in parallel and concatenate It's the easiest to implement and that's the one that we have in our fork There are some more advanced one where you can negotiate which algorithm you want And and the authentication side is also a similar ideas for the authentication and the certificate integration Again, what we've implemented is just this naive approach. We don't say we do RSA and then signature and a And a picnic for to take one Signature and mix them. We define a new algorithm. It's called RSA picnic and everything is concatenated So it's easy to to implement and integrate But there are multiple ways to think about it. You could have two certificates one classical one post quantum You can have one certificate with a post quantum extension in there. There are a lot of options So one interesting question is that okay, you want us to play in integrate post quantum In our deployments. So what's the cost? Is everything is going to crawl to To slow down to a crawl there's a reason why some of these algorithms have never been adopted 30 years ago when they were first proposed because RSA was way better was way faster and smaller like the Recorrection codes are gigantic key size megabytes of Artifacts, so we don't want to deal with that. Well, fortunately the top candidates have very interesting performances For example on the left side, you have the key exchange algorithms The orange one is the our base elliptic curve P256 top of the line Efficiency and security and we see that new hope is the lattice one gets really close to it. There's number of fetches per second So it's quite competitive and the one Just above it P256 new hope is the hybrid one that I I I mentioned we do both The elliptic curve one Plus the post quantum one in one go so it doesn't double the cost because a lot of the cost is the rest of the exchange so the crypto part you don't pay a lot of a of a You don't pay a big penalty to transfer to post quantum so Very interesting To start playing with that that's certainly not a stopper the same thing for signatures basically this new crypto is is is Competitive and will in the next few years be optimized both in algorithmic Algorithically can pronounce our word sorry and in an hardware all sorts of optimizations so That's gonna be interesting SSH. We also did the work and I want to repeat myself It's a little very similar to TLS and conceptually So similar integration in the key exchange and in the authentication part So one interesting project I like to mention is another one we have it's called It's based on the open VPN project Unlike other VPN projects you that use a different Protocol this one uses TLS as its security so we can just use our open SSL fork and get the security for free in in the VPN So what's interesting is that when you start thinking about all the applications that will need to to change? Takes a lot of work dev work to do that But if you do it that the on a VPN level then you can tunnel all your classical unmodified legacy applications through a post quantum tunnel and then the adversary outside Cannot peek into the classical or even if they can break RSA they wouldn't be able to get into that post quantum tunnel so that's a very interesting model to To give a blanket protection against quantum computer without actually changing any code and deal with all sorts of services So that's something we have this one is not part of OQS is part of our Microsoft research project You can also open source you can take a look at it and gives interesting interesting thing to play with and We also integrated in the HSM Some one of our algorithms and all of these Projects are basically to show that okay it works it works in software works in hardware works in different deployments Just to get comfortable to say okay, we want to de-risk these These new algorithms so that when it's time to transition when this picks some winners and some new standards will be ready We know what breaks what doesn't break in the software. We've done the work I just want to conclude with a quick demo Let's see as it shows on the screen. Okay it's always hard to demo cryptography because you know, it's Just showing a green icon on the screen. I'm just going to show an open SSL and Maybe you're already familiar with it. If you have played with open SSL It's this is the open SSL client and server tool. So what I'm gonna do. I apologize on the small size But I'm just gonna read it to you This is I've now just generated a new certificate. That's a hybrid between ECDSA p256 with Q Tesla Which is a lattice signature scheme and the main point here is that that is open as a cell As you know it if you know it It's nothing changes other than the algorithm identifier and now I can start a web server with this Let's go back to my history. There it is So I use the certificate and now it's waiting for a TLS 1.3 connections and I'm gonna connect from this other console This is by the way a Windows subsystem for Linux that I use which is awesome. If you don't know it I recommend you do it I'm going to in a box right here and then Well, this is the boring demo just a bunch of letters no errors and it spits out the certificate And then you can see If you have really good eyes that I'm using here you see the SA Q Tesla one signature and the key exchange with p256 e CDH E plus Frodo So I've kind of decided so I'm gonna go with lattices for this key exchange the lattice scheme signature is the lattice scheme and then This is secure because the curves are secure and then if you have a quantum computer in 10 years and you've recorded that then you wouldn't still not be able to decrypt it because the lattice schemes are unbreakable with a quantum computer and That is it for the presentation So the main point is that okay quantum computers are gonna come in 10 20 50 years who knows As security practitioners, we need to be safe and assume the worst it might come sooner than later We need to be prepared and that you need to start thinking about the transition today. So maybe you're Thinking is just I need to I'll wait when the standard comes out. I'll be ready. I don't develop any of this I'll just adopt the new software as they get updated. But if you want to be proactive and you are Dealing with with data that needs to be secure for a decade or more Then you might want to just sprinkle in says this post quantum protection on top of the classical one To make sure that you're safe against this imminent threat So I thank you for your time. I'm happy to answer any questions now or during the launch break


1. Amendment 11247.2, yn y name of Shona Robison, which seeks to amend motion 11247, in the name of Douglas Ross, on independent investigation into the First Minister and Deputy First Minister, be agreed. Members should cast their votes now. The vote is closed. The result of the vote on amendment 11247.2, in the name of Shona Robison, is yes 63, no 53. There was one abstention. The amendment is therefore agreed. The next question is that amendment 11247.1, in the name of Anna Sarwar, which seeks to amend motion 11247, in the name of Douglas Ross, on independent investigation into the First Minister and Deputy First Minister, be agreed. Are we all agreed? The Parliament is not agreed. Therefore, we will move to a vote and members should cast their votes now. The vote is closed. Point of order, Monica Lennon. I couldn't connect. I would have voted yes. Thank you, Ms Lennon. We'll ensure that's recorded. The result of the vote on amendment 11247.1, in the name of Anna Sarwar, is yes 53, no 64. There were no abstentions. The amendment is therefore not agreed. The next question is that motion 11247, in the name of Douglas Ross, as amended, on independent investigation into the First Minister and Deputy First Minister, be agreed. Are we all agreed? The Parliament is not agreed. Therefore, we'll move to a vote and members should cast their votes now. The vote is closed. I call Monica Lennon for a point of order. Thank you. I was unable to connect. I would have voted no. Thank you, Ms Lennon. We'll ensure that's recorded. The result of the vote on motion 11247, in the name of Douglas Ross, as amended, is yes 62, no 54. There was one abstention. The motion as amended is therefore agreed. The next question is that motion 11262, in the name of George Adam, on behalf of the parliamentary bureau, on approval of an SSI, be agreed. Are we all agreed? The Parliament is not agreed. Therefore, we'll move to a vote and members should cast their votes now. The vote is closed. The result of the vote on motion 11262, in the name of George Adam, is yes 64, no 53. There were no abstentions. The motion is therefore agreed. The next question is that motion 11264, in the name of George Adam, on behalf of the parliamentary bureau, on designation of a lead committee, be agreed. Are we all agreed? The motion is therefore agreed. I propose to ask a single question on four parliamentary bureau motions. Does any member object? No member objects, therefore. The final question is that motions 11261, on approval of an SSI, 11263, on approval of an SSI, 11265, on committee substitutes, and 11266, on recess dates, in the name of George Adam, on behalf of the parliamentary bureau, be agreed. Are we all agreed? We are. The motions are therefore agreed, and that concludes decision time, and we will move on to members' business in the name of Willie Coffey.


Hi everyone welcome to one of the last sessions of the day. I Know you guys must be exhausted by now. You know, it's normal even two two days of Pretty I think for you like attending a lot of sessions, right? so I Will try to keep this interesting and conversational So the topic of my presentation like first a little bit of myself. My name is a sort of bad. I'm a Senior solutions engineer at upticks. You might have seen me in one of the booths So the topic of my presentation is security that enables Breaking down security silos in the DevOps ecosystem. So what do we mean by security that enables? so any CICD pipeline right or as I like to call it innovation pipeline it consists consists of Different components working together And in the end the developers aim is to release code at a really fast pace and You know like they can overlook security, right? But what the ultimate aim is to Make sure that security does not hamper innovation. That's why the name security that enables So it basically enables the developers to be successful It enables the security team to be successful as well as the operations team. There is there has always been friction between No security and developers. So we make we want to make sure that there is that goes away So here's the agenda of my presentation like first would be introduction second why are we seeing attacks on The CICD ecosystem, right? What do the attackers see when they look at your pipeline? Next would be security gaps in a traditional pipeline with so many You know, very with various tools working together. You have your build tools repositories your containers It's it's only like logical dark, you know, like security gaps Can't keep in whether they are vulnerabilities whether they are Oversights so we will look at how and why like security gaps get Become a part of the traditional CICD pipeline Then I would like to go through the Dropbox breach That's one of the latest ones that comes to mind. You have like the circle see I as a one-two When we say when we talk about attacks on a developer ecosystem, right? On the left hand side, you see one of the examples the last pass attack then you have the slack Breach and the Dropbox breach so I'll break down What exactly happened and what are the lessons learned and in the last I would be covering enabling dev and security teams to work together to create a successful Working software in the cloud which is secure Now I'll go through like why has there been a rise on the developer ecosystem CICD ecosystem The first one being lot lack of integrated and automated security testing tools You have when you see your CICD pipeline you see Your developers laptop you see code repositories. Then you have image repositories on your containers in production so many different Components are working together, right? So there is overall a lack of integrated and automated security for these tools and All these different components make for a large attack surface. So the attacker just needs to enter just in One particular stage, right? And then he can go like for example If an if an attacker enters and gets hold off access keys Which which were exposed by the developer like the developer wants to be make a code of really fast He has admin access to systems just to make his life easier, you know, hard codes the keys the passwords If an attacker gets hold of those credentials, then no like, you know, you have seen examples of Dropbox, you know, what exactly can happen? He can get access to those crown jewels in a CICD pipeline Your code is getting built, right? It's it's something which is kind of the Like a crown jewel for your organization, right? And then you have The reliance on automation Leads to complacency. It's just human nature. If anything is getting automated, you know, why care you have Automated driving cars right now. So reliance on automation leads to oversight Vulnerabilities that would have crept in No one even paid attention to them So we have to make sure that each and every stage of the CHD pipeline is actually being monitored audited And if something creeps in right at the first which is shift left, you know, like the developers laptop We need to make sure that it's getting fixed as soon as we discover that So Here you can I've just mentioned up the developer Breaches that happened recently. You have the last pass attack the slack One where the employee get help tokens was stolen and the circle CI one where the authenticated session keys was stolen So this is different from the Dropbox one. So in Dropbox, it was actually a circle CI imitation, but in In this case, it's actually that an attack that happened That targeted circle CI organization. So what are the security gaps in the CI CD pipeline? So Why do the security gaps keep creep in your CI CD ecosystem? So CI CD is a term which has become a household name but organizations Like are still not an expert in CI CD. So probably like four to five percent might claim Okay, we have got a hold of CI CD, but still there is unrealized potential for CI CD adoption System as such the whole pipeline hinges on various dependencies and configurations. So developers use a lot of third-party libraries and So having such a diverse Set of tools working together, right? There are dependencies configurations and because of that vulnerabilities might creep in The last being haste and need for fast-paced delivery cycles So in an agile environment that developers want to just write code commit it and release the application But then again as I mentioned, they overlook security It should not be like Like obviously the end goal is having a working software, but security is also important So because of the hastiness and the fast-paced nature of the agile development developers tend to overlook security which comes on which gets discovered what exactly was left unpatched when the workload is actually in production. So This is a traditional securing like CI CD pipeline So just to recap what I've covered till now like I covered why are we seeing Attacks on the developer ecosystem why security gaps creep in And this is like if you pay attention to this image, it's a lot of things are going on You have your development stage, you know code is being developed It's been committed to a code repo like you know GitHub and then you have your building and testing tools The images that are getting built are being applied to registries, right and then Those containers are running in production having some kind of orchestration such as Kubernetes OpenShift So I would like to call the development and CI CD pipeline piece as pre-production and control plane and data plane as post production So let's focus on Post production right when the workloads are actually running You will see that it consists of different services such as orchestration Runtime such as Docker engine and then you have the actual worker nodes running those containers From a security perspective, right this data is pretty siloed Like take for example container escape So containers when they are deployed they just widen the attack surface They share the same underlying IP space So even if an attacker escapes one container, he will have access to the other underlying containers To the host itself and he can go deeper into your infrastructure Now if you look at the pre-production stage We silo The development stage from the building and testing stage We never focus on developer laptops right developers do the groundwork for the software development They you know, they have admin access to different tools But we never focus on developers laptop security and they don't even like that so Again coming to a from a security perspective The data that's getting generated from the developers laptop or even repositories It's pretty siloed from what exactly is happening and the building and testing phase and the registry phase So let me cover what exactly happened At you know when the Dropbox Beach occurred So This attack Highlights the fact that there have been a rise Of attacks on the developer ecosystem We all know the reason why they do the Stuff they get the stuff done build code develop develop the application In case of Dropbox what happened was If I'm a developer I logged in I saw this email from circle ci which is The tool they were using internally in Dropbox I clicked on the malicious link. I had no idea that I was doing that It took me to a fake circle ci page Asked me my github credentials and a one-time passcode Once I entered the credentials and the otp The attacker took those credentials logged into github and as a result 130 internal repos were cloned And this was no spray fishing attack. It was actually spear fishing because The developers were targeted The attackers actually knew that circle ci was being used inside Dropbox so Which shows that attackers are becoming sophisticated day by day So on this screen like this is again what I said so basically, you know, what exactly happened was It was just a sophisticated attack that could not be prevented right Logging into an invitation page Giving out your credentials and then the breach Just happened So what are the lessons learned? One thing I would like to Point out which is not on the slide is user education and training is really important Especially developers who don't Care about security much who don't Are not involved with security. So user Education and training is of utmost importance They need to know if If they see something fishy, they should reach out to the department right what exactly like we got this email But in this case, they just clicked on the link. So user education and training is really important and then This attack along with last pass lack circle ci it reinforces the trend that attackers are actually targeting the developer tools the ci CD pipeline when they Look from outside ci CD pipeline is a goldmine, right? They know that okay somewhere some vulnerability will prop up so To avoid such scenarios, right there are with like some Some of the lessons learned from the draw box breach Just regularly rotate password and set up mfa right. It's it's a simple thing And Attackers knowing that circle ci was using was being used internally Attackers are becoming more sophisticated and more familiar with environments And it's really important to scan the source code repositories or even image repositories for any credentials In the haste of just releasing an application making Making code changes committing the code you're like Even like I was a developer in past life. I never cared of you know for not hard coding the credentials So it's really important to scan your code repos as well as image repos And how do how can we enable dev and security teams to go hand in hand and have give you a secure running application in the cloud? so first What's a good and what's a bad security culture in an organization and what are the characteristics? so in a good security culture It builds trust it builds trust within the teams I am a developer I trust the security team not to hamper my innovation. I can code. I can commit the code as I like Right, but still there's trust that okay, you know, it won't hamper my innovation It simplifies access and workflows. So if I Um, if I have zero trust for example, right my machine is You know, my machine is protected I I want to access any critical applications. So based on my zero trust code, they were like, okay, this this machine is good You know, let the developer access the applications. He's requesting access to It encourages people to speak up and then It enables users to be security minded as As we learned from the draw box breach users Developers or any other person and organizations should have that level of security awareness that He can judge what's wrong and what's not On the other hand, what's a bad security culture like it roads trust people different teams don't trust each other I'm a developer. I don't trust the security team. I will always think okay. It will hamper my speed You know, let me just write code and commit it It complicates access and workflows and last It encourages users to hide their mistakes Right if I may I know I did something wrong like I left my credentials, right? But I don't care. It's already committed. The application is already running I won't even let the security team know like if there are no tools in place You know, I won't even work with the security team to make sure that I'm releasing a secure software So what are the different security solutions that enable first zero trust frameworks? That's The latest buzzword. It's it's a deviation from the traditional mindset of trust, but verify Always validate a user's integrity when accessing internal resources it means Like zero trust is like on every stage you have to authenticate and then you get authorized And similarly having a zero trust score it will differentiate good from the bad and if I'm a good user I can easily get access to internal resources Second one as I mentioned on the previous screen we should scan for vulnerabilities um In that might have crept in uh in the pshc pipeline maybe because of you know, hastiness or user overlook Then look for private keys credentials other secrets which can be stored in images which are already in Registry such as jfrog artifact re ECR and also registry code. So if you're committing committing the code to uh repo like github we should have the ability to also scan those repositories because it reduces the attack surface So again zero trust builds acts builds trust If it's a good it tells us the difference between good and the bad it simplifies access and workflows It reduces ability for lateral movement because at every step you have to authenticate Right and it empowers modern developer work culture. It means like you have your b y od policy or work from home Remote today. I'm working from Seattle tomorrow. I can be in canada, right? So having the zero trust score for a machine Can tell you like even if this person is out of his geographic area This is still a good machine because we trust this machine And similarly the second approach that we discussed about build time scanning registry scanning First it reduces the attack surface because if something is already patched the The attackers have less chances to exploit that Then it simplifies workflows it enables team to release builds, right? I'm a developer. I'm happy these These stages are secure and then it hardens the static code and the container image repose So For the conclusion, right? I would like to point out that whatever we have discussed or whatever I have presented that Developers ecosystems are being targeted The attacks are becoming sophisticated day by day. The attackers are becoming more aware of internal environments Good security enables developers to work dynamically and ship faster more secure it means Security is no longer hampering innovation. It's actually driving innovation. So good security enables developers to develop a tool a product which is actually secure and I can't you know stress this enough that dev dev and security teams Should go hand-in-hand right and they should go hand-in-hand to fix those gaps in a CI CD pipeline, which might have kept in and there are like numerous reasons you have your diverse attacks your diverse tools user oversight, you know probably like access levels like you have Admin access to tools we can you know protect this by tying down the access So dev and security teams should work hand in hand And a good security program should never hamper innovation, right?  That's where the stuff gets done So a good security program should never ever hamper that innovation So any questions? I'm open for questions No questions. I think I did well then Yeah, thank you