It works. So good morning, everyone. My name is Anurag Bhatia. I work at Hurricane Electric. Today I'll be talking about the routing security and quick introduction on the talk. So I'll give a brief background. Hurricane Electric operates a global IP backbone. So we operate a network in around 40 countries as per the last count. And a large part of this talks comes from our experiences of route filtering, implementing large-scale route filtering as well as the challenges associated with it. So to start with, you may ask yourself a question on when you are communicating between machines, when you are communicating, say, with your server, can you be sure at this point of time that the IP you are communicating with is actually the IP which belongs to your server? The stock will try to answer that and then cover that as we proceed with the talk. So I have divided the talk in four brief parts. So one is the fundamentals of the routing just to give a brief understanding of how the global routing is working before we get to the challenge of filtering. Then is the part with IRR, which is internet routing registry, then some current statistics around it, and the future of routing security. So fundamentals of global routing, internet as we all know is network of networks. They are usually taught, you know, this in school and colleges, excluding the fact that how exactly these networks are stitched together. So the logic here is all these networks are autonomous in themselves. So they have an autonomous system number, an autonomous network and it can have, it's on specific routing policy. So as of now, there are around 65,000 autonomous networks in the world and these are known by their AS numbers. So the 65,000 is the number in IPV4 world and then you have around 17,000 autonomous network in IPV6 world. Any autonomous network around you, well most of ISPs you see around you are the autonomous networks, say for Airtel or ACT or BSNL or most of the content networks including Google, Facebook. So they have control on their own routing policy, they can interconnect as per their own requirement. How these are stitched together, how you make sure that you are able to reach any location in the world, that's based on the fact that you have something called transit-free zone, which is roughly a list of around 15 ISPs and I had to use the term because it's quite abused by marketing guys, it's pure one networks. So these networks are the ones which peer with each other. So around 15 networks, they ensure that they peer with remaining 14 networks, they maintain reasonable circuits with them and all other networks in the world are essentially their customers or whether they could be a direct customer or they could be indirect customer. So when you say 65,000 autonomous networks, all of them are on direct or indirect customer of either one or more of these networks. So that's how you ensure reachability across the internet. You can find the list of autonomous networks, I think the Wikipedia has a list that is reasonably decent list, although what it signifies is the networks who do not buy IP transit, there could be separate arrangements across them and some of the networks you may be interested in. So from India, it's data communications and there's entity from Japan, you have AT&T and Verizon from US. So it's usually super large networks who have submarine assets as well as who are connecting multiple continents. It does not play that significant role in present traffic because a large part of modern traffic that flows from limited set of ASNs which are mostly the content networks towards the eyeballs. So a large part of traffic does not really go via tier one or it may be going via tier one but then there's a cash fill happening which is adding the effect. So they play an important role only on the stitching side of the internet, not essentially on the traffic side. Just an example, you may have AS1, 2, 3 connected, all of them speaking BGP which is border gate with protocol to communicate with each other. So they exchange routing tables dynamically and that's how it works. Another way to understand the global routing can be in this room, let's imagine we have a complete blackout and you want to map who is sitting where. Very simple and good practice can be, we just pass on a paper, everyone writes down what's the name of that person and who is sitting on their either side. So you may say my name is A and B is sitting on my right and the same thing is done by B, same thing is done by C and so on. Within a minute you'd have a table of who is sitting where. That's essentially how internet is working at this point of time and it works well as long as no one is faking who they are. So beyond the BGP part, the other thing is of course DNS so DNS ensures the translation. So on the core side, DNS is essentially relying on 13 root DNS servers. These are run by 12 organizations because one of them is running multiple servers and most of these organizations are there because of historical reasons and this is how you start in the DNS chain. So there are around 980 plus instances which are anycasted of these 13 root servers. So 13 is just a logical number, real number of servers is much higher. In India you'll find server in Delhi, Mumbai and Chennai with Nixie. So you have K-root in Delhi, you have F-root in Chennai, I-root in Mumbai. Plus there are a couple of other root instances as well. So there's one in Kolkata, if I remember correctly. There's another one in Chennai separately outside Nixie. So there is reasonable resilience in that infrastructure. And now again, these 13 root server IPs are hard coded in the DNS resolution software. So you need to make sure that these IPs are the ones who you're speaking to. If they are not the ones, then you have a problem. So how does trust in BGP works? And I'll get back again on the same example which I used for this room. If everyone writes who they are and who is sitting on their side, it works really well. But as soon as anyone of the person fakes, it becomes a problem. So in case of BGP you have options that's again on the fundamental side of things, you have options around filtering. So networks can filter what they learn, what they do not learn. The filtering can be based on an IP prefix. So you may say I want to learn a specific IP only from one of the peer. I do not want to learn anything else. Or I do not want to learn a specific thing and learn everything else. They can be based on AS number which is autonomous system number, as you just mentioned. And it can also be based on AS path. And with respect to filtering, it's much easier when it is implemented near to the edge. It becomes a problem as soon as you move towards the core of the internet. And you'll get an idea as we proceed with the slides on what I mean to say when you move beyond the edge. Let's take this example. You have two networks. These have AS1 which is the provider and you have blue AS2 which is the customer. Now AS2 may say I have this prefix, I have this slash 24, please route it. Please accept the announcement. AS2 would set up a BGP session with AS1, would start announcing it. Here on the AS1 side, all you need is just a simple policy. Just make sure you allow this prefix, right? It works. It becomes a problem when AS2 adds another customer, say AS3, the green customer. Now what happens to AS1? It also needs to add the customer information for AS3, right? So it quickly adds up on the internet scale. It becomes a trickier problem to solve. So if I am filtering a small network operating, say in Bangalore only with a couple of prefixes, it's very easy. But what happens if I'm trying to filter, say, someone like Airtel or someone like Tata who have multiple, multiple customers behind them? Here's some data on the AS path length. So Mr. Jeff Huston from APNIC, he did a research and he found that average AS path length is around 5.7 across the internet. What that means is on an average, you'll see as many AS paths as 5.7 ASNs away. And that's where you get the challenge. So when you have AS1, 2, 3, 4, and 5 along the chain, it's very hard now for AS1 on the corner to find what to accept from AS5. How can you have a system where, say, AS5 is communicating reliably and in some digital fashion to AS1 what it wants to do and make sure that filters are updated? So this brings up to the part on how to make sure that the route filtering works at the internet scale. And that's what brings us to the current setup, which is IRR, internet routing registries. I'll first give a brief introduction of IRR and then we'll discuss about the statistics of how is the situation with IRR at this point of time. So quick introduction. These are essentially the registers and when I say register, this is something which surprises a lot of people. Internet is still in a way on the BGP layer, acting, working as tins and cans, hanging together and just communicating. So what you have is these registers where you will say what you want to do and then you do it. There's no way for these register to authenticate you in most of the cases. And then anyone can actually look at these registers and try to verify what you are doing is actually either matching or not matching these registers. So IRR use something called RPSL, which is Routing Policy Specific Language and you define route objects here. So you say this is the route object, it contains your prefix, it contains your AS number, it contains some other information like description, et cetera. It also uses something called AS sets, which as the name describes, a set of ASNs and you can define which set of AS numbers are your customers. So that's the brief idea about the IRR. I'll show with an example. So I'm jumping the slide, sorry for that. So here you have, we are querying one of the IRR. So we are querying RADB for one of the prefixes which belongs to us. So what you get in reply is the prefix, the origin AS, you also get a description which can be just anything. You have certain other fields, including the notify, changed, maintained, et cetera. And these are the route objects which are visible in public for various networks to use digitally to generate filters. Here's an example of AS set. This is example for ACT, which is a local provider here. So we are querying again RADB for the AS-ACT. You see the member ASN. So ACT saying AS 5577, AS 131269 and so on. All these are its customers. You can also find that it's maintained by maintainer which is Beam Telecom, which I think is the older name or probably some acquisition happened in between. So that's how the AS sets are. Who runs these routing registries? Again, this comes from the historical part. So there are around 25 IRRs at this point of time. A lot of them are already dead. They are still, the database is still there, but they are not changed from almost years. And what stitches them together is just a vague syncing which is there with RADB. So RADB comes from Merit Network and that's a non-for-profit IRR. And RADB mirrors all these IRRs remaining 24 and makes that data available. So that's what brings these IRRs in picture. So you may go and run IRR on your own. The daemon is available. It's an open-source package called IRRD. So you may pick it from GitHub and you may run on your own. If you can convince RADB to mirror your database, then you can practically have an IRR which most of the networks would be using. RADB is more popular because it mirrors everyone. So it's easier for various networks to rely on RADB instead of querying all 25 of them. Besides RADB, entity is also mirroring them. So there are IRRs from large networks like entity, level three, Bell, Canada, Telstra, which got to reach and so on. So most of these assets you'll find are the transitive assets which they got as the companies went with acquisitions and so on. It's more popular right now for networks to use IRRs which are run by RIRs, regional internet registries like APNIC or EDIN. So in this region, APNIC handles these resources. So if you need IP address or AS number, you go to APNIC. So besides running the registry, these operators also run IRRs and it's common to use them because they know who they allocate an IP to. So APNIC knows that IP belongs to you. So they can give you access to create route objects and that's actually one of the reasons RIRs run IRRs are quite clean and secure. One can define which IRR one is using using the syntax. So you define RADB or APNIC, colon, colon and then the asset which you are using. Here's another example you're querying to RADB for one of the prefix. So in the bottom, you'll see the source and I think should be visible all the way to the back. So it shows you. So in this scenario, Airtel is using APNIC for maintaining its route objects. How do you generate filters with the IRR? So you have a tool called BGP Q3. There are multiple tools because these databases are open. So you can write a tool on your own. BGP Q3 is one of the popular open source tools. So you can use it to generate syntax for Cisco, Juniper. Plus it also supports a custom output like JSON output as well as, you can pretty much define any syntax you want to put for the hardware which you are using. It also supports adding the AS path in the filters and the support for IPv6 as well. Here's the BGP Q3 in action. So I queried my AS number which I use for R&D purposes for IPv6. So it just generates the filters. It tells you that these four prefixes are registered in IRR and it helps you in generating the Cisco or Juniper-like syntaxes for them. What BGP Q3 is doing in the back end is just formatting. So you may query an IRR like, here we are querying RADB. I'm just doing the same query. This time I'm just querying RADB with a specific syntax. So I use exclamatory mark six to define this IPv6 and then the AS58901.  It's quite old and in a way ugly and we'll get to that in a few slides. That is also one of the reasons why there are challenges with that. So how well IRR-based filtering is working? As now we understand that IRR is in place, is internet secure with respect to the fundamentals of BGP routing? Can you be sure that the server you're communicating with the IP actually is reaching your server and IP is not being hijacked or the traffic is actually flowing through the expected path and not from some unexpected country? And the answer is it's not so well. So what we did was we looked at all the entire routing table and tried to match it against the IRR to find how clean the routing table is. And this brings us to the present statistics for the current setup. And this is the present state. So there are around 7.5 lakh prefixes visible in the routing table. This includes V4 and V6. It keeps growing, so number would be outdated very soon. Out of these, around 79.54% of routes have a valid route object. So when I say valid route object, I mean that it has a route object first and second it has a route object which matches the ASN. So it's a case where provider says this is my prefix and this is the autonomous system number I want to use to announce this prefix and it matches that. Around 7.73% which is almost 58,000 routes do not have a route object. And you may ask at this point of time how they are even visible in the routing table which is the challenge. It has become like a slump problem it's there and there's limited things people can do about it at this point of time. Around 96,000 prefixes which is 12.73% of the routing table has a mismatching route object. So these could be the cases where these are genuinely the cases where someone just migrated a resource from a company one to company two or someone might be running different organizations. It's also common for large telcos to have different ASNs for different parts of their network. So they may have an AS number for their 4G network, they may have a separate AS number for their fixed line network. So they might be migrating those resources and missing to update the records. So again that adds to the junk plus there can be real cases of hijack where someone is intentionally doing it. This reminds me of an interesting story where once a senior engineer from Yahoo told me that they were finding somehow their mail delivery was getting affected. They were having a large mail queue being generated for just a few minutes, just five to 10 minutes every day at random times. And when they started digging further into it they eventually found that a couple of spammers were just hijacking their IP addresses. They were just announcing their private exchanges so that they can have the TCP session to work to start transmitting spam mails. So right now if you implement a strict IRR based filter across the internet, you're going to black hole almost 1.5 lakh or 20% of the routing table, which is a problem. You don't want to do that because so the IPs to whom these problems belong to, it could be those operators directly responsible, it could be their customer side of things. So you don't want to end up in penalizing the customer by just blackholing them, which adds to the problem that you cannot fix it completely with a single click. Here's some of the statistics specifically for India. So I'm not sure if you'd be able to see the slides on the screen, but you can later download the slides and see. I'll just quickly read them. So for Airtel it's around 1.7% of the routing table which has no route objects whatsoever and then 7.5% mismatch. And this includes the route which Airtel is originating on its own as well as its customers, which includes a large number of Indian networks. Same thing with Siffy, with Siffy it's around 1.4% mismatch, with Vodafone it's 4.2% and so on, with Tata it's 7.8%, Geo 0.5%. With Geo I think it's relatively clean because they don't sell wholesale services yet. So they don't have customers who run BGP behind their network. And that's one of the reasons it's relatively clean on the IRR side of things. A historical network like Tata, which acquired VSNL has more of this legacy problem where they would be routing lots of customers over the time who may have mismatching or missing route objects. So this brings us to the question, is there a real world problem here? Does it really matter? Oh these are just the statistics. So these statistics are visible. You can see that a large part of internet, almost one fifth of the routing table has the problems with the route objects. Does it really matter? Oh it's just a plain stats. So the answer to that is it's actually really bad and you might be following the cases of various route leaks as well as route hijacks which are happening. And before I get to the route leaks and hijacks I want to briefly introduce both the concepts. So route hijack is a case where someone hijacks your prefix. So if you have an AS number, you have an IP prefix which you are using say in your data center or your ISP network, someone else goes and just starts announcing that from its on AS number. And that's a problem. So someone may be doing that far away from you and it may not be that easy to detect. And you may not be having clean route objects or even if you have clean route objects the upstream provider may not be filtering the hijacker so the problem can go on. In the other scenario is a case of a route leak which is that the routes which someone is learning from you instead of just keeping it to their network or instead of keeping in the expected manner they start leaking it to someone else. So you may be operating a data center here. You peer with another network, another local network in Bangalore. You expect the local network to keep your route within Bangalore while the other provider starts leaking it to its upstream and it further starts going out and you have this problem. So here are some of the few route leak cases and trust me I cannot go on the individual route leak cases will take like ages. There have been probably a few hundreds so far. Some of the popular ones are so this issue got a good coverage back in 2008 which was YouTube route hijack by PTCL Pakistan. What they did was at that point of time PTCL was given orders to block YouTube and back then YouTube used to originate slash 23 for their prefixes. So Google was originating slash 23. PTCL put a black hall route for slash 24 on their router which is bad but still okay. They have to follow the regulation but instead of keeping it restricted to their network they started originating it from their AS number to their upstream and their upstream wasn't filtering them. So their upstream back then was PCCW Global which was not filtering. So PCCW Global carried that slash 23 announcement far away all the way to major exchange points as well as major transit points in Europe and US and the leak was heavily visible. So instead of dropping traffic for YouTube only in Pakistan there was a global outage for YouTube almost for half an hour until Google realized that their slash 23 has been hijacked and someone else is announcing a 24. The effect of this scenario was even worst because in routing you follow more specific route. So if a router is learning two routes it's learning a slash 23 less specific and slash 24 more specific it will always follow a more specific. So PTCL was announcing a more specific as soon as anyone was sending them traffic they were just dumping it. So by the time Google realized it they started originating a 24 as well to make sure that now whoever is directly paired with Google or whoever has a short AS path to Google at least gets to Google but the problem I think went on for I think four or five hours as per the documentation. And then there was another case of Google's route leak by Airtel actually it's not exactly Airtel but Airtel was part of it. So it was the original leak came from Hathaway. Hathaway was paired with Google Hathaway is paired with Google in India and Hathaway was learning their routes. The arrangement in these pairings is often that Google is not buying from Hathaway neither Hathaway is buying from Google. So they are supposed to keep routes local only. So Hathaway is supposed to learn routes just make sure that Google is able to reach its customers and its customers are able to reach Google over. Google does not expect Hathaway to announce their routes globally. Hathaway leaked those routes to Airtel Airtel further leaked those routes to its upstream and no one in the chain was filtering so the announcement just carried on and the impact was visible globally. So for a large part of time there was an outage while there was outage when the traffic was actually flowing because it was totally unplanned path. So there wasn't enough capacity on that path. So it was choking a large part of these networks during that time. There have been cases in recent time after Bitcoin there are more cases of targeted attacks on the Bitcoin system. There were notable cases where some of those systems were targeted either by announcing the prefixes on which those systems are hosted or by targeting the DNS of the provider or IPs of the DNS of the provider. So that's again a problem. So and then of course another route leak which came a while back from China Telecom. Oracle covered it quite well. Oracle has Dine which does this intelligence work and gathers the routing table and tries to analyze these route leaks in quite details. So this in itself gives you an idea that it is a real world problem. It's just not in statistics. So at this point of time, whichever IPs on your provider is using they can be hijacked and traffic can be altered. So why this is happening? When you have IRR in place, why the problem is there and why you have 20% of the routing table with no or missing IRR route objects or missing assets. Well IRR is old so it started long back and it's not easy to integrate with routers. I mentioned the tool BGP Q3. You have lots of similar tools but these tools can only generate config. You still need a mechanism to push and update your routers with the config. So operators need to have a system in place where they dynamically generate filters. Keep on updating them. Keep on filtering, keep on doing it at regular basis. If not 12 hours and maybe at max 24 hours or something of that sort. There is no direct incentive for operators to do it. So if you have a small operator who just starts by buying capacity from a provider and the provider does not ask them to create route object and starts routing them, as soon as that happens, now they are part of the problem. And there's no incentive left for anyone to fix because right now it's being routed. So very few networks at this point of time are doing strict filtering if you move beyond the edge. On the edge side is there, so a large operator like Tata, Airtel or Vodafone would be filtering their customers who have only a certain set of prefixes, five or 10 prefixes. But beyond that, if you have a regional operator, it's very hard for them to filter. The software speaking to the routers and pushing config, again that's a very common thing while in the DevOps world it's still not that common in the networking world. And industry overall lags behind that. Lots of still older hardware, lots of older hardware even with people using Telnet to access it, pushing and using expect scripts or something of that sort. So it's still tricky with the overall ecosystem which is in place beyond the IRR problem. So this gives a depressing picture. So what's the future? What eventually would happen which will ensure that you don't have this tins and cans kind of thing connecting the core. So some of the recent developments, there are some large networks which are filtering at this point of time. I missed to mention entity here in the first list. So entity at this point of time has IRR based filtering, I think, and at Hurricane Electric we implemented large scale IRR based filtering. It was tricky. And because based on the challenges I mentioned we did had to make exceptions. We do have strict IRR based filtering for most of the networks who are announcing us less than 5,000 prefixes at this point of time. Any network who is announcing us more than 5,000 prefixes it's hard for us to filter because then we are talking about the route servers or we are talking about super large regional networks and it's just not possible to filter them at this point of time. So the chain goes on, you start with small, you start filtering all the way from edge, all the way up to the core. There are some notable cases which will help to fix this junk is, for instance, Google, they have announced that they'll start IRR based filtering in September 2019. They announced that back at Nanog a while back and that will help because while a lot of providers may not be connected to large tier one operators, they do connect with content players. So content players have a lot of traffic which is flowing towards these providers and if content players go and tell these providers to fix their problem it's going to work because there is a direct incentive here. If Google stops sending in traffic they have a problem or if Google stops sending them traffic over the peering link which is a free interconnection, instead starts pushing the traffic over their transit link it's a problem for them. So there's a good incentive for them to fix over there and this always comes as a surprise for many people that networks do not filter at the large scale like Google or Microsoft because again based on these IRR challenges. You have RPKI which has come up over time. RPKI is the resource PKI so you're bringing cryptography all the way to routers to match the signatures and to ensure that routes which are coming do have a signature and RPKI is much more easier to implement instead of IRR with the routers. Here's just a quick example in the config so what you're doing here is you are putting different local preference for the match, mismatch or valid cases so RPKI does give the hope and at this point of time there's only one large network which has a deployed RPKI which is entity, sorry which is AT&T. Back in November 2008 in the announced that they are rejecting anyone who has RPKI invalid. There are many smaller regional networks which are coming up which have implemented RPKI and that's again helping to solve part of this problem. And I cover the last one's slide on how you can check for RPKI and as well as IRR so you maintain a free tool which is bgp.he.net so you can go to that link and it will show you the network from which you are visiting or you can put your own ISP's name or AS number or the prefix and the tool reflects you with these icons on whether the IRR is valid or invalid or whether the RPKI check is valid or invalid. So here's an example say for Cloudflare you have a green key which tells you that RPKI check is valid and a green tick mark which tells you that IRR is valid. So the route switch Cloudflare is originating from their ASN that matches the public register as well as we are able to authenticate them based on the signatures coming for these. Here's an example for Beam Telecom. In valid there's no RPKI so there's no key here but there's a red check because it's announcing the prefix other than from its ASN so it's using AS18209 to announce while the prefix have something else written in register. Anyone can actually filter them. You can help to contribute in the clean up. I'll probably skip the slides. You can read the slides as I'm already out of time and essentially it's about reporting the junk entries and helping to solve the problem and the references to whatever I mentioned during this talk. Thank you.


The first item of business today is general questions and we Francine Mc playing will start with question 1 from Fulton Mc回去. Thank you, Presiding Officer. To ask the Scottish Government what its position is in increasing the legal entitment to paternity leave and what discussions have it had with the UK Government regarding this? Minister Jeannie Hepburn. Whilst Employment Law remains reserved to UK Parliament as the responsibility of UK Government, we are funding the family friendly working Scotland partnershipинг, family friendly and inclusive workplaces to employers at employment policies. rôl yn cymrydd. Mae'w strategy-govern, i wneud hynny i eu cyngimythau meantimeau, yn gweithio ei olfawr amddor iawn i molygnegodol i gynnwys a'r ffordd o'i wlad i ffriddio fawr i hunanol f favorites. Felly, mae hi'n rhaid i wneud i ffwrdd mwy o'ch gwirio i gwsig oherwydd i gweld i'w ffawr i gweld i wneud yn hcourse. Oni, mae'n dod, ar ei ddweud i wneud i gweld i gwelr, ac yn ei wneud i gweld i gweld i beithio y ffordd i'r ddechrau yn cydyn nhw, oedd dysg…)r FgF? Dyna wnaeth cheyf a'r Ddysguir Cymru yn fawr o'r cydyn nhw, sydd gyda ni'n gwybod ar eich hyd Gwldor Fyryn. Fellyddian McGraw. Fyllteith y ddegwyd wedi bod yr hyn ffordd y ddechrau yn gwybod y rhai, yn cyfleoedd i fi agirion tawr maternol, mae'r prifsgail o gweithgaf i'r cyfrifniadau tygrennu. Mae'r digwydd yn gweithio i ddweithio i ddegwyd i ddegwyd â holl ffrifion i gydawn And would you join me in encouraging employers in Scotland too for enhanced pretendent leave or 4 weeks? Minister. It will let me reiterate, yes, I would absolutely encourage employers to do so. I not just for the reasons that Mr McGe quère has set out in terms of child wellbeing and parental wellbeing, but we also know that FLEX will be working as it has that clear benefit for employers, Felly, mae gweithio chi ysgrifftu gwahodol o'r byw yn ei wneud dda wedi'u brithlwst y byddai'r cymdeinig o'r byw yn dangos o'r byw cael ei wneud, a byddai o'r byw cael ei wneud i'r brithlwst o holl, hi weithio I-10, i wneud i'r brithlwst teidwydol, chi weithio adnod o'r bethau, a chael ei ysgrifftu gwahodol, hwnnw nes pasteur yn amladewch i'r dydd yn ei ysgrifftu gwahodol ond we have provided £857,000 since 2014-15 for that programme. We are also promoting our framework agenda on a wider basis. Michelle Ballantyne Has the Government done any assessment on what the impact of increased parental leave has on SMEs? Those are the areas of business that are most likely to suffer from employees being absent for periods. As I have just made the point, what a flexible approach, irrespective of the size of employer can lead to is reduced absenteeism, better retention rates and increased productivity. That is what the evidence demonstrates. Not just in relation to enhanced paternity leave but across the board in terms of the flexible work agenda. SMEs and businesses and employers across Scotland could stand to benefit by adopting that deflexible approach. Ruth Maguire To ask the Scottish Government how it is involving stakeholders with the development and implementation of its planning bill. Minister Kevin Stewart Thank you, Presiding Officer. The planning bill has been developed through a highly inclusive approach involving extensive engagement and consultation with a wide range of stakeholders. That has included two formal consultation exercises convening a series of stakeholder working groups and full publication of regularly updated information on the Scottish Government website. We have sought out opportunities to engage across our stakeholders throughout the development of the bill and will continue that very inclusive approach as the review of the planning progresses. Ruth Maguire I thank the minister for that answer. Our dear peninsula in my constituency is subject to a 1953 order, which allows almost any development to be carried out without planning permission. I understand that that could cause issue for potential sustainable development of the site. Would the minister look into this matter and help to find a solution that best meets the needs of our community, promotes inclusive growth as per the aims of the Ayrshire growth deal and respects wildlife and the environment? Minister I am aware of the unusual circumstances surrounding the special development order for our dear. My officials have been in discussion with North Ayrshire Council officials about the complex planning position. The possible options and how that might best be taken forward to a satisfactory conclusion. I will be very happy to meet Ms Maguire and stakeholders to discuss the issues and an appropriate way forward for that area. Question 3 has been withdrawn. Question 4, Stuart Stevenson. To ask the Scottish Government what action it is taking to support and encourage young people to engage in sport. Minister Aileen Campbell Thank you. The Scottish Government strongly encourages people of all ages and backgrounds to try and participate in sport. To aid with that, we have protected the Scottish Scotland budget for next year and committed to help mitigate the impact of continued reductions in their income from the national lottery, invested up to £50 million from our active schools programme between 2015-19 and committed to increase the number of community sports hubs. I would also like to use this opportunity to pay tribute to the achievements of Team Scotland during the Gold Coast Commonwealth Games. I am sure that everyone else will agree as well. Following the success of Team Scotland, I am confident that the performance is by all of our athletes will inspire young people to take up sport, allowing them to set and achieve their goals. Stuart Stevenson I particularly welcome the fact that a member of the team of Scotland was older than me, and that is pretty unusual. More seriously, I recently visited Cullen Bowling and Tennis club, where the members have taken in hand to offer coaching sessions to young people to encourage a new generation of club members. Does the minister agree that that is an excellent example of community-based approach to encouraging our youngsters to try new sports? I would also like to pay tribute to the athleticism of Stuart Stevenson. This is a great example of encouraging young people to join their club. I wish Cullen Bowling and Tennis club every success. Our commitment to active schools programme will not only allow children to try new sports but will also provide them with a pathway to local sports clubs. I would actively encourage that partnership. I commend the work in Cullen, particularly during this year of young people, for their endeavour to get our young people and children active. Bruce Crawford To ask the Scottish Government how many young people in the Stirling constituency have received support from the help-to-buy scheme. Minister Kevin Stewart Help-to-buy Scotland data is published at the local authority level and is not readily available by parliamentary constituency. From October 2013 to March 2017, there have been 190 sales in the Stirling local authority area that have received support from the help-to-buy Scotland scheme. Bruce Crawford I know that I have to go to the council in the future from that reply, but I am still grateful that there have been 190 people in my constituents who have benefited. This is a much-needed way of supporting people into a new home, particularly those who are buying their first home. Can you tell me what the age of the range is for the scheme and what the percentage is of first-time home owners, please? Minister We estimate that 76 per cent of buyers who purchased a property with assistance through the scheme are aged 35 and under, and 66 per cent have been first-time buyers. That is based on an analysis of the first three years of the scheme from September 2013 to March 2016. Linda Fabiani I ask the minister to look at my particular concerns about the open market shared equity scheme, in which there is a valuation price set at a threshold. In very desirable areas such as East Kilbride, it means that sometimes it is difficult for people to find suitable accommodation to purchase and to still get assistance. That is an advantage for people who have not been looked at for many years now, I understand. Can that consideration be given? I thank Ms Fabiani for her question and I understand the desire to live in East Kilbride. The price ceiling has gradually reduced from the original figure of £400,000 to the current £200,000 to ensure that more people can benefit from the available funding and help to target funding at lower-income families and first-time buyers. We accept that in certain geographical areas not as many homes will be purchased with assistance from the scheme, but I assure Ms Fabiani that I will continue to look at all of that as we progress. Lewis Macdonald The plans for major trauma centres in Aberdeen and Dundee to commence in October have been affected by recent events in NHS Tayside. Shona Robison Progress with implementing the Scottish Trauma Network is continuing as planned, including the opening of the major trauma centres in Aberdeen and Dundee in the autumn of this year. Implementation will not be affected by the recent events at NHS Tayside. Lewis Macdonald I am pleased to hear that clear assurance from the cabinet secretary. I wonder if she can also address the issue of the appointment of Malcolm Wright, the chief executive of NHS Grampian, to head up the team rescuing NHS Tayside from its current crisis. When Shona Robison made the announcement, it was as an interim appointment, but in her statement the other day it was as the new chief executive. I wonder if she can clarify the future arrangements for leadership of both NHS Tayside and NHS Grampian. Lewis Macdonald I can do that for Lewis Macdonald. Malcolm Wright will also remain as the chief executive and accountable officer for NHS Grampian. There is no change to that. I have not described Malcolm Wright as the interim chief executive. I think that he should have the full title as the chief executive of NHS Tayside. Of course, work will be under way very quickly to find a permanent chief executive for NHS Tayside. I have also agreed with Professor Stephen Logan, the chair of NHS Grampian, that Amanda Croft, who the member will be well aware of, as deputy CEO, will oversee the day-to-day operations of NHS Grampian. I think that Amanda Croft is very capable of doing that, and hopefully that will give the member the assurance that he is seeking. Graham Dey Thank you, Presiding Officer. Can I ask, in relation to the NHS Tayside situation, whether the support team, led by Professor Lewis Ritchie, will continue to provide an assurance role on the board's future plans for services? Yes. Lewis Ritchie's involvement with the assurance group will continue. He has provided a very important role there, and that continuity remains important. I can certainly make sure that Graham Dey has kept informed about that continuing role. Liz Smith To ask the Scottish Government what its position is on the performance of integrated joint boards since their creation. The integration authorities went fully live in April 2016 and are already delivering achievements. Individual integration authorities published annual reports on how the new arrangements are delivering real change and improvement. The latest annual performance reports are due to be published in July of this year. Liz Smith Will the cabinet secretary confirm to Parliament that she is aware of some of the very strong criticism, including some within her own party, which is being levelled at integrated joint boards because of the current structures, are not at all clear in terms of the lines of accountability for decision making and for the accompanying accountability? Will she, with some degree of urgency, review whether the current IGB structure should be completely overhauled? Liz Smith Cabinet Secretary I think that the structures are fairly new, and they should be allowed to bed in. As everything, we would always keep those matters under review if there are particular concerns that need to be taken forward. In relation to local matters, we would expect local partnerships to take forward any changes to services in a way that has the full consultation of the local public. We would expect that to be done in a way that is open and transparent. If Liz Smith has any particular concerns in relation to that, I suggest that she writes to me with the detail. Murdo Fraser To ask the Scottish Government what discussions it has had with the Office of the Scottish Charity Regulator regarding the use of public funds by NHS boards. At my request, the chief executive of NHS Scotland has written to all NHS board chairs seeking assurance that NHS Scotland endowment funds are being used appropriately. Responses are required by the end of April. That approach has been agreed with Oscar, and responses will be shared with them. Oscar has agreed to review the evidence provided, and once it has considered all of the relevant evidence and completed its risk assessment, it will come to a decision on whether to undertake inquiries into other NHS endowment fund charities. Oscar has indicated to my officials that they plan to be able to give a response on that by the end of May. Murdo Fraser I thank the cabinet secretary for that response. This morning, the Parliament's Public Audit Committee heard from the Auditor General for Scotland, Caroline Gardner, in relation to the issue. That raised a number of quite serious questions that are required to be addressed, including the question of a conflict of interest that might arise for NHS board members who are being asked to deal with public funds and deal with funds from charitable endowments. Given that, will the Scottish Government look at creating a structure whereby board members are no longer required to make decisions, both on endowment funding and on general funding, for NHS boards? Murdo Fraser may be aware that the guidance around that was reviewed back in 2013. Oscar has already signalled, and we have agreed that that guidance should now be reviewed. Murdo Fraser points out that there is a potential conflict of interest of board members being the trustees on an endowment fund. Oscar will come forward with sensible recommendations about what structural changes should be made to strengthen the governance, whether that is external people sitting on the endowment fund board as trustees or other suggestions that will strengthen that governance. However, please be assured, and the member should be assured, that Oscar has already indicated his desire to do that, and we have agreed that that needs to be done. I am happy to keep Murdo Fraser and indeed the chamber updated as that work progresses. Monica Lennon, in question 9, to ask the Scottish Government how it will protect respite services to allow carers to access a short break as set out by the Carers Scotland Act 2016. Under the Carers Act, local authorities now have a duty to provide support to make carers identified needs, which meet local eligibility criteria and to decide whether that support should include a break from caring. The 2018-19 budget includes an additional £66 million to support additional expenditure by local government on social care, including for implementation of the Carers Act. In addition, the Scottish Government is providing £3 million in 2018-19 for the voluntary sector short breaks fund, administered by Sharecare Scotland and the Family Fund. Monica Lennon, I thank the minister for her response. I am pleased that short break support is giving prominence in the new carers legislation, which came into effect on 1 April. However, Lanarkshire Carers Centre has raised with me its concerns that respite services are facing a very uncertain future, with many short break providers believing that they are at moderate or high risk of local authority funding cuts. At a time when local authorities have seen a real-term budget cut of nearly 10 per cent over the past eight years, can the minister reassure carers and short break providers that sufficient funding will be available for as much needed respites? I have outlined the additional money that we put in to support additional expenditure by a local government on social care, which includes the implementation of the Carers Act. I would also point to the fact that a service planning level local authorities also have duties now to publish a short break service statement providing information about short break services available in Scotland so that people can understand what short break options are available. That is in addition to the money that we also provide to the voluntary sector short breaks fund, which I said in my previous answer, is administered by Sharecare Scotland and the Family Fund. That is because we know how important these short breaks are. We know how important it is to enable carers to have a life alongside their caring role and to enable them to ensure that their wellbeing is maintained. Again, I am happy to engage with Monica Lennon on the particular issues that she has raised around Lannyshire Carers Centre, but, certainly from our perspective, we have put additional resources in to protect and support this important part of this act. 10. Ash Denham To ask the Scottish Government what its response is to the recent publication of large companies' gender pay gaps, which show that there remains a significant pay gap among many companies, both in Edinburgh and across the United Kingdom. Mr Jimmie Hepburn Although the full-time medium gender pay gap in Scotland is lower than the UK figure at 6.6 per cent compared to 9.1 per cent, some of the figures that we have seen employers report highlight the very real challenge that it remains to be taken to further reduce the gender pay gap. We need to see employers take forward actions that improve the position of women in the workplace and wider society. The action that we are taking is the establishment of a gender pay gap working group, funding returners programmes that support women following a career break, establishment of working groups to challenge pregnancy and maternity discrimination and to support the delivery of the women in enterprise action framework, promoting payment to the living wage and tackling occupational segregation and gender stereotyping through the modern apprenticeship equality action plan and the Scottish Funding Council's gender action plan. Ash Denham I thank the minister for that answer, but it was particularly disappointing to see that the pay gap in Edinburgh was marginally higher than the national average at 12.9 per cent compared to 12 per cent. Are there currently any talks between the UK and the Scottish Government regarding further improving the gender pay gap legislation? Michael Matheson Having mentioned the working group on the gender pay gap, one of the early areas of work will be to work with closed the gap in gender and the STUC and other relevant bodies to develop a key current action plan to reduce gender pay gaps across Scotland, where that may require us making recommendations about legislative change. We will, of course, seek to recognise that that requires all to make, if we are engaged with the UK Government to explore options for legislative change and for joint working on that issue. Y Llywodraeth Cymru


What's up everybody, Jason here from jazbeastcasebrace.com. We just sold out 21-22 Panini Eminence Basketball case break number nine. Again guys, this is a random hit. So the way it works guys is there's 10 spots. First we'll open up the case, showcase the 10 hits. Then we'll randomize the list of hits and the list of customer names. And whatever you match up with is what you got guys. Nine autographs, one additional card and look for silver, gold, platinum bars with real diamonds. So we sold basically nine straight up and then Carl won the last spot in a filler. So let's get the break going and then we'll, like I said, pasting the names and the hits.  And when it's a $22,000 case, I guess you've got to go all out, right? All the cards are kind of out of place here. Instead of them moving around. I guess we'll go with this one. I guess we'll go with the top of our hair first. All right, here we go. First one we have is a Walt Frazier little diamond and autograph one of three green, 75th anniversary. Oh, what's definitely harder than yours for us but I didn't think for you guys. Next one, little Troy ounce of fine, fine silver for Trey Young, four out of six. Of course it just got eliminated today or yesterday. And then we got a carton called Bob Coosie. Five out of 10 for the Boston Celtics. Maybe he just thinks for you guys too because the mic is so close. But I don't know, I don't feel like I'm over here. We have a Dennis Rodman little diamond autograph two out of three for the Bulls. Nice Dennis Rodman right there. And then last one here. Is a Jason Kibb, two out of five. So all veterans here, no rookies at all. So the second half better have a lot of rookies. Gotta cover this for you guys. I don't want you guys peeking. All right, here we go. Next one we got is a Clyde the Glide Drexler. Look at that patch. One, two, three, four color patch, three out of five. Nice one there. We have a Jalen Green Optum autograph, little diamond autograph, two out of 10. That's very nice. Nice rookie there. So we finally got a rookie there. Then we got a Bob Hettit, eight out of 10. And two really old school players that are gonna sing those hocks. So it better be a big RPA or something in here. I'm about a little Kareem Abdul Jabbar, one out of five, little Diamond Otto. I think the middle one is a patch autograph. Cade Cunningham, that's nice. Five out of 10. Hearless patch, rookie patch autographs, one, two, three color patch. Very, very nice right there. That's a big hit. All right, well, unfortunately no one-on-ones, but finally did get some rookies here on the second half. And we just left that up. Nothing else there. There. All right, you guys. Well, again, I'm gonna input the hits just the way they came out. A lot more vets, but some nice stuff there regardless. This was our last case I think I seen in stock, so. Hopefully we get more if anything, guys. I'd love to do some more of this. All right, now let's switch scenes. And I'm gonna input the names here, guys. So I'm gonna pause the video really quick. When we come back, we'll see who gets what, guys. Thanks. All right, you guys, welcome back. So again, I did input the names there, input the hits that came out. Let's see what you guys match up with, guys. Good luck. Here we go. Click the dice roll. It is a two and a six, eight times. Good luck, eight times. Here we go. One, two, three, four, five, six, seven, eight. So two, six, eight, Michael, Donald, Carl. Now let's go two and a six, eight times on the hits. One, two, three, four, five, six, seven, eight. Kareem Abdul-Jabbar at the top, Dana Walt Frasier at the bottom. So Michael, you have the Kareem Abdul-Jabbar, Diamond Autograph to five, Carl with the Bob Cusy Diamond Auto, and the Jalen Green Diamond Rookie Autograph to 10. That's pretty nice right there. Then you go Trey Young, Troy Owens, Fine Silver, Hilton with the Dennis Robin, Diamond Auto to three, Carl with the Bob Pettit. Sorry, I said box. Troy Owens, Silver out of 10, Auto. Hilton getting the Cade Cunningham RPA, very nice. Carl with the Jason Kidd, as well as the Clyde the Glide Rexler, and the Walt Frasier there. So there you go folks, that was it there. So again, I didn't see any more back there. I'll double check, but if you do get more, it'll be on jaskyskatespakes.com guys, thanks.