Good afternoon. Good morning. My name is Johnston Makubu from the South African Revenue Service. It gives me great pleasure to have you here as we explore hidden wealth and we will have quite a number of speakers or presenters that will share some very interesting insights from research that has taken place across jurisdictions. I think it's important as I open up this session that generally I indicate that we had quite a number of discussions yesterday that will cross-pollinate with the papers that are presented here today. There was some insights that came out of the UK in terms of real estate and you will see that there will also be presentation today around issues that pertain to real estate in as far as Dubai's consent, but also earlier on this morning in the opening session much was said about evasion and this session will touch a little bit on that. If I just share from the South African context as we continue to look at hidden wealth, a number of things that we have started to do that I think are important just to kick off from a tax administration perspective. We started to really focus on creating a segmented focus on high wealth individuals in the South African context by setting up a unit that looks at specific individuals that have been profiled to fall within that particular segment with a view of broadening the base but also ensuring that the revenues that are supposed to come through to the tax administration are indeed received. We've done some work as well at the back of the Panama Papers where we saw quite a number of South Africans that were featured in those leaks and not only the Panama Papers but subsequent leaks and some audit work that have since started have yielded quite significant revenues for us and therefore we continue to focus on ensuring that we integrate whatever data and information that comes out of the various institutions to ensure that as a tax administration we efficiently mobilise domestic resources for the betterment of the fiscals. So I think having said that it becomes quite important that in a DRM context that the issues of hidden wealth becomes a discussion point here today and we've got four speakers that will interchangeably address some pertinent aspects of the issues that pertain to hidden wealth and without further ado, I will allow the first speaker to come forward. Anzila, if you can approach. Thank you very much and good morning to all of you. We had a very interesting morning today. It was a panel which raised some of the questions that you will be exploring in this session as well. It was a great warm-up and I look forward to our discussion through all these next hour and a half. So in my brief presentation, what I would like to do is to share some insights as to the work of the global forum on transparency and exchange of information. In the presentation I'll focus first on the progress which has been made in relation to two standards that the global forum is helping to implement. These are the exchange of information on request and automatic exchange of financial account information. So far we've been focusing a lot on what needs to be done and in my presentation I'll try to say what has already been done. Also, what are those exchanges in practice, the numbers surrounding the scope of exchanges? Then and in line was the topic of this gathering. We will talk a bit about the role of these two tools in domestic revenue mobilization and finally, of course, what's next? Because we certainly have not yet reached the end in this journey. So let me take you back to 2009. What happened then? It was the OECD members and also those jurisdictions which are referred to as non-cooperative tax havens all committed to implement exchange of information on request standard. At that point, the global forum was called upon to carry out peer reviews of exchange of information on request. As of today, we have 168 member jurisdictions and half of these jurisdictions, more than half in fact today, are developing countries. Developing countries, they make significant contribution to the work of the global forum. If you look at the composition of the subsidiary working bodies, developing countries would represent about one-third of the delegates. These contributions of various types and for instance, last year 40% of expert assessors in relation to exchange of information on request were delegated by developing countries. Half of the members of the expert panel on the assessment of confidentiality and data protection are also coming from developing countries. So, what progress have you made in that group of 168 jurisdictions? Let me first talk about exchange of information on request. That standard has already come through two rounds of reviews. The first round was completed in 2016 and for those of you not familiar with the substance of those reviews, they can include three components. The first component is to ensure that jurisdictions have information available to them and that information would be ownership information, information on accounting records and also banking information. You would already sense, especially those of you coming from tax administrations, that making sure that jurisdiction have access to that information is important not only for international exchanges, but also for domestic revenue collection purposes and that's an important element of development as such. The second component is to ensure that competent authorities will have access to that information domestically and the third component is really about the actual exchanges. So that's what we focused on in round one of the reviews. In 2016, the standard was enhanced to include also beneficial ownership information in it. So now we are looking into the availability of legal as well as beneficial ownership information and the second round that we use is largely focusing on revisiting what we looked at in round one plus beneficial ownership. Now we are almost halfway through these reviews in the second round with 101 jurisdictions being rated. So what do we know from those reviews is that 85% of jurisdictions that have so far been reviewed are compliant or largely compliant. Generally, you would say the standard demonstrates growing maturity. Whilst we are saying that the standard as a whole is quite well implemented globally currently, there are still weak areas. One of the weakest areas is one that relates to beneficial ownership information, the newest component that hasn't yet been reviewed twice. So you see it on the element A1. About half of the jurisdictions are non-compliant or partially compliant with the implementation of this particular requirement. Also, some material deficiencies can still be found in the availability of accounting records. That's A2 and the very last one, C5, that's about exchanges of information in practice. What do we do to make sure that things get better? We have an annual enhanced follow-up process in which jurisdictions report what they have done to implement recommendations provided to them and we also provide them with technical assistance, of course, to make sure that that happens. Another important component is that we monitor in real-time exchanges. So each year, all jurisdictions can report on the exchanges and if there is any difficulty in communication with another jurisdiction, you can make a complaint. So what about AUY, Automatic Exchange of Information, adopted as a second standard in 2014 and the Global Forum launched a commitment process. The initial focus was on ensuring a level playing field so that developed countries and also international financial centres swiftly implement that standard. That process covered about 100 jurisdictions which started exchanges in 2018. What about developing countries? Developing countries without financial centres were provided with more time, understanding that their capacity is more limited in terms of implementing the standard quickly. They may consider their own capacity guided by technical assistance team and define the date by which they will be implementing the standard. At the moment, 48 developing countries have already defined the date by which they will be implementing the standard. So that's a significant number, it's about 40% of all committed jurisdictions. 11 developing countries in addition are undergoing technical assistance on this method in order to define by which they will be implementing. So how do we assess the effectiveness of implementation? There are three main components to that process. First is the assessment of confidentiality and data safeguards framework. That's a very important assessment to demonstrate that you can handle data securely. If you receive the data, we don't want leaks, we don't want to scandal around data not being handled appropriately. Therefore, we check that capacity before exchanges commence and that's something that has been mentioned in the conference earlier today, which is a challenging component for developing countries and then also after exchanges have started. We also reviewed the legal frameworks which implement automatic exchange of information and finally we look into the effectiveness in practice. So what is the picture emerging from those analysis? Let me first tell you about the legal framework. So assessment of legal frameworks is pretty good. We have information published last year at the end of 2022. There are more than 100 jurisdictions were reviewed that over 90% of jurisdictions are either having that framework in place or in place, but need some improvement. It didn't happen overnight. 74 jurisdictions had to make changes in their legislation in order to get to this point and 600 recommendations were implemented in order for us to reach that result. Effectiveness in practice is the second component. We published the first results last year and you could see that a large majority of jurisdictions have already put in place administrative compliance frameworks in order to make sure that the standard is implemented correctly. However, there are still jurisdictions which don't have that in place and we are working on making sure that that changes. This year we had the stage of in-depth reviews which means that assessment teams are visiting each country that have commenced exchanges to verify on the ground where the financial institutions and their regulators indeed comply with the standard and with their claimed compliance agenda. So let me move after that to exchanges in practice because so far I've just explained to you how the legal framework operates and what we have in terms of commitment process. The network for exchange of information has expanded significantly since 2010. Back then main sources or main foundation on which exchanges took place was bilateral agreements. Since 2010 we use a multilateral treaty which means that for any developing countries that would like to receive information and a couple of those were already mentioned during those conference. All that's needed is to sign one convention and that opened the rest to information in 146 jurisdictions with one ratification which is a significant advantage. The quality of domestic frameworks and also a wider international framework mean that there are more exchanges now that they used to be 10 or more years ago. Approximately 25,000 requests have been made by the members of the global forum in 2022 and that's more than double from the number that we've seen in 2010. Automatic exchange of information, exchanges are massive. You can see the gradual increase through 2018 to 2022 on this slide but basically what we have today is in 2022, 123 million financial accounts were exchanged worldwide and the total assets of about 12 trillion. You will ask me a question what about developing countries, right? Because we hear a lot and hear specifically the developing countries are behind. I already told you that 40% of those committed to implement by the defined data are developing countries but what do they receive in practice? Quite significant. What we do know is that the developing countries are net receivers of AUI data. In 2022 they received over 33 million financial accounts and send information on over 16 million accounts. The difference is quite even more striking when we look at the values. About half a trillion were reported to other countries by developing countries and yet they received information about the values of over 3 trillion. So what we can say was certainly that if you invest in AUI, in implementation of AUI, you definitely will receive significant information back. What about the quality of that data? We conduct survey every year which demonstrates to us whether countries are happy with the quality of the data and we do see that the matching rates are quite high and they are increasing over time. And if there were any obstacles that countries identify through the survey, these were the human resources or capacity to analyze the data in which we put now significant capacity building support in order to make sure that the data can be used. So what about revenue potential? I think these numbers have been cited and been in media quite widely. 126 billion euro have been identified by jurisdictions around the world through short tax investigations, voluntary disclosure and other associated tax transparency initiatives. 41 billion was identified by developing countries and these are not some estimates. These are actual revenues that are reported by our members through the survey. We also asked jurisdictions whether they monitor how much revenue is being identified through these two standards. Only 40% monitor the revenues. So that figure is significant understatement because only 40% would even have records of how much is being identified. Can developing countries benefit more from these standards? Yes. And what we do for that is we adopt the processes both at the commitment and implementation level and also we provide capacity building assistance. I will not be explaining in detail how the processes are adapted but I wanted to focus on one specific example because it was mentioned earlier today during the panel. It was ISM, information security management. I think there was question from Uganda as to whether the standards could be different for developing countries. So the solution that we found is that the same standards apply to everybody but then there are some solutions at the level of implementation. So specifically on ISM, we have published guidance on the implementation of a secure parameter for AUI purposes. And that allows developing countries to have a secure space, physical or virtual, in which they meet those requirements on confidentiality and data protection. And that is the balance to be found between making sure that developing countries can receive AUI data and that would be both financial accounts and also CBCR. But yet the data is secure. So speaking about not the organization as a whole, meeting that higher security standard but creating an environment where those standards are being respected, which we believe allows developing countries to meet those requirements faster. And I will not be speaking much about capacity building but just like at a very high level, so you had this sense, 60 developing countries already benefited from technical assistance support this year and received over 90 reports that we published tailored to every specific jurisdiction's context. We have very interesting regional initiative programs and I'm mentioning this because not only they allow countries in the region to make progress and monitor it but also to define their own objectives and set the agenda for international cooperation. For instance, Latin America initiative piloted a very interesting program on how can we use tax information exchange on the tax treaties for other purposes because at the moment you can only use that information for tax purposes but you can definitely see benefits for IML purposes or something else. At the moment that type of use is very restricted. So on the Latin America initiative we piloted a program which allows doing so and we developed possible approaches for doing that and the report on this was published earlier this summer to G20 in order to demonstrate how globally we can benefit for this type of exchanges which could be extra benefit for development. African initiative allowed looking more closely into recovery of taxes and if you publish a toolkit for jurisdictions that would like to enhance cooperation in the area of recovery of taxes and you see here how developing countries in particular can promote their interest and set their own agenda and then push it to a global level in fact. We also have trainings and toolkits which are focusing on developing resources in developing countries themselves. So training the trainers which will then train others locally. So what's next in the last minute or two that is remaining first last year we received a call from G20 in order to build upon our commitment and monitoring processes in order to achieve widespread implementation of crypto assets. We also have an asset reporting framework and the amendments to the common reporting standard by relevant jurisdictions. When the OECD completed the technical work on the package of the framework itself in July 2023 we received another call from G20 to define a timeline as to when those exchanges can be commenced noting that significant number of the jurisdictions already want to start those exchanges in 2027. So the work in this area as I have commenced we literally a few weeks ago published a call for membership in the new CARF group and as soon as that group is formed the work in this area will start. Let me conclude with the current priorities to wrap it up. So the first would be of course continuing AUIR and AUY peer reviews and monitoring. We still have about 70 jurisdictions that are to be reviewed on AUIR. We have a huge number of developing countries which are starting to implement AUY so it's a significant amount of work ahead. We are also working on redesigning the peer review and monitoring processes and you will hear more about it in just a few months. As we witness growing maturity of the standard we want to adopt our processes. We are also incorporating monitoring of current and emerging risks to the standard in the processes. Obviously CARF already mentioned those new areas pushed by developing countries themselves such as wider use of information or recovery of taxes is an important new component of work and finally capacity building. Which will continue to expand. That would be all and if you have any specific questions we will be happy to address it later. Thank you.


Ladies and gentlemen, I begin today by acknowledging the traditional custodians of the land upon which this important symposium is taking place and their elders past and present. I also pay my respects to the Aboriginal and Torres Strait Islander peoples attending today. Thank you for this opportunity to address you in my new position as the UN Special Rapporteur on Torture at this important national symposium. As Australia gets ready to finalise its network of state, federal and territory, preventive mechanism and move to the business end of making sure they function effectively to prevent torture and ill treatment in any place where a person is deprived of their liberty. I take note that Australia is a long-term party to the UN Convention Against Torture ratifying in 1989. And what we are here to speak about today, the optional protocol to the UN Convention Against Torture which Australia ratified in 2017. The role that incarceration has played in Australia's history since British white settlers arrived is a dark one. Over an 80-year period from 1788 until 1868, approximately 162,000 convicts were sent to Australia, of which one in seven were women. Most were sent for petty crimes. Among them, political prisoners were also transported. Today, we probably call them refugees. The problematic of incarceration in Australia has particular significance for the First Nations people that to date has not been adequately addressed. Australia's history notably records many terrible events, not least the forcible removal of the stolen generations of children into homes and institutions where terrible crimes occurred. And today, despite some progress, there are disproportionate incarceration rates and deaths in custody of indigenous Australians and unacceptable patterns of inequality for our brothers and sisters within criminal justice systems. Historians recount how the colonial period based on establishing Australia as a penal colony for British overcrowded jails has shaped Australia's national identity. It also appears to have a continuing legacy in Australia's prison system. That assertion is not too far-fetched when one considers the following. After the United States, Australia spends the most on its incarceration system in the world. State and territory governments spend approximately 5.2 billion Australian dollars annually. Australia's imprisonment rates are increasing. And according to the OECD, they are the third fastest in the OECD at 39% growth. Only Turkey, 120% and Colombia, 46% have experienced faster growth. A third of the prison population in Australia is on remand. This proportion has almost doubled since 2000. The average time spent on remand has increased from 4.5 months in 2001 to 5.8 months in 2020. Australia is the only industrialized country that mandatory detains asylum seekers and putative refugees, and which has maintained a cruel system of offshore detention in violation of international law, regrettably producing some popularity in replicating the failed experiment in at least two European countries. There are plenty of studies to show that trauma is intergenerational. So a former colony built on prison and prison labor that opts to ratify op-cat can only gain from a system of inspection bodies that are able to visit any place where persons are held against their will. The capacity to make unannounced visits with full access to all spots in a detention facility at any time and to speak to any detainee is a powerful deterrent to abuses. But moreover, has been found in other countries to be one of the strongest ways to improve conditions in detention and the humane treatment of detainees. Australia is a developed democracy that not unlike other such countries, generally think things are going along swimmingly until they aren't, until a breaking news story or a whistleblower shatters that comfortable view. That's what an op-cat national preventive body is intended to avoid, that complacency, that out-of-sight, out-of-mind mentality when society looks away and forgets about its unwanted citizens many times it's most vulnerable. NPMs can act as a warning system alert for when internal mechanisms break down. It is not, however, a replacement for good prison management or humane and well-regulated custody arrangements. Those internal procedures, including internal disciplinary codes and hearings, need to remain robust and functional. However, what an op-cat body adds is its external function and therefore arm's length eyes, ears, taste and smell. In Australia, we don't have to look too far back to see why independent bodies are so important. If you will indulge me, I'd like to tell a short anecdote about why I've long been convinced about the utility of external oversight bodies. When I was in my fourth year of an arts law degree at UTAS, I was clarking in Sydney during the period of the Royal Commission into police corruption in the summer of 1945. So in the summer of 1994, 1995, at the invitation of the Royal Commissioner, James Wood, a family friend of my grandmother, who it turns out had written a handwritten card, unbeknownst to me, informing him that her youngest granddaughter was coming to Sydney from Hobart and didn't know anyone there. Those hearings, which I had the privilege of gaining access to and the extensive commission powers were eye-opening for me as a young law student, to see that even in a 200-year-old parliamentary democracy such as ours, with a strong foundation in the rule of law, that the largest police force in the country could be so endemically riddled with corruption and misconduct, such that the Royal Commissioner, Wood, described the problem as systemic and endemic. This commission followed the Fitzgerald Inquiry in Queensland some years earlier, which also focused on police misconduct and corruption. When I was at dinner with the Wood family later that evening at their home, a loud noise sent the family running to cover. I was startled. The matter was quickly resolved and the 24-7 close security team, assigned to the commissioner, confirmed that this time it was not a bomb and not another letterbox bomb that he had previously received. This was in a developed democracy such as ours. The outcome of that inquiry will be familiar to all of you and was the establishment of a police integrity commission that later changed to the Law Enforcement Conduct Commission and many other recommendations, including the removal of the police commissioner and root and branch reforms. At times drastic action is required. All critical incidents must now be investigated. In the 2020-2021 period, over 3,000 complaints were assessed and 125 investigations carried out in New South Wales. Now that is the value of external bodies. It was obvious to me then as a 21-year-old law student and now we have all the research and evidence and evidence in the world to back up the view that external bodies prevent abuse, misconduct, corruption, and in extreme cases, torture. They act as a check on power. Even in the best functioning democracies, there are risks, weaknesses, and blind spots. When people are behind bars, it is the ultimate isolation from society. The UN Convention Against Torture even acknowledges there is inherent harm from being incarcerated in accordance with lawful sanctions. However, standards of treatment are to be humane and no one shall be subjected to forms of cruel, inhuman, or degrading treatment of punishment, of which torture is the most severe amongst them. The criminal punishment is removal from society for a period of time commensurate with the crime. The punishment is no greater, no narrower. The punishment is not to degrade, to humiliate, to intimidate, to abuse, or to torture. The punishment is the deprivation of liberty plain and simple and that is punishment enough. Preventing torture is everyone's business and everyone's responsibility. Australia signs international treaties regularly via the constitutional power. The ratification of OPCAT is no different. The obligations exist at the federal level and also flow to state and territory governments. No matter the level of government or seniority of public officials, they each bear responsibilities and obligations to prohibit and prevent torture and other ill treatment as part of the Commonwealth of Australia. I congratulate the states and territories that have already seen the wisdom of this preventive mechanism and have taken concrete action to designate or establish NPMs. While appreciating there remains some budgetary questions which I trust can be resolved quickly, I plead with those governments yet to come on board that please do not let budgetary matters stand in the way of adhering to the absolute prohibition against torture and preventing acts of torture or humane treatment in your state. I conclude by noting that with the upcoming visit of the UN subcommittee on the prevention of torture next month, as well as Australia's review by the UN Committee Against Torture later in the year, and my own appointment as the first Australian to occupy the post of UN Special Rapporteur on torture, it seems that all eyes are on you. I encourage you to make this year count. Thank you.


We will begin this with General Questions, question number one from Julian Martin. To ask the Scottish Government what action it has taken to assist businesses in the North East that have been affected by changes in global oil prices. Minister Paul Wheelhouse, the Scottish Government continues to support both businesses and individuals affected by the downturn in the oil and gas sector. The energy jobs task force is developing long-term solutions to the structural challenges affecting the oil and gas sector. Our enterprise agencies have engaged with more than 700 companies in the oil and gas industry. In addition to support for individuals through the transition training fund, we have also provided a further £12.5 million to support innovation and business resilience, informed by the work of the energy jobs task force. This included £10 million of Scottish Enterprise funding to help firms to reduce risks associated with carrying out research and development. To date, around 78 innovation projects with a total project value of around £16 million have benefited from around £7 million of Scottish Government support. £2.5 million was set aside for business resilience reviews, providing targeted support from industry experts with over £2.5 million committed investment so far. Scottish Enterprise and the Highlands and Islands Enterprise are providing practical assistance to the supply chain and have run six resilience in oil and gas events, welcoming 217 delegates from 144 companies to hear from experts on strategy, operations, finance and market resilience. In addition, our competitive business rates package also targets support where it is most needed, capping rates increases for it in the region of 1,000 offices in Aberdeen and Aberdeenshire, as the local area most adversely affected by changes in the oil and gas sector. Councils are able to apply further rates reductions and we continue to work with Aberdeenshire City and Aberdeenshire Council to inform that consideration. Thank you for that answer. Could the minister also outline what he believes to be the key asks of the industry to the UK Government at this time, which will support the considerable work done within the limited powers of the Scottish Government and may also allow companies and the oil and gas workforce to plan for the future? Minister. I certainly recognise the balance between devolved and reserved powers. It is encouraging that the chancellor has finally listened to repeated calls from my predecessors in the industry. I have been repeatedly making for some time to ensure that the right assets are on the right hand. We have seen some recent deals of that nature in terms of transferring some shell to Crissure and BP to Enquest, but it is crucial that the UK Government turns talk into action rather than simply forming further talking shops. While the panel has been established, we really need it to come forward with concrete proposals that can help the industry. This week's oil and gas UK business built and highlighted the urgent need for fresh capital investment to stimulate activity and maximise economic recovery. We believe that steps must be taken to incentivise investment and exploration, which would be of particular help to the supply chain, which is likely to continue to see some tough times ahead. We are doing everything that we can within our devolved powers, as I have outlined in my original answer, but we really need the UK Government to step up and stop talking and do something to help the industry. Ross Thompson Thank you, Presiding Officer. The Cabinet Secretary for Finance, as well as the Minister for Business and Innovation, has said that business rates raised locally and collected locally stay locally. However, Aberdeenshire Council this morning, councillors were advised that of the £116 million that they expected from business rates next year, they are only getting £93 million from the Scottish Government. Can the Scottish Government tell us where the £23 million has gone? I think that the member raised an issue, which is important, but, as I stressed in my own attendance at an event in Inverourie, I think that Mr Thompson was present. This is an issue where revenue is retained by councillors, but on a multi-year basis. I will ask my colleague, Derek Mackay, to provide further detail of that mechanism so that it is understood by the member and other members in the chamber. Lewis MacDonald Thank you very much. The minister will know that, of the 10,000 businesses in the northeast hit by the recent rates to evaluation, 8,000 of those have had no benefit from the selective cap that was announced on 21 February. Will the Scottish Government not now offer some support to businesses such as that owned by my constituents, Graham and Linda Dawson, who have faced not only a 50 per cent increase in their rates liability but, as a result, have been taken out of any access whatsoever to the small business rates relief scheme, or was Stuart Spence of the Markliffe hotel right when he told this morning's press and journal, I just don't think that they have grasped the problem in Aberdeen? Lewis MacDonald As Lewis MacDonald knows and has been explained on this chamber on a number of occasions, individual rates valuations have been set by assessors. The Scottish Government ministers do not have any role in setting valuations, but what I would say is that clearly any business such as that highlighted by Graham and Linda Dawson in his constituency would be able to take forward an appeal. Speaking to the assessor for Aberdeenshire, it is very keen to engage with businesses on an informal basis to see if there is any mistake being made in the valuation and to take forward any changes that could be arising from that. If, of course, the Dawson's are unhappy with the outcome of that, they can still take forward a formal appeal and will have up to six months to do so. It certainly encourages them to engage with the assessor who seems willing to have detailed discussions about individual businesses on an open-book basis to see if there is any unfairness in the valuation that has been arrived at. However, we continue to support businesses as best we can with national release and, indeed, local authorities are taking forward local release as well. Alex Cole-Hamilton To ask the Scottish Government for what reason prisoners contesting their convictions are reportedly denied privileges afforded to the wider prison population. A system of privileges is in place in every prison in Scotland, although the system may contain different provisions depending on the security category of prisoners or for prisoners detained in specific parts of the prison, it does not restrict privileges for those contesting their convictions. Alex Cole-Hamilton I thank the cabinet secretary for that answer. My constituents Stephen Green and Alan Dambrosio are both serving seven years in HMP Edinburgh. They both maintain their innocence, and I personally find the grounds for their appeal most compelling. They have already suffered unacceptable delays in the appeals process and have been told that they cannot progress to Castle Huntly, and the significant privileges that are for them have already been given to them. They have been told that they cannot progress to Castle Huntly, and the significant privileges that that affords while they are contesting their verdicts. Does the cabinet secretary agree that denying prisoners progression in this way puts unfair pressure on those who might be innocent to abandon their appeals, and what steps does he plan to take to address that? Alex Cole-Hamilton It would be appropriate for me to comment on an individual case relating to two of Mr Cole-Hamilton's constituents. Those are matters for the courts to determine if any appeal is being pursued. What I can say to the member is that denying the index offence does not automatically exclude an individual from progressing to less secure conditions. However, the Scottish Prison Service must consider the risk of an individual before they consider whether they should move to less secure conditions. The process for that work is being taken forward within the Scottish Prison Service through the risk management team within an establishment that is responsible for considering whether a prisoner should move to less secure conditions. Where an individual denies some or even part of their index offence and that that restricts their access to being able to participate in any of the behaviour programmes that the Scottish Prison Service operates, the risk management team can also consider the findings within a psychological risk assessment as well. It does not place a complete provision that prevents them from being able to progress to less secure conditions. However, those matters are considered and decided upon by the risk management team within the establishment. Claudia Beamish To us, the Scottish Government, whether it will provide an update on environmental concerns regarding the aquaculture industry production targets. Minister, Aquaculture Scotland provides world-class products, namely farm salmon and trout, which have the potential to contribute £3.6 billion annually to the Scottish economy, supporting 18,000 jobs across the supply chain by 2030. The sector supported by the Scottish Government must strive to be a world leader in innovation and demonstrate a global model for sustainable growth. At the same time, however, we need to ensure that there are appropriate measures in place to protect Scotland's water environment from any adverse impacts. Claudia Beamish I thank the cabinet secretary for that answer. The industry is significant, of course, for employment to fragile coastal communities. As the industry develops and the Scottish Government consultation, which I understand is about to open, goes live, it is important to consider environmental and welfare issues as well. Will the Scottish Government and the cabinet secretary consider welfare assessments into delicing treatments and the success or otherwise of cleaner fish, which is a more environmentally friendly way of dealing with this intractable problem? As I brought forward in my amendment, which was actually turned down by the Scottish Government to the Aquaculture Act as it now is, a farm-level assessment for reporting with a delay to give companies an opportunity to sort out any problems and to protect their reputation. Michael Matheson In principle, the member raises very reasonable points and one that we all share. As I have already said, we need to have appropriate measures in place to protect our water environment. She is quite correct that there is a forthcoming consultation on a new licensing framework. This new framework will seek to help the aquaculture to expand, but within sustainable limits. I am pleased to inform members who may not follow this as avidly as I am. Figures published by the Scottish Salmon Producers Organisation on 13 February show that reported sea-lice levels during quarter 4 were the lowest since 2013, which is very welcome to use. However, we need to do a lot more work, including the thorough assessment of all planning applications, and I can assure all members that that is the approach that we take. Tavish Scott I hope that the cabinet secretary might accept that fish farming is one of the most regulated industries in Scotland and needs to be supported through that regulation. Would he include a beamish's point, though, except that the marine centre in Scalloway is undertaking field trials into the use of lump-sucker fish as a mechanism for dealing with sea-lice, which is indeed a grave problem for the industry? Is that the way forward that he proceeds for the industry, and will he make sure that his research funds go into supporting that kind of initiative? Michael Matheson Yes, I am very happy to agree with the member, and indeed I was not so long ago in Shetland and more recently last week in Fort William, unable to speak to people about the success that fish farming provides in Scotland for our most rural communities, where there would not really be many other obvious employment alternatives. I think that Tavish Scott would also agree that salmon is the most climate-friendly food with the lowest carbon footprint of any food so far as I know in the world. This is a great Scottish success story and we are determined to write new chapters there and then. Liam Kerr To ask the Scottish Government whether it will provide an update on the proposed integration of the British Transport Police in Scotland into Police Scotland. Minister, how is it useful? The Scottish Government's railway policing Scotland bill was published on 8 December 2016 with the objective of paving the way of integration of British Transport Police into Police Scotland. The bill is currently subject to parliamentary scrutiny. Liam Kerr It is the opinion of, among others, the rail operators, the rail unions, the travelling public, the BTP federation, the BTP itself—now even Police Scotland—that this merger is unnecessary and threatens passenger safety. Deputy Chief Constable Hanstock has said that we have not been able to identify any operational or economic benefits. The BTP federation has said that the force is an established and successful model and highlighted an inspection that was so successful that no recommendations were made. Minister, the British Transport Police is not broken. What is the Scottish Government trying to fix? Minister. Let me make a couple of observations from the remarks that the member has made. The first I will like to remind the member that, of course, the devolution of British Transport Police is a result of the Smith commission that is reached by all parties coming together in consensus. The second point—oh, they do not like that very much at all. They will not like the second point that I am going to make, either. At that point, of course, is that I was looking through the consultation responses to this very bill that we have brought forward, desperately looking to what the alternative is that the Conservatives are proposing. Presiding Officer, I could not find any consultation response from the Conservatives whatsoever. Let me say this. What we are doing with British Transport Police is ensuring that it has the same level of accountability as Police Scotland to this Parliament, which, of course, previously did not have. If Mr Kerr, in the way of being constructive, would like to join in the next meeting that I have with rail operators, as I did yesterday with ACC Higgins Police Scotland and the British Transport Police, he is more than welcome, because he will find very, very soon that the way that he has characterised their views on British Transport Police integration is not their view at all. In terms of being constructive, I will come forward with the proposals of what the alternative may be, but I will come and have a conversation with the rail operators and you will find that the way that he has characterised it is not the way that they view integration at all. Kenneth Gibson Thank you, Presiding Officer. Can the cabinet secretary confirm the integration of British Transport Police will mean a more efficient and effective service? Rather than wait on occasion for a considerable period of time for BTP colleagues, local police officers can be drafted in to deal with crimes on our railway network much more quickly. It was touched on there in the previous answer, minister, but you are not surprised why the Tories in this place are so opposed to this, why their colleagues in Westminster were so keen to devolve it. Kenneth Gibson A couple of observations, of course. The UK Government is looking at integration of British Transport Police south of the border with other infrastructure authorities as well. Now, it has not made an announcement on that, but I assume that the Conservatives in this chamber will be equally vocal in their opposition to that as they seem to be on our plans at the moment. The second point that I would make is that the ACC Higgins at the Justice Committee just on Tuesday gave an absolute assurance to the British Transport Police that we know that they have expertise, and that expertise will be maintained in a railway policing division within Police Scotland. That expertise, which has been gained over many years, will be protected. The funding that goes to the British Transport Police is protected, triple-lock guarantee in terms of jobs, pensions and pay. That means that the safety of the commuter passengers and those who use our railways is paramount in our minds as a Government and, indeed, in the minds of Police Scotland and, of course, the British Transport Police. 5. Jackie Baillie To ask the Scottish Government what its position is on NHS Greater Glasgow and Clyde's review of GP out-of-hours services. The out-of-hours primary care system has been facing increasing challenges with pressure of work rising due to significant numbers of people seeking help and due to the lack of available GPs willing to participate in the out-of-hours service. It was with that in mind that we published the report, Pulling Together, Transforming Urgent Care for the People of Scotland in November 2015, which was led by Professor Sir Lewis Ritchie and followed extensive consultation with stakeholders. The review highlighted the need to think anew about what is best for urgent care for the people of Scotland and that that would require transformational change across many sectors. The review by NHS Greater Glasgow and Clyde has been undertaken to ensure a safe and sustainable out-of-hours service. We have been assured that the board will be undertaking meaningful engagement with the public to shape its future provision of its out-of-hours service. Jackie Baillie The cabinet secretary will be aware that, over the last three weekends, there have been no GPs available to cover the out-of-hours service at the Vale of Leven hospital. Although I understand that the health board is reviewing the service, it has given absolutely no guarantee about operating hours continuing. Will the cabinet secretary guarantee that current evening and weekend services will be fully retained after the review, or will there be cuts at my local hospital? The Cabinet Secretary for Health and Sport has advised that the closure of the out-of-hours service at the Vale of Leven hospital on the dates that Jackie Baillie referred to was a temporary measure taken to protect patient care due to a staff shortage. The hospital did continue to have medical and nursing staff on-site in the minor injury service, and patients requiring emergency medical attention were treated by the service. For those who needed a primary care service but were deemed not to be in an emergency, transport was offered so that it could be transferred to an alternative out-of-hours service. In terms of going forward, the review will be getting under way. We need to wait until we see the outcome of that review. However, it is clear that we need a robust, safe and sustainable out-of-hours service that is available to people within Jackie Baillie's constituency or elsewhere within Greater Glasgow and Clyde. We should allow the review to take its course. I will then make sure in discussion with Glasgow and Clyde that that aspiration is delivered. To ask the Scottish Government what assessment it has made of ambulance provision in the Moray area. The deployment of ambulance resources is an operational matter for the Scottish Ambulance Service. The service continually reviews demand and resourcing throughout the country to ensure that it is delivering a safe and effective service that meets the needs of the people and their communities across Scotland. Cabinet Secretary will be aware that, last week, 95 per cent of ambulance staff who are unite members supported the call to start official dispute talks with management. Staff have said that bosses are clueless and more interested in spin than sorting the service. In Moray, we have had a new ambulance not being used for months because of a lack of driver training. Administrative errors, meaning that the stock of oxygen in Elgin was so depleted that it had to be rationed by ambulance staff because their tanks were in the red. What is the cabinet secretary's response to the catalogue of problems in the area and will she agree to meet with me and members of the Scottish Ambulance Service to urgently discuss those issues to ensure that local ambulance staff are properly equipped to do the job and the public in Moray get the service that they expect and deserve? Cabinet Secretary? I am aware of the issues that are raised in the north of Scotland and have been in contact with the service to discuss those matters. In fact, I discussed that with the chair of the Ambulance Service, David Garbat, just this week. I am reassured that work is on going to address the concerns that are raised. It is very important that those concerns are addressed and have been asked to be kept informed of any developments. I should say that the Scottish Government has invested an extra £11.4 million in the Scottish Ambulance Service, and that has helped in the recruitment of 200 additional paramedics this year, 30 of whom will be working in the Grampian area. I would hope that that is something that the member would welcome, because that is important resources that his constituents will benefit from.


What's up traders? This is Tosh. I go by T Bradley 90 in the mind best and club chat today We have a very special and new video for you guys one of our head moderators in MIC Austin who goes by a loha trader in chat who is both long and short biased has started a weekly Thursday two-hour Q&A webinar for members He talks about MIC strategies and also takes members questions live While this is just a sample of the entire two-hour webinar If you want to see the full-length version or any of our exclusive content then become an exclusive MIC member Alex did a good job of Reorganizing the video website and the MIC strategies that are the ones that I want to go over in this webinar So what we're gonna do is I'm gonna go over important trades I made recapped or not and every week I'm gonna be doing this like there's gonna be different segments of this webinar like some of the segments might like Important trades is gonna be a segment market sentiment is gonna be a segment key topics is gonna be a segment We're gonna have a watchlist segment segment. You know, I might have like a One-on-one invitation in the future where I invite members on Where like we talk about their trades that might be a segment. So there's gonna be different segments week to week So hoping that we can get Hoping that we can switch it up every single week and go over different facets of trading There might be a psychology segment one week. So and then we're always gonna end with the question and answer segment What this is all about? bow was long this bow was long biased on this pre-market and so was I and What was what was really? The the conflict here was that we know it's a pig We know it's a piggy company, but because the it's got that beyond that beyond IPO sympathy to it It had that that kind of hype factor for that sympathy momentum that we always see in the market another report trade This one was today Workout work horse work out work horse. Yeah, and so this was a really conflicting trade where Because there was two things weighing on my mind the move is too big You know, we had it got up to five pre-market, right? Like the move was definitely too big for For a float this size, I think the float was like 40 or 50 million right like this was a this was a massive float and it was What I consider to be unsustainable for The float meaning like if something was up that much like when we're up from like one I'm thinking that we're immediately gonna sell right out of the gate like because it there's just gonna be an overwhelming flood of supply So yeah market sentiment. I just wanted to kind of go over. I want to do this week to week We're just coming off of earning season And for those who don't know earning season happens four times a year It happens in April. I think April July April July October and January and this is because It's quarterly right quarterly earnings and January January February March Normally they come out a month later in in April and then you know like April May June and then the next month is July. So that's why you get them. They typically last about four weeks and so we're coming off of the earning season so This is kind of explains why it's been really dead lately and you know, if you guys have been Avoiding the boredom trades really good job everybody because it's been really tough Like I've I've actually not been doing the greatest.  Cool so Where are we at here? Oh, this is the thanks guys So one of my weaknesses I say I enter a trade to long at 210 with a 250 goal in mind and the stock Will range break through 220 from From 210 to 230 then it starts testing The previous resistance now support at say 220 and I sometimes let it go at 220 and it runs to 240 Stop 250 well immediately before I even finish. I I feel like that's you changing your risk Because without a valid reason to right like that this comes down to the thesis part You got to have a reason why you're in why did you long at 210? Was there some reason that the support was holding? Figure out where your thesis is however other times I hold for the exact goal and the 220 cracks and then say it goes to two and I'm out now because that was my previous risk I go from a green plus 20 to a minus 10 and this happens often. How would I approach so? This is probably an example of why did you get in right there at 210? There's probably a reason why you got in at 210 right and that reason is probably because There you thought that it was gonna go up right away, right? You thought it was gonna go up right away and so you were right, right? You got you got You were rewarded, but you didn't take that you didn't take the profit on your reward right there Sometimes when you enter there's two reasons to enter right and that means that you didn't you're not paying yourself for being right Part of the time and you got to pay yourself when you're right on half of the trade, right? with the 250 is the the the goal in mind, but like what you said but like To move your your risk back up to 220 you have to realize that stocks like to play right stocks like to Test right like they want to test that to 20 level like they want to go over and under and make sure that like there's enough Bitters like people want to wait because a lot of people don't want to chase I want to make sure that higher lows are gonna happen before they get in So that's why you see a lot of over and under stuff at at like these levels that you're important That you deem important because most people deem important because support resistance is kind of that self-fulfilling prophecy So you want to kind of like this is where like I think your patience might need to Increase a little bit. You need to stick to your stick to your trade stick to your process because There's nothing work.  That's gonna eat at your mental capital So yeah, and so that's why I say make small changes right take some off for the profit right there You know take some of that profit off up there when you're immediately right Don't don't like just change completely and say well It didn't work this time I got a change and take all of it off here or not stop out here or yes stuff change my software No change my stop you want to You want to stick to that process stick to that risk, but what you can do Now what I what I don't want to give you the message of is if you are feeling uneasy about a trade like I only so I only Deviate from my plan if one thing happens if significant information that I did not expect happen So this is a trading rule that I have it's I do not deviate from my plan unless Significant new information arises now this can be news pops up or I see something unexpected in Price action the second I see something unexpected like a huge volume count a lot of nowhere I know that like there's something in the trade that I don't know right There's something in the trade that that I did not foresee Something is going on that I'm not sure that's the only time where I'm willing to like move my risk or change something or get out because There's something that I didn't foresee So I hope that answers your question Eat Baca What are you looking for in filings so oh Great great Scott. Um, so what I'm looking for in filings is kind of what everyone else is looking for I'm just looking for I if so I want to know if I haven't seen the company I'm typically I typically have every company's a pig and Until proven otherwise for the small caps and like if or the rule is if it's a pig before it's 100% likely still a pig now. So like if I'm training SAEX like I know the story there, right? But what I'm looking for is 425 I'm looking for shelves One thing I really like to do is take a look at I'm operating cash flow that really helps me to know If if they're making money or not, right? That's one of the key metrics I like to look at is the operating cash flow because this tells me if their business is actually making money And this kind of gives me the piggy level indicator if they're if they're operating cash is negative That means that they can't sustain themselves through Operating and that they have to use financing So this is kind of my piggy indicator is the operating cash So in a diff in addition to looking at cash balance and seeing if they need cash And if it coincides with the story of there being a raise, right? Sorry, they're being a shelf in there and that a raise can be there like that might give me some kind of indication to like this It might and it doesn't mean that I still might not long the stock But it you know like if because I'm a momentum buyer if I see momentum gonna buy it But it might make me more conservative on myself, right? That's what that's what it might change It might change the the way I the way I trade it Maybe I'm more conservative with my entries too Maybe I don't go and buy that break because I'm afraid it's gonna stuff into dilution right or I might not long it at all So that those are the main things I'm looking for I'm looking for cash on hand I'm looking to see if it's a piggy. I'm looking to see you know, hi, that's always good I want to see if they've been profitable before or if they've just continually been not profitable I want to see dilute at the markets are good shelves are good for shorts For shorts and for confirming a piggy and operating cash flow Yeah, every time I talk to He's on the bar doing his thing. No Thanks, Austin. Well, thank you No, thanks, Alex Under what circumstances Under what circumstances use market orders to get in and out of trade, I don't think I've ever used a market order in my life Um, I I think yeah, I do have a panic button and it is an ARCA market and I think the only circumstances I would ever do like as if I Need to get out all of my positions and it's I need to get out all of my positions right away Like I think like I'm gonna lose power or something like that's about the only time I don't use market orders at all. I'm never and I'm never really worried about like not getting the fill because Where you can all like if you put a limit order Depending on how thin the stock is I guess but for most stocks like if you put a limit order five cents above the price You're probably gonna get out all of your position. That's you're trading like 20,000 shares or something like that, you know And it's a thin stock, but you can always like I much prefer to not give them a blank check Because like you can totally like I have that fear of like I don't know I can only assume but like I have that fear that you're gonna just They're just gonna see that market order and you're just gonna get a shitty fill when you know They're the market makers are they're in the business of making money So they want to take the best offer in the best bid so if the ask is at $2 and you put an order at 205 They're you know, they're gonna take it right like you're probably gonna get out no more You're probably gonna get out so I Much prefer using out of them or out of the market or in them in the market limit orders If that's the right way to say that Joe Kelly's lap is exactly what I'm talking as yeah, exactly To the T. I actually watched it today Yes Yeah, great info. Thank you. Thank you. Cool. Thanks marketable. Yeah, basically I mean if you if you put a limit order way above the price you're gonna get filled like So well, hey, it's only been an hour and 20 I talked to really really fast There are any more questions like anything else we want to go over I Was totally talking the fast. I actually drank coffee before this. Oh Man revenge of the Sith Revenge of the Sith man because of that because of the Anakin and Obi-Wan fight Definitely, dude, definitely slow down next time. Yeah, but I see I don't really hate Jar Jar Banks Like I'm not like he I know he was caught comedic relief But at least they made him play a role like he was the reason why palpates, you know He his foolishness is what put Palpatine in power. So at least he had a story arc Yeah, that was really fast I You know make a bigger make a bigger PowerPoint next time But I just the first one I just wanted to go over the classics So as a long-biased trader, can you briefly describe the process as far as getting locates for shorts? Like what do you have to say? What do you have to say to say I need locates to short today? So um, I Have a rule of thumb where I Don't like to locate unless I'm willing to put a starter position on at the time now This is for B setups only like if it's a B setup I'm only willing to locate if I'm if the price currently right now I'm willing to put at least up my foot in the water at least get my toes wet, right now If it's a potential even if it's a potential ASAP if it's a potential ASAP I'm locating pre-market at the whenever I can because you have to you definitely have to because it's Um It's an a setup it's gonna like even if you don't use it three times You know, you don't get the opportunity to look at three times that four times kind of pay for it if it's an a setup You meant see did I answer that wrong so as long as as a long bias trader Can you briefly describe the process as far as getting locates for shorts? So yeah, even though I'm a long bias. I still get shorts every single day Oh, actually no not anymore almost every like today. I located um Workhorse I guess but I did short it What do you have to see? To say I need love. Yeah, that's it What would be your best advice to a new trader to become consistently profitable less is more bro Less is more you do not need to trade every single day.  Sometimes I sometimes like I've had profitable weeks Where I only trade two times a week and unprofitable weeks right trade every day, right more trading doesn't mean more profits Um, yeah, so it's literally just honing on that hone in on the On on just one thing that you're good at or two things that you're good at and just if you don't trade for a week That's okay. Like it's better than like a zero days better than a red day PDT sucks, but I bet it really but I bet it saves a lot of people. Yeah Yep True that For a first for a first bounce once the price has spiked Created friends and then spiked more. Are you immediately putting your scale in buy orders and Scale in buy orders and stop limit risk and profits So ideally if it's created friends and spiked okay So yeah, so once it's created a friend and it keeps spiking and so I know where I want to put the order Is that that's what you're saying and am I immediately putting the orders in? No, and let me tell you why because what if it like keeps going up higher than I think You know what I'm saying? What if it keeps going up higher than I think like I kind of want to see the top kind of happen first because the Orders might not even be relevant Like what if it just goes way past the friends, you know, I'm saying and and then to be like sometimes I could be a true parabolic where the the first bounce is gonna be where the friends isn't even at right? so but most of the time that's going to be so I just wait because Normally you're on the front side like what if what if you put the orders in and like news comes out like an offering or something like And then you get filled or something. I don't know like I Typically just wait until it's starting to tank because I want to see how it rejects What if it stuffs on like what if it stuffs on like a million share volume candle? I might not want to buy that first bounce, right? I might not want to buy that first bounce if it's stuff on like a million share volume candle might just say You know, this is the first bounce that I'm skipping so I won't do that I typically wait to see how the top formed. Who's my favorite game of Thrones character? For multiple for more reasons than one are yeah Yeah Team Johnson. Yeah, he totally deserves a throne dude in my opinion. Oh, man Good questions guys. Good good good stuff Yeah, man. Hey, good luck guys Thanks, Sam No silly questions unless it's Googleable. I know this might be a silly question But a more profitable longing or shorting Gosh, you know, that's a tough one dude. I haven't tracked in a while, but like um, I think still um It's probably about 50-50 now. I Honestly, I have to do the math because I don't know shorting overall because I definitely lost a lot while trying to learn How to long near near late 2018 so overall shorting Definitely overall shorting, but I have high hopes for longs in the future Yeah, guys. Well, thanks. I mean 30 minutes early, but like I said, I talked kind of fast For sure guys. Um, and let and please guys give me feedback. Let me know Let me know like what I can do to Something else if you guys have an idea of something else that I can do or do something better or or So may please let me know like just send me p.m. Is Um, and and I'll take it to heart We're gonna like I said, like I'm gonna have different kind of segments of the show kind of like how Like I guess the Jimmy Fallon show he has like different segments I guess it's kind of how this webinar is going to be so hopefully like I don't maybe we'll do us Something about psychology and in the PowerPoint next week Hey traders, this is Tosh I go by T Bradley 90 in the my investing club chat Just wanted to reach out and say if you have any questions about M. I see joining M. I see maybe you're a member already You have three ways to contact myself personally and through M. I see you can hit our social media You can hit me through pms in chat or you can contact us through my email at Tosh at my investing club calm That's TOSH at my investing club calm I will get back to you in a timely manner And I'm saying this because I'm here to help and I don't want anybody to be afraid to reach out and ask any question That they have we are here for you guys. All right. See you guys


My name is Kevin Louie, and this is Callin Rain, and today we're jointly presenting on how we scale back in authentication at Facebook. Since Facebook's security architecture involves a whole lot of complex components, this talk is unfortunately not going to be able to cover every detail of the entire system. Instead, we're just going to focus on highlighting the most interesting aspects of our security infrastructure and also the tools we help made to scale authentication. So last month, we announced that our fleet consists of 11 data center locations across the US and Europe. Our data center has worked together to host 2 billion monthly active users, and as a result, our internal infrastructure is incredibly intricate with layers upon layers of caching, replication, and cross-service coordination during each user interaction with Facebook. So keeping this entire infrastructure secure can be pretty challenging on multiple levels, and at the very least, we certainly don't want any external actors to have unimpeded access to our infrastructure. But even though we pour a lot of resources towards enforcing a strong network security perimeter, it's also important for us to reduce the surface of trust within this network perimeter. So primarily, we do this by enforcing granular access control between services. To help understand the structure of these access controls, we can classify our internal services into roughly three categories based on their proximity to our route of trust. So our route of trust includes our core security services, with which we bootstrap security for the rest of the network. This is essentially our walled guarding and includes, for example, the only machines which have access to Facebook's master keys. The intermediate layer of trust includes machines which are allocated for some of our critical backend services. An example of something in this layer would be machines which hold a service-specific encryption key, which is used by the service to access its own data. And finally, the lowest layer is everything else, including the machines that directly serve web requests to load Facebook.com. In order for these three tiers of trust to be meaningful, it's important to keep the walled garden as small as possible. So having fewer machines in the top trust tier means that we can limit the number of hosts which can access master keys, which then means that we can implement solutions which increase the physical security of these machines without having to worry too much about scaling issues. Also, we can carefully audit each and every attempt to manually access these machines. Now if the top tier of trust had to scale with a total number of Facebook servers, then we would find that all of the extra preventative measures we applied to this tier would be a lot less effective. How to keep this tier as small as possible while transitively extending its security to the rest of the machines in our fleet is the motivation behind many of our efforts in securing our infrastructure. So before we dive into how we address this central problem, we'll start by introducing some of the fundamental building blocks of authentication and authorization that we rely on at Facebook. So these four components constitute the root of trust within Facebook. First we have a key server which has access to all of our master keys used for cryptographic operations. When a client wants to encrypt or assign something, it can send the plain text over to this key server which then returns the encrypted results or the signature. And this means that we don't have to distribute these master keys to all of the clients which need to use them. We have a root certificate authority which is responsible for issuing and signing certificates which associate identities with machines and a login service which is responsible for issuing and signing user sessions which associate identities with external users. And finally we have an authorization service which controls all of the permissions for which entities can access resources within our infrastructure. The central components of authentication and authorization are identities and ACLs which stand for access control lists. We define identities in a flexible and granular way that allows us to associate a unique identity for every user, every machine, every service, job, and so on. These identities can then be listed in an ACL which is just a publicly verifiable mapping from a specific resource name to a list of identities which can access that resource or perform that action. Okay. So with these pieces in place we can establish securely authenticated connections between hosts in our infrastructure. So in this diagram we have a service owner who is going to start a job. We're going to call that client in green. It's going to need to communicate securely with a remote server. So the first thing that happens here is that the service owner requests a certificate from the root CA on behalf of the client. The root CA here has a list of all the ACLs for all the possible clients and it's going to check the service owner's identity against the ACL for the request of permission of that client's identity to make sure they can actually have access to deploy a job with that identity. Note that the ACLs here are all coming from the authorization service which is distributing them. The certificate that the client receives will have the client's name in an extension field. We use an extension field instead of a common name because we want to put a lot of identities in there and there's actually a limit to the size of that we can use. So once the certificate has been deployed to the job, it can be used for TLS connections that the client can negotiate with the service. So let's look at the server side. When the service receives a request, it's going to parse the client's certificate and extract identities from it. It will then have an ACL that it has loaded from authorization service and it's going to check that client's identities against that on the list and it will allow or deny access. So here's a slightly simplified version of the diagram from the last slide. So this shows authentication and authorization with one client and one server. So if the authorization model in your infrastructure is this simple, this TLS is the state of the art. We get integrity, we get privacy, we have an authenticated connection. This is actually not far from what would actually happen for direct isolated connections between clients and servers in our infrastructure. However, as you all know, production environments are not this simple. So in reality, a large production network is complex and doesn't fit the simple model of point-to-point authentication and authorization we just showed. So there are two key differences I'd like to highlight between that model and what actually happens. So first we have a complex service architecture. We have requests that can travel through layers of hosts before reaching a destination that will perform authorization based on the original client. At first, it seems like we could just perform authorization on each hop of that request chain of viewing each one as a separate point-to-point authentication that we could authenticate and authorize. However, Kevin spoke earlier of the different levels of trust within our infrastructure. What happens when a client needs to communicate with a service through a less trusted intermediary? So let's look at that. For example, here we have a single intermediate proxy transmitting requests from a client to a destination server. The client and the proxy have distinct identities. These were deployed with certificates. So the client's original identity gets lost when the proxy terminates TLS in the first hop. The request would then fail the ACL check at the server. So if the proxy is only used for one service, this isn't an issue. We just treat the proxy as logically equivalent to the service. So to do this, we would just put the proxy on the ACL, and then both the proxy and service would check the same ACL. But if we don't want to consider the proxy as trusted as the service or client, we wouldn't want to give it unrestricted access to the service like this. This also is more difficult if the proxy is shared or if there are multiple proxies, and this could look something like this. So here we have the proxy, and it's now responsible for an ACL for every service accessible through it. And this increases the complexity of the system. Sharing responsibilities for authorization like this increases the operational overhead involved in managing authorization over time, and it's liable to be misconfigured. So to summarize here, relying solely on TLS authentication authorization can be less practical when we have intermediate servers in our request flows. So we've found that attaching cryptographic tokens to requests can be a useful companion to TLS-based authentication for a few reasons. So first, they're fairly flexible. We can put anything we want in tokens, and we aren't constrained by specific protocols or data formats. We can represent identities for users, services, machines at Facebook, not just the identities that we issue certificates for. These tokens are also quite portable. They can be easily forwarded through proxies or immediate servers. They're generally transport agnostic, and are just simple serialized structures we send over headers. So finally, tokens allow us to scope the rights of the identity they carry. Each token can be limited to a narrow use case, ideally to a specific request. This limits the impact of a compromised token to the overall security of the system. So this kind of scoping isn't as easily done with TLS authentication. So for the remainder of the talk, we're going to present two types of tokens we created for authentication. The first is a public key certificate-based token, and the second is a symmetric key variant called crypto off tokens, and we call them cats for short. This leads to a lot of cat puns. So certificate-based tokens can be seen as a simple extension of TLS authentication. Essentially the idea is we use the existing credentials the client already has, the certificate and private key we talked about previously, and we make a token out of it. So this token is going to be serialized and attached to headers of each request. When the token is received by the server, it is validated and used for authorization, and you can see how this would solve the problem of the proxy that we presented before. So here's a closer look at how the tokens can be constructed and validated. So to create them, the client creates a structure with their certificate and metadata describing the use of the token. So this metadata will contain the intended proxy to use. It will contain the resource it is used for, so at the destination side, and then any actions will be performed on that resource. And this resource is generally mapped just to a specific ACL within our authorization infrastructure. We'll also add some metadata I don't have added here, things like timeouts and other additional application-specific data we'll put in there. So we then serialize this, and we're going to sign it with the client's private key corresponding to the certificate. So this is added with the signature and serialized into the final token. So when the server side, once we receive a token to validate it, we're going to first make sure that that signature matches the certificate inside, and then we validate the certificate to make sure it was actually issued by our root CA. We also need to validate the metadata, which involves checking that the service relaying the token has a valid identity, so this is the proxy part, which is the token. We need to make sure that the token is actually applicable to the resource that is using it on the server side, and that the scoped action that is in there, action or actions, matches the actual request. If everything checks out here, we will use the certificate as if it were coming directly from the client. This just means we extract the identities and check them against the services ACL. So we implemented and deployed the certificate tokens, and as you may expect, we quickly found that creating and validating them on every single request becomes completely infeasible very quickly for any service with a reasonably high request rate, because these are all public key operations, and they're very CPU intensive. So what we can do here is we can add just an LRU cache, one for the creation of the client and one for validation at the server. The creation cache is relatively simple. It only holds the small set of tokens for that client to use for other servers. The server side validation cache is a little bit more complex. So for creation, we have to generate a single public key signature, which then must be validated by the server along with the certificate chain. Each client must generate a unique token for each proxy server resource action that it communicates with in some request flow. This can be used then for any destination server that is involved in that request flow. So this means that the creation cache can stay quite small, because a lot of these clients, this doesn't blow up very quickly. So the validation cache is a little more complex. The client can reuse a token for two machines running the same service, but if we have two client machines making requests to a single server machine, even through the same flow, the server will see distinct tokens, because the client certificates are distinct. So as a result, the size of the server side validation cache will scale with the number of unique clients that are sending requests to it. This can get quite large. Because of this, we can't actually cache the entire token. It ends up being just a lot of memory. Instead we're going to just extract the metadata and identities from the token, get rid of the certificate, get rid of the signature, and just put that in the cache. Without that in there, the rest of the data in the token can be efficiently cached without much memory blow up. So you might note here that you got rid of the certificate and the signature. How do we make sure that's equivalent? Yeah, we should make sure that a cache validation is logically equivalent to an uncached one, so we don't have any security vulnerabilities that we introduce here. So we've been using these tokens for long enough to have a pretty good sense of their advantages and limitations. So from an engineering point of view, these tokens are extremely scalable and reliable. They have no external dependencies at runtime, other than the client credentials that are already present on the host. As a result of this, we can attach them to tens of millions of requests with our infrastructure, with extremely reliably. They're also quite simple. They piggyback on our existing security infrastructure, this PKI we have for distributing identities. This means we have less code to write and maintain, and fewer dependencies that can fail. So lastly, the scoping we use of these tokens is generic and pretty reusable. What I'm talking about here is the proxy resource action model. Because of this, we've integrated them into Facebook's routing framework, so they're just automatically added to any requests that need them. So they also have some drawbacks. First, the tokens are quite large. They contain the entire client certificate, and they have an additional public key signature on them. So with some protocols, connection-specific headers are actually reset every single request. So this is extra bandwidth that we'll add up. The fact that they're public key makes them CPU-intensive to create and validate, we can mitigate this sum with caching to make them feasible for services with high request rates, but that's not always enough. Lastly, the tokens are quite coupled to X7-9. This limits them to any identity we can put in a certificate, which is not optimal. It's not all the identities we want. There's also lots of data being transferred in a certificate that isn't technically necessary for authentication, but we have to keep it there because we can't tamper with a certificate. So to address these limitations, we also have an alternate symmetric key approach in these tokens that we use in conjunction with these certificate based tokens. So the way that these symmetric key tokens work is analogous to the way Kerberos handles one-way authentication in that the client asks the key server for a session key or in Kerberos language a ticket, which is tied to the service that the client wants to communicate with. However, our setting is slightly different because we're building authentication on top of the already existing TLS used to secure point to point connections, which means that we don't actually need to support every part of the Kerberos protocol. Also, our setting differs from Kerberos and how we construct session keys. So the session key is a shared secret between the client and service, which can be used to MAC the request. And this MAC is stored in our token along with some extra information about the client. Internally, we refer to these tokens as CATs, which stand for crypto auth tokens, and they can be seen as the symmetric key variants of certificate based tokens. OK. So since these tokens are not certificate based, they are both flexible enough and fast enough to handle authentication for 2 billion users. In our CAT protocol, when the client makes a request to a service, it must first ensure that the request has been authenticated on behalf of an acting user through our login server. It's connecting to must obtain a service key from the key server. And the service key is deterministically derived from a root master key and the name of the service, along with some auxiliary information like time stamps and other properties of the service. We can think of the service key as the output of a PRF, or a pseudo random function, using the master key and the service information as its input. Then the client requests for a session key by interacting with the key server, specifying the name of the service it's connecting to. The key server, which verifies the authenticity of the client, creates the session key deterministically by re-deriving the service key and then performing a second PRF evaluation using the service key with the client information as the input to the PRF. And this is where we divert slightly from the Kerberos authentication protocol. So in Kerberos, this session key would instead be picked completely randomly, and the key server would encrypt the random session key under the service key and send the resulting blob to the client. And it would be the responsibility of the client to forward the encrypted session key to the destination service. The advantage to deriving session keys deterministically is that the mapping from the client's service pair to its session key does not need to be stored explicitly. And so we bypass the inherent reliability and scaling issues that can come with having to query a data store on the critical path of every client request. In our model, the client can now use the deterministically derived session key to create a cat, which contains the Mac over its request to the service, along with the client information. Now, the service can use its own service key, along with client information, to locally re-derive the session key without having to request anything from the key server. And this session key can then be used to verify the Mac contained in the cat over the client's request. And finally, to handle rotations for the session and service keys, we encode timestamp information as a part of the PRF input so that these keys can be enforced to only last for a certain time period before needing to be refreshed. The advantage to using cats is that we move away from public key primitives. And hence, these tokens are more performant and can scale without caches. The single Mac is also a lot shorter than having a certificate and signature embedded in each token. And finally, these tokens don't rely on X509 certificates. So we can move away from identities that are tied to physical hosts and can more readily handle implicit identities associated with users who perform requests. So to summarize, there are three main takeaways from this presentation. Firstly, we have different tiers of trust for our machines. And we constantly aim to keep our route of trust as small as possible. As a result, we can't solely rely on authentication and authorization guarantees that we get from securing point-to-point connections. To tackle that problem, we implement two solutions which allow us to extend authentication beyond the connection, each with or on trade-offs. One variant is closely tied to certificates and therefore is based on public keys, whereas the other is based on symmetric keys. Both of these token primitives have been tested thoroughly within our infrastructure and are being used to authenticate millions of requests each second. So before we finish, we just want to acknowledge all the engineers we work with who have contributed to the development of the systems we talked about, including these tokens and all the different services we mentioned. The techniques and motivations we present today are not at all new within Facebook. This is a lot of history about how we actually arrived at this current state. And many, many people contributed to the refinement testing and development of these systems over many years. We also fully expect that the technologies we present today are not the end of the story and there's still room for improvement in our approach to back-end authentication and authorization. So we're looking forward to input from the academic audience as well. So thank you for listening. Thank you folks for a fantastic talk. We have about 30 seconds for last minute questions. We can get one in, sure. Proxy replaced the tokens and pretends to be the server. Why isn't this the client? Why isn't this not a problem? Yeah, that's a great point. So we can't assume that the, we have to partially trust the proxy here in the certificate-based tokens. If you have completely malicious code in the proxy, it can kind of do it over at once. We see that as slightly better than just giving it the client's identity. So it just can't forge requests, but yeah, we are open to those replay attacks. Sorry, one question. Have you guys done any presentations on the service identification, service identity part of your system? I didn't quite get that. Have you guys done any presentations on the service identity part of the system? How you give services identities and manage them? We haven't presented on that yet. I think there actually might have been a talk from our transport security team at a Facebook hosted at skill conference you could look up, but I'm not totally sure about that. But we would love to do more of these in general. Yeah, we'll be back. Thank you folks very much. I think we need to let everybody go. So let's thank the speakers one more time. Thank you.


First, it's in Andrew Fassett. My platoon is the vertical construction platoon for Alfa Company. So kind of building up the troll bases or taking them down is kind of what we specialize in. The Marines are here to work and they know that. They're here to do a good job and they want to. I'm Lance Corporal Zachary Couch. I'm a 1371 combat engineer from 90SB Alfa Company. Here we're demilling, getting ready for the final push out of Afghanistan. It's pretty tedious work for myself and the other Marines, like using all the power tools. Especially the bolt cutters, those get hard after a while. After maybe at least two or three seven foot hascoes chopping down from top to bottom. It gets pretty tough but with the power saw, the rescue saws, it makes it a lot easier just like cutting straight through butter with it. Having all the sparks flying everywhere, just that power, it's like going straight to the hasco. It's pretty cool. Lance Corporal Dempz Tanika, 1371 combat engineer. Today I've just been helping stack the leftover hasco and cutting the hasco with the bolt cutters. I just like to work, I like to be busy. If I stop, just, I don't know, I feel like I'm not doing anything. I just like to keep myself busy. It feels good to work. To finish this pace, we go into the next one. So, you can just get this deployment over with and go home.