tonight. And I'm Steve Eustis, your moderator for the evening. And I'd like to start by with introductions and I'm going to introduce President Andrew Brown who can introduce everyone else. Thank you, Steve. And thank you all for being here for what I hope is our final remote informational meeting but our first for our city. So thank you all. For introductions, I will first start off with our staff, then go into our city councillors and then other distinguished guests. So first and foremost we have our city manager Regina Mahoney, finance director Jess Morris, Public Work Superintendent Rick Jones, Susan McMurray-Hill, our city clerk, library director Wendy Hisco, as extension recreation and parts director Brad Luck, we have Fire Chief Chris Gaborio, wastewater quality superintendent Chelsea Mandigo, human resource director Colleen Dwyer, communications and strategic initiatives director Ashley Schnellenberger, and community development director Chris Ewan. In terms of our city councillors, we have Vice President Raj Chowla, we have city councillor Amber Tebow, we have councillor George Tyler, and we have city councillor Dan Karen. As for our distinguished guests, we have representative Lori Houghton with us, as well as representative Karen Dolan. Thank you all for being here. All right. Thank you, Andrew. So I'm going to read over the procedures for this informational hearing. This is an informational hearing to discuss the articles being voted on by Australian ballot for the 2023 city meeting. As such, there will be no motions, amendments or voting at this meeting. Pertinent information on this meeting, agenda reports, etc., is on the city website. Attendees must remain on mute, except when recognized by me. Attendees can get in line to make remarks by using the raise hand tool or by using the chat to type that they'd like to speak. People be queued in order of request. Only residents of the city of Essex Junction are allowed to speak. All remarks, questions, and discussions should be addressed to me. Please wait to be recognized before I'm muting and speaking. Then give your name and street address, speak in a loud voice, or your comments may be heard by everybody. As in our usual city meeting, each person should plan to limit their time to two to three minutes so that more people have a chance to speak. As in past years, I will not be specifically timing people, but will encourage people to wrap up if they're speaking too long. My role as moderator is to help you ask your question or make your point. If you need help, please let me know. Above all, be civil and respectful of your neighbor's opinions. Lastly, a reminder that chat window is only to be used to ask to speak. You can type your first and last name and that you'd like to speak. No comments, questions, or conversations are allowed in the chat, and the chat is not part of the meeting record. So that's the background. And what we're going to do is we're going to go down each article one at a time. And then for most of them, there's a quick overview that the council, a different member of the council will go over each one. And then we'll take questions and then move on to the next. So I'm going to start with article one. Shall the voters approve an annual general fund budget in the amount of $11,421,171 for fiscal year July 1, 2023 to June 30, 2024, $10,420,986 of which is to be levied in taxes against the City Grand List. So there's article one. Andrew, are you doing the presentation for this one? I will, yes. All right. We'll go right ahead. So here we have the article in which Steve was just referring to. With this budget, you will see the change here in terms of the summary of our general fund from the fiscal year 23 village budget, which does not include any portion of taxes that went to the town of Essex for the four services. So things such as contributions to the police department, things like stormwater and those types of activities were not included in that budget. You will then see the fiscal year 2022 mock city budgets with inflation that was factored in. Next to that, we have the proposed city budget. So this being the city budget that you would be voting on tomorrow for fiscal year 24. This reflects a change of $730,078 from that mock budget, with a percent change being 6%. That bottom portion of the estimated tax impact, you can see the combined rates and then the proposed rates, their change, that percentage change of 0.4. If you take this number and you find your property tax bill and you look at just your municipal portion, so take out your school portion, so your municipal portion, multiply that number by 0.4%, that should be approximately what the impact of this budget would be on your property taxes. To the home, the average home in Essex Junction, which is assessed at $280,000, those property owners would see a $10.86 property tax increase. The important thing to note here is we all know that the real estate markets is extremely high right now. And so what you will see for your assessed value through the assessor's office is very likely to be drastically different than what you could get on the real estate market. So it's important to note that if you use this $280,000 as your guide, if your home is assessed higher than that number, then your tax impact would be higher than that $10. If it is lower, then it would be lower than that $10. But the important part is to know the difference between the assessed value done by the assessor's office as compared to what your market value would be because those are very different numbers. The main drivers of the salary or of this increase to the budget, the largest portion is salary and benefits, some of which for new positions. So new positions that are proposed in this budget are things like an administrative assistant, a code enforcement officer, which is 50% of that position is offset by the local option tax, as half of that position should receive funding through the rental registry. And so we are using non property tax funding to help start that process. A city planner, an adult program coordinator for half of the year, since we have the recreation agreement with the town of Essex for the other half of the year, as well as a building coordination role and then associated adjustments for annual raises and annual increases in healthcare costs and those such. The increase of nearly $120,000 for stormwater, which was previously included within the town budget. An increase in costs for Essex Rescue, the Essex Junction Cemetery Association Memorial Day Parade, and then the planned annual increase into the capital transfer. And then there are some one time expenses that are not included in the budget, we are just showing here so that you all are aware as to what is what other expenses are being paid for. So as associated with separation, as you can, or as you know, we are now a city instead of a village. And so there are various signs and other materials that will need to change over to city. And so we're looking at having a rebranding effort that would be paid for through the local option tax. There is money that we have set aside through the local option tax to start a strategic planning sessions, where now that we are a city, we want to engage the community and we want to further engage committees to help us figure out where to go next. Now that we are a city, we really want to make sure that we don't necessarily operates in the status quo, but we instead have a clear vision as to where we are going in the next few years. And lastly, just simply replacing those banners and signs to change from city or from Village of Essex Junction to the city. Thank you for that presentation. Does anybody have any questions on Article One? We've got a guest that has their hands up. Can you unmute and state your name and my name is Rich and I'm on West Street. I had a couple of questions related to the tax property tax. First one on the flyer that was mailed to everybody under revenues and property taxes. It shows an increase of 168% for the next year, going from $3,800,000 to $10,400,000 in change. Can you explain how that number is, how you come to that number? And the other one is when you look at your tax bill, are you taking out the tax, the information that shows Town General and Town Capital from the tax since we're no longer with the town? Thank you for that. Andrew, would you like to answer that? Yes, I'd be happy to. So for that first question of the property tax line item, the 168% is being compared to the Village of Essex Junction's property tax revenue. So that 3,890,000 was what it took for the Village of Essex Junction. The 10 million is what is proposed for the City of Essex Junction. It's very much frankly doing an apples to orange comparison as the Village of Essex Junction and the City of Essex Junction are not the same things, do not provide the same services. The Village having services being provided and paid for through our town taxes are not associated in that number. So when you are looking at your property taxes and that impact, that 168% is very misleading. The 0.4% that's the one that's not misleading because you are not going to see a 168% increase on your property tax bill. You would see a 0.4% property tax or increase on your property tax bill, which to answer then your second question as to which line items it is for your property tax bill. Yes, take out the school district. I'm going to look to our staff on this one in terms of whether that was inclusive of the town capital line item or not. Because I don't want to... And the town general. Yeah. The town general, yes. Town capital, I am unsure. Okay. Do you want to handle that, Regina? Yeah, I'm sorry. I missed that question. The question is for if someone was looking at the property tax bill from last year, do they remove... We know they remove the town general from this year's tax bill, but do they also remove the town capital fund? Like we know it'll be removed, but was the 0.4% comparison including the removal? Jess? Yes, remove the town capital that was not included in the city projections for FY24. So the taxes should technically go down from the amount you're paying since you're taking out the town amount? So the comparison that we did takes all of the rates that were on your previous bill versus the city municipal rate for FY24. So your bill this coming year, this coming summer, will not include that 1%. So the 0.4% increase accounts for that. Okay. So let me try to understand it. So if I look at the bill and I'm just going to put some numbers out there and I'm not counting the homestead education that's part of the tax bill, but that's separate. You have the town general and the town capital. Let's say that that's $2,000 in taxes and then the tax agreement, city general and city economic development, that's a thousand bucks. Are you saying that $2,000 is going to go down and it's going to be 0.4% on the 1,000? Yes. Okay. All right. Other questions? I don't have another question. Thank you. Okay. You're welcome. Does anybody else have any other questions on Article 1? Okay. Oh, yeah, I'm sorry. I didn't see you there. Go ahead. Go right ahead. This is Raj, too. I don't know that we all agree on that. I'm not quite 100% sure on what I'm sorry, sir.  It's not. It's rich, rich. Sorry, rich. I'm not 100% sure we're on the same page. I'm not. And I don't want to leave you with, I don't want to, I want to make sure we're right. So can you ask her, ask that last bit again? Yeah. So if I look at the current, at the tax bill, now look at the municipal tax column, there's the town general, the town capital, tax agreement, city general and city economic development. If we no longer pay the town taxes, those first two lines should disappear and that would remain what the current tax would be. And then you add the increase on that current tax, or are we going to pay the same amount of taxes as what we're paying the year before, but they just transferred everything to the city? I see your question. I think it's the latter, but Jess, do you get that now? Yes, yes, that is correct, Raj. So it's the latter without the capital portion. So it's those lines you mentioned. With a point four percent increase without the capital line is my understanding. Correct. I thought we were going to get a tax decrease with the split. Well, we can talk about how that happened, but that's a different. Just to understand, it's just to understand it. Yeah, that's a separate question, but I just wanted to make sure that we weren't leaving you thinking because it sounded like the way we left you a minute ago was you thinking you're not going to pay two thousand dollars in property tax. And I want to make sure that no, I think my thinking is more that you're going to have a hundred sixty eight percent increase here in there. Well, so the hundred. Yeah, so right. So the hundred and sixty eight percent increase is the numbers. So as President Brown indicated earlier, it's we were paying those lines to different plates. We're paying portions of the of the city budget that you're seeing now to a town budget. So everything is now under one city budget that you're seeing reflecting that hundred and sixty eight percent increase in the past. A good portion of that was being sent to a different budget, which was the town. And so as of this proposed budget, all of that is just going to the city. And so the sum of these lines are going to have some crazy some very interesting increases and decreased numbers. So it's very difficult to look at the percent changes on a lot of these lines. And it's a little complicated. So there may be a lot of questions. Yeah, I just didn't want to end up seeing, you know, going from, you know, seven thousand to twenty one thousand dollars of taxes. And that's what that's why that's why I wanted that's why I wanted to understand that revenue of one hundred sixty eight percent, because if taxes were supposed to go down, it didn't make sense. Right. So I think the answer you got earlier of being point four of that total minus the capital. So I think as President Brown pointed out, if you take your tax bill minus all of the capital and multiply it by. Point four percent and the capital is pretty much nothing. So yeah, not the school, right? Now the school, no, just the capital itself is point two percent. Right. Thank you, Raj, for the extra clarification. So I think I think we're good now. Any other questions? OK. Glenn, you had asked that you had a question. You can ask your question now. Yes, I was looking at that. And if you take the town capital amount out and not include that in the two thousand twenty four budget and multiply by point four percent, the remaining amount and assuming that you have a two hundred eighty thousand assessed house, which will yield a ten dollar some odd set increase. Your tax could go down because on a two hundred and eighty thousand that town capital amounts to roughly fifty some odd dollars. So even though your taxes you say, OK, there's a point four percent increase, there's actually a decrease because you take out that town capital, the town capital and the new one, as I understand it, is not going to be there. So you're you're even in the town general obviously won't be there, but it'll be incorporated within because we're going to a city that's going to be incorporated into the city general of city economic developments and tax agreements and so forth. Am I interpreting that correctly? Who wants to take that? I would ask that the individual who did the math to help create these numbers, if they would be willing to answer that question. So I think this would have all been taken care of long before now. It should have been.  Just, can you answer that question? Yeah, I was going to. Is it OK if I bring up our actual budget file that shows the calculation? I think that might be helpful to see. Exactly what goes in. OK, go for it. Sure. All right. Going to take me a second to pull the file up because I'm remote, so bear with me. That's perfectly fine. Better to have everybody straight again for anyone tuning in. We're just waiting for Jess to bring up a chart. There we go. Perfect. All right. So this is the spreadsheet that's in the budget file showing what your current rates are in total, so it includes the town general, the town capital, the tax agreements, city general and the city economic development fund. Our proposed rates for FY 24. So you'll see that the town general and town capital are removed. So your tax agreement rate would be this zero, zero, two, two. Your city general will be nine, two, one, five. And then the city economic development fund is still the penny on the tax rate. So in total, compared to what you're paying right now, your tax rate combined tax rate is going up point four percent. OK. Yeah, I think that's I think that is clear from my standpoint up. I want to make sure that Rich that explains better Glenn understand the chart. Yeah, that that makes a lot of sense. The issue then becomes if you look at the amount of dollars, you've got two thousand six hundred twenty nine eighty before or under that one and see your new one actually is twenty six fourteen, so it went down because of the town capital that was at least according to what I see here. We don't I don't see an increase. I see a decrease in the number of dollars. So those Glenn, those two numbers that you're looking at the twenty six twenty nine and the twenty six fourteen are based on this this set of data up here. The twenty six twenty nine is derived from the old grand list value, which is the value that it was at the time that previous staff created the projected budget. The actual grand list value today is this amount down here. So you really want to focus on this information that's highlighted in the green. So what you're saying is I can't take a look at last year's or any of the previous years. Right, I can't take a look at last year's amount of dollars that I paid. I would have OK, I can, but I'd have to increase it by a point four percent. Correct, correct. And you can't include and you still have to include the town capital in that. Right, correct. OK, so I was I misunderstood you. I thought we were taking that one out, but we are in terms of looking at last years. And because I am looking at last year's we've got to include that, even though it's not included in this year's. But we've got to include that in the total bill and multiply the total amount by point four percent and add to that. Correct. Yes, we're comparing we're comparing rates in total. Yeah, it gets so I was confused. I misunderstood that from the previous and I think the guests did as well. And so that clarifies it. So we are seeing the tax increase. Yes, any comment? Yeah, OK, we've been a number of cases, as I've mentioned, to the city council, we had been told that there would be a decrease. But because of the change over and because of various things, inflation is one of them, but also having to hire individuals to take place and separations and so forth. We're seeing a tax increase. All right, thank you. And it'll probably be easier going forward because we won't have such a jarring, you know, it'll be more apples to apple through your year. So it'll be easier for everyone to follow. This is probably the hardest year. So it makes sense that there's extra questions. So. All right. Thank you much. You're welcome. Anything else on Article One? OK, let's go to Article Two. President, let's see, shall the voters approve the following amendment to Section 206 of the charter? It's going to be hard for me to read. So I'm going to let this is on section 206, conflicts of interest and prohibitions. And I'm sure on the presentation it has it where we can all stare at the words. So let's do that. Thank you, Steve. And I hope you all can see the words that, thankfully, Steve did not need to read. And I hope you all can see them here in front of you. The important portion here to notice is this underlined statement that says unless allowed by state statute to try and summarize this as briefly as I can, this new language to the existing portion of our charter would allow for times in which the state says a city councillor can act as an employee. We came into the situation this past January, where we had not as a city. We had not appointed a town health officer because of not doing so and not having a town health officer by state statute. That defaulted to me as a city councillor. The unfortunate thing is is that our charter prevented me from acting in that manner because that would be considered a form of city employment. So this will allow for that to happen again. Should a future chair of the city council or president of the city council need to act in that manner or any other manner in which that is allowed by state statute, which to the best of my knowledge, that is the only time in which it can't happen. And I also want to make sure to point out that there are no changes to the charter that would prohibit the city councillor or that would not prohibit a city councillor from holding other types of city employment, so it would still not be allowed for a city councillor to be a city manager, a community development director, so on and so forth, unless it is allowed by state statute, which it currently is not. OK. Excuse me. All right. Thank you, Andrew, for that explanation. Does anyone have any questions on article two? OK, that one is pretty pretty straightforward. OK, let's go on to Article Three, which is also a charter change. Shall the voters approve the following amendment to Section two is six of the city charter, which is also complex of inches and prohibitions. So again, I won't read that out. So a couple of things to note here with this one. There is an error on the ballot where the ballot is referring to Section 206 B. It should say 206 A in consultation with our attorney. This is not an issue that would render the results of this vote invalid. So the voting you are doing and or will be doing tomorrow are still valid on this section. And we do regret that this says 206 B instead of 206 A. Another comment to make. Article two and Article three are referring to these exact same portions of the same or of the same section of the charter. These two these two votes do not require the approval or disapproval of these changes. So if you approve of one and not the other, that is perfectly fine. These do operate in in their own vacuum, if you will, because we are only voting on the changes.  So the part that you would be voting on in this section is just the crossed out portion that would that would remove the section that reads no former council member shall hold any compensated appointed municipal office or employment, except for poll worker until one year after the expiration of the term for which they were elected to the legislative body. OK, thank you, Andrew. Any questions on Article three? Moving on to Article four, shall the voters approve the following amendment to Section 302 of the city charter? And this has to do with the moderator's position. Andrew, I'll take this one, I guess. This change would result in the following. The council shall appoint a moderator who will reside at the next city informational meeting. The term of moderator shall be one year. Only qualified voters in the city of Exxon's Junction shall be eligible to hold the office of moderator. The difference here is that currently every year we elect a moderator to preside over our city annual meeting. We have gone to Australian ballot and we will likely be reimagining how annual meeting operates. The combination, I think, of mailing ballots and Australian ballot means that we may be looking at different dates in a different setup in the future to ensure people still have an opportunity to provide input and we as a community have an opportunity to get together and do something as a community around this decision-making process. All right, thank you, Raj. Any questions on Article four? We'll move on to Article five. Shall the voters approve the following amendment to Section 401 of the city charter? City meetings and elections. And the difference here, this voting in the affirmative for this will mean that the section of the charter will read by January first of each year. The council shall set the date for the next annual meeting at which time the voters shall vote for the election of officers, the voting of the budget and any other business included in the warning for the meeting. We had a situation this year where we just, it was pointed out to us that we had scheduled annual meeting to coincide with the first night of Passover. And we as a community, as a board, we put that date out last year, much as we're doing this year, and we voted as a community to hold it on that date. And a few weeks before that, it was pointed out to us that we had a scheduling problem. So we discussed it and decided that it might be a good idea to have some flexibility in terms of when those meetings are scheduled to avoid any conflict. Thank you. Any questions on that? Let's move on to Article six. Shall the voters approve holding the annual 2024 annual meeting on Tuesday, April 9th, 2024, at which time voters shall vote by Australian ballot for the election officers voting on the city budget and any other businesses included in the warning for the meeting. Now, that partly relates to what we just talked about. I can do this one again. Based on what we just discussed, we had just talked about having the flexibility to set the date set by the city council. And until that happens, we are asking voters to approve a date for next year to have this opportunity to vote on the budget and officers. So we still need to do what we've always done. And I think it sort of speaks for itself. Any questions on that? OK, let's keep moving to Article seven. And Article seven is presentation and shall the voters authorize a planning loan through the Drinking Water State Revolving Fund for a project in the water enterprise funding. Got a question from a service line inventory and lead service line replacement plan for an amount not to exceed four hundred thirty three thousand seven hundred dollars to be financed over a period not to exceed 10 years. Andrew, who's going to discuss this one? Yeah, the short story of this one is the federal government is requiring all potable water lines to be to determine whether or not there is lead in them. And if there is lead, then there needs to be a plan created and that needs to be done by October of twenty twenty four for that identification. So this loan would allow for us to meet that requirement without getting this loan. We would need to figure out where this how else to raise four hundred thirty three thousand dollars. And so this loan would allow for interest free payments over a ten year period instead of trying to find four hundred thirty three thousand dollars on the calculations. OK, thank you for that information. Any questions on Article seven? OK, onward to Article eight. To elect city officers required by law, including moderator one year term and there's one person on the ballot, two city council members for three year terms and there's three people for those two slots on the ballot and one library trustee for a five year term and there's one person on the ballot for that. OK, and we usually don't debate that. It kind of is what it is, which takes us down to public to be heard. Yeah, this is the time people can bring up if there's a particular question that we haven't covered in the meeting that relates to the city. Steve, if I may jump in real quick, go right ahead. Two quick announcements. One, a hopeful reminder. One being as I will put up on the screen here, one being that voting tomorrow, if you are going to vote in person or drop your ballot off, is going to happen at Champlain Valley Exposition within the Blue Ribbon Pavilion. It is not going to be at the high school. If you go to the high school, I'm hoping somebody will tell you that you're not going to be voting there and instead directing you to the Champlain Valley Exposition at their Blue Ribbon Pavilion. For those of you who are not familiar where that is here on the screen, you can see the black arrow pointing to the Blue Ribbon Pavilion. There is ample parking. There is handicapped accessible parking so that hopefully this will be a very smooth process for voting this year as we have a new site. One of the issues that was identified to us by the school district is a concern of just having the flow of people coming in and trying to maintain student safety at the same time. So we're given something, we're given a new practice of shot this year. I think that announcement. The last one is city councillors George Tyler and Dan Karen. This is their final meeting. This is their final portion of their term. Personally, this is, it's disappointing in many ways. Dan and George have both served our community for more than 15 years. George as a village trustee, councillor, the president of our community, Brown Hill Library trustee and Dan Karen having been a village planning commissioner, served on the Recreation Advisory Board, as well as one of our representatives to the Chittenden County Regional Planning Commission. Not to also mention George, a longtime representative to the Tri-Count Committee, the one that oversees our wastewater treatment facility and the relationship we have with Williston and the town of Essex for those services. The two of them have have truly impacted our community in ways in which are going to long outlive, frankly, myself, the work that they have done for the downtown economic development, helping to get funding for our train station revitalization that's going to be happening. The Crescent Connector Project that should be completed this upcoming year, all in large respects to George Tyler and Dan Karen. Our community would not be what it is if it were not for them. And so personally, I owe them a great appreciation to people who have acted as mentors to me as a as a as a young counselor and trustee. Deeply appreciated or deeply appreciative for the two of them and their work for our community. I can't thank them enough. Andrew, if I could jump in, I'm hoping I won't outlive you. But it I'm not going to get into the speech. I just want to say a number one thing is it's always it's always it hasn't always been fun, but it's always been wonderful. And but most of all, it's always been a privilege to serve the people of this community. And I also want to say I don't know who the new counselors will be coming into the board, but I leave with tremendous confidence and of the three remaining counselors, you and Amber and Raj and our new manager and all the staff. I have such great confidence in all of you and where you're taking things. And so I lead with a lot of satisfaction that we've accomplished a lot and things are in good hands. So thank you. If I could just quickly I'd echo what George said. Also appreciate all the. Education I received basically doing what I've done for the past was roughly 17 years, over 17 years since I was on the planning commission, but and many fine people in our community, outside of our community and some that are no longer with us. I remember my first election to the board, George Dunbar, the second was running back then and he's long since gone, but had done tremendous things for our community as well. So and I'm sure it'll continue on long after we're gone. So thank you very much, everyone. Thank you both. Does anyone have anything else to bring up? OK, thank you all for attending today's informational meeting and see you at the next meeting. Have a good night, everybody.


So I'm gonna talk about our platform yours also called yours org But the title is making Bitcoin cash mainstream because we think about this you know one of the ways to think about the project that we're building is basically making a mainstream user-friendly interface to the blockchain or Bitcoin cash and We're trying to reach a mainstream audience. We're trying to make this technology Useful to normal people who aren't technical People that are familiar with social media people that know how to use snapchat, but they don't necessarily know how to run a miner So that's sort of our interest so Let's let's start here. So because this is a Bitcoin cash conference. I'm gonna frame it all in terms of You know, basically what we're doing with Bitcoin cash and how we're making Bitcoin cash mainstream specifically so Look this conference is called Satoshi's vision I've been involved in the Bitcoin industry for a long time and Bitcoin cash has all the properties that Bitcoin is supposed to have It's sound permissionless scalable peer-to-peer electronic cash with low fees instant transfers Entering complete smart contracts. Wow So let me dive into this a little bit and explain what each of these terms being because some of these might even be controversial So it's sound of course. We know that there's only ever gonna be 21 million Bitcoin cash No one can cheat and inflate it away. It's permissionless. No one can stop you from using it You can do whatever you want to do in accordance with the protocol rules. It's scalable We do know how we can scale this to reach a global audience. That's possible. It's peer-to-peer You can send money, you know to anyone. Okay directly with no third party. It's electronic cash It's it's money, you know, you can hold it and you can transmit it It has low fees on our case or well, I mean for any Bitcoin cash transaction But it's especially noticeable in our case fees are less than a cent most of the time Instant transfers because especially if you're sending smaller values zero con for it's just fine and Touring complete smart contracts. This is kind of the controversial part I won't get into this in my talk, but my co-founder Clemens is gonna talk about this on Sunday So all this stuff is really amazing, but these are all really technical things So how do we bring this incredible value to normal people? So We think about it, you know, so one question people have asked since the early days of Bitcoin is what's the killer app? You know, we're sort of missing something that by itself sort of goes viral some application of Bitcoin That you know goes to a You know to a mainstream audience something that's you know the app that introduces everybody to to Bitcoin cash So That's Bitcoin cash now. Let me talk about sort of the problem. We're looking at and how and why we're using Bitcoin cash So on the internet today, we have a couple of related problems First of all on most social media networks people the users don't earn money. Okay You create content on reddit. We look to reddit as a role model, but we look to all social media networks, you know, Facebook Medium SoundCloud and so on Usually they either don't have a way for people to earn money for creating content or they don't have very good ways It's all based on ads and ads only work for like some of the users But also not just the creators. What about everybody else the moderators the editors and so on people that curate good content We want to create mechanisms for those people to earn money The second problem is why is there so much low quality content on the internet? And I'll start with trolling because many of us in the Bitcoin community have probably seen or experienced Hopefully not done the trolling In in you know, Twitter, especially reddit and so on There's also things like, you know, just outright false information. There's lots of propaganda and censorship things of the sort Clickbait spam and so on of course. There's also really good content, but there's a lot of low quality, too So how do we how do we make this better? And so our solution is basically we think that if you build payments in that we can solve a lot of these problems So first of all if you build payments into the infrastructure of a social media app You make it possible for people to earn money for doing anything on the app You can make it possible for people to earn money for creating content for curating content for moderating content and so on Secondly, we think that if you set up the incentives correctly we can encourage high quality content If you earn more money for creating better content, well, you're encouraged to do so So we think this will improve the quality of content if we do a good job designing the incentives Or in other words ads suck Let's use Bitcoin cash instead and what this means is if you think through what these problems are and why they are this Way it has something to do with ads like the fact that you know When you create or consume content on Facebook for instance Why are these third-party advertisers involved at all like why are you why are you you know? Why do you have to look at these ads? Why are these unrelated parties involved in funding the content and how come you're not earning the money? I mean if you're creating all the value how come advertisers are paying Facebook for that There's something wrong here. There's something wrong with the sort of the ubiquitousness of ads on the internet And we think we can solve a lot of these problems with with Bitcoin cash. So Yours org this is the the app that we created It is a social media destination with Bitcoin cash monetization for creating and curating good content I'll get into this in a minute what this means exactly because it won't be obvious But we get compared to reddit a lot because we have a vote button With the difference is that actually the vote button is money. So the voting cost 25 cents I'll get into how that works in a minute, but you can start getting the idea for what it is that we've built That it's a social media app with built-in payments So I'm gonna start with this one. This is my favorite feature It's my favorite because it's fun to talk about and it's a fun sort of thought experiment Although I admit it's not the most widely used of our features, but I Mentioned trolling earlier It's interesting that on most social networks You usually have the ability to add comments sometimes you have the ability to turn them off But you don't have the ability to charge money. So on YouTube for instance YouTube lets you allow comments or disallow them in other words It's either free or it's infinitely expensive, but there's nothing in between Wouldn't it be cool if you could just charge some amount of money for people to write a comment? So on YouTube or on Twitter wherever Wouldn't it be I mean like imagine you get trolled which again many of us have experienced this Wouldn't it be interesting if you could just charge people a dollar to write a comment on your article or your tweet or read it Whatever I bet that would discourage trolling because the trolls would realize that it's actually costing them money And so they're gonna run out if they keep doing that We're also very interested in creating mechanisms for people to earn money for all this stuff So that anytime that you spend money on something you can you can earn it back again So another feature is this one's this one's just kind of cool We've seen this one use in our app we have tipping built into comments So as you can think of it like tipper bot people have probably used that one But sort of built into the app so you can tip comments directly you see it when you tip something You see a little face and the amount of money that you tipped you can see the total amount of money the commenter earned So this makes cool things possible like you could ask a question in your article and Say I will pay you five dollars for the answer and then someone answers it You can pay them and you provably pay them built into the app So this makes just interesting interesting things possible We also have something we call the voting model So we saw the vote button earlier The way voting works is it's 25 cents to vote on content The idea is that by voting you're curating you're helping send a signal to other people that this is high quality It costs 25 cents and that 25 cents is distributed evenly to all earlier voters Or if you're the first voter it goes to the content creator they get it They get the first vote for free So this makes it possible to earn money for curating content So you got to sort of buy in you got to pay 25 cents to vote on content But imagine you're the first voter and a bunch of people vote after you you earn money from each subsequent vote So if you're good at curating content you vote on hot content early you can profit from that And finally we have a paywall and the paywall is it's probably poorly named We need to come up with a better name because people are he's turned off by paywalls But our paywall is a little bit different than what you see on you know The Wall Street Journal the New York Times or something like that our paywall is actually literally just a paywall where the author sets The price for something behind the paywall Newspapers have subscription walls when you go to the Wall Street Journal and you're not signed up yet They say something like well, please you know before you can read the rest of this article Please sign up for $25 a month or whatever it is But wouldn't it be cool if you could just pay like a one-off fee to read the article like maybe the author could Just set a price that's how our paywall works It's like the obvious simplest way to monetize something on the internet is just charge whatever for it So we let the author set the price they can set anything as low as one cent as high as $10 or higher than $10 could be anything We've actually had people charge hundreds of dollars For content on the app and yes people have actually paid for that. I'll get to some of that later So you get the idea We are a social network with built-in payments and actually it's really cool once you have that working You can do all these different things that actually many of these things have never even been tried before We're not aware of a working version of the paid comments ever in existence to the best of our knowledge Even the paywall it's actually really hard to find examples where people actually literally just had a button You could press to make a payment to somebody there have been a few really minor Experiments and no one has really tried it in a serious way certainly the voting model We're not aware of that and we have a bunch of other ideas And it's fun to brainstorm all the other things you can do. In fact, I could just give you one other idea Well, eventually add a referral system to the platform Like wouldn't it be cool if you could earn money for sharing content to people? Because you get a portion of the revenue Generated from people that click through and then buy or vote or whatever it is after that So it's fun to experiment. There's there's a giant world of possibilities here new ways to monetize not just creating content But also curating and discovering and moderating content things of that sort that have never been tried That are only possible when you have really low cost transactions So anyway, so why Bitcoin cash? So there are sort of two ways to look at what we're doing We're taking Bitcoin cash and trying to bring it to a mainstream audience Or we're trying to solve these problems like improving the quality of content on the internet getting people paid They go hand in hand. Why do we use Bitcoin cash specifically? So the best way for me to explain this I'm just going to give a brief overview of like sort of our history and how we got to this situation Because often when I when I talk with sort of new people a Lot of people have no idea what Bitcoin cash is and if they look it up on the internet They they get a lot of negative, you know information like you'll see, you know, I won't go into it Actually, I'm not going to use any of the words they use but you know what I mean If you Google it you or whatever you see it on Twitter, you see a bunch of negative information about Bitcoin cash But let me just tell you briefly how we got here and why Bitcoin cash is the right tool for what we're trying to do Way back in the day a little more than two years ago. We started on Bitcoin We were using Bitcoin because well two plus years ago Bitcoin was like 95 percent market dominance and cryptocurrencies had by far the largest economy There was no reason to use anything else All we needed was peer-to-peer payments in the app We need peer-to-peer because we don't want to be a money transmitter Bitcoin made that possible The only problem was fees were kind of high in early 2016 at about five cents per transaction Now five cents at the time seemed high because fees used to be really low. It was like zero basically So at five cents, we thought well We need to lower fees because the payments might only be about five cents And so a five cent fee on a five cent transaction is awfully high So my co-founder and I Clemens who's in the audience probably somewhere here. We spent I see him in the back there We started developing payment channel technology similar to the lighting network So we you know by that point lighting network had been sort of theorized hadn't been put in production or anything like that but the basic ideas were out there and there's lighting network and a few other sort of Papers and whatnot about how to do this stuff So we researched and developed this it took about a year to get a prototype of this working Which we announced in early 2017 But by that time fees on Bitcoin weren't five cents anymore They were five dollars and actually in order to open a payment channel You have to broadcast about three transactions, which means that five dollar transaction fees It costs about $15 for someone to open a payment channel not to mention You have to actually fund the channels with something and with fees that high you got to fund it with quite a lot More than $15 for it to make sense. So Bitcoin just stopped working for our use case and I'm not going to go There's just simply no time. I'm sure many of the audience is familiar with this, but many probably aren't but unfortunately We just couldn't use Bitcoin anymore. So we switched to Litecoin Litecoin was technically very similar to Bitcoin. It was easy to switch to all of our technology worked on it and the fees were a lot lower But Litecoin's long-term roadmap was not encouraging Litecoin also has a fixed maximum block size and even though its fees were low The developer and sort of ecosystem around Litecoin was pursuing the same type of long-term roadmap as Bitcoin core Which meant that Basically, if it ever got popular we're gonna have the same problem again So we weren't very encouraged by that and we watched Bitcoin Cash Very very eagerly because we knew that Bitcoin Cash was solving the problem that really needed to be solved Which was how do we just raise the maximum block size? You know safely in a way that just scales to a larger transaction volume and when Bitcoin Cash launched in early August It's August 1st 20 you know last year 2017 We started running tests on Bitcoin Cash and the fees were less than one cent and we're obviously very encouraged by the community all Many of us in this in this room about what the plan is moving forward with a plan as we're gonna keep raising the maximum block Size as needed and we're gonna solve all the technical problems You know that we need to solve to be able to scale on chain So in a nutshell So anyway, so we switched to Bitcoin Cash visa really low We ended up archiving our payment channel technology So even after at that point about a year and a half developing the routed payment channel technology We actually archived all that code and we just use simple on-chain Bitcoin Cash transactions Because the fees are so low We don't need payment channels and furthermore the usability of on-chain Bitcoin transactions is way better than payment Channels and I have a couple of articles a couple of videos where I talk about this extensively about why the the The usability is better. I'll just give you one brief example On Lightning Network or any of these payment channel technologies The recipient of funds has to be online, which is a really difficult thing to work around if like they're not online Which is true in a social media app, which you don't literally have open 24-7. So anyway in a nutshell Bitcoin Cash works today and has a best chance to keep working tomorrow and that's why we're using Bitcoin Cash So we think the way to make Bitcoin Cash Mainstream is to make it really easy for anyone anywhere in the world to earn money For working in the global economy on the internet and that's exactly what we're doing in our app You can create value in our app You can create content you can curate content and so on and you can earn money And the payments can be from anybody anywhere in the world and that's amazing like you can be a part of the global economy you can doesn't matter where you live or whatever you can create value and you can earn money from that and we Think this is how we bring Bitcoin Cash to a mainstream global audience. We think it's the most basic use case smart contracts are awesome We'll get to that later. Let's just make it possible for people to earn money really easily So I'm gonna run through here. I don't know if I'm gonna get cut off on time. How many five minutes? Okay, what I'm gonna do is since I only have five minutes left. I'm just gonna cover a couple of these and then we'll leave it for For questions. So I was gonna run through tons of examples of how people have used our platform So just for instance our first popular article was called Bitcoin Cash Investment Thesis by a guy named Bitcoin Optimist and this article earned 86 dollars So this was I forget the timing of this exactly But this was the first article on our platform where someone earned enough money from it that actually maybe that was worth His time to write the article so this was like you know This was like a proof of concept that oh the thing actually does basically work It's no longer really theoretical and I'm just gonna jump ahead to the the next great example Which was we have a user named rivers and mountains who not only like was it worth his time to write the articles? He actually earned quite a lot of money. He earned about $500 per article because what he would do is he would write a free Article about Bitcoin cash that was actually a really good interesting article And so people would share it because it's just a good free article But then he placed an $8 paywall and behind the paywall was trading tips about how to trade Bitcoin cash And so but you read the article like oh this guy knows what he's talking about oh eight dollars But gosh if I like buy in you know at the right time, I'm gonna way more than eight dollars So he actually earned like $500 per article here and several thousand dollars something five thousand dollars total for all of his articles So that's just it I'm out of time. So I'm not gonna go through the rest. I'm just gonna blast through you can see there a bunch of them there But there are all sorts of interesting things people have used our platform for because we've set something up that like was Didn't really previously exist It's just a social app with content and built-in payments You can just easily pay people for stuff and see it on the app There's a lot of use case for this anyway, we're sort of out of time I don't know me how much time we have left and whether I have time for questions I'm gonna give you some questions because that was awesome Do we have any questions from the audience? Okay, I'll go. I'll just go. Yeah, I can I can tap one for 10 seconds or something. I'll just I'll leave this one up here Yes, so my Once you develop a social network that lets people get paid Yes, and you start to create this platform that anyone can use to earn money on the internet Based on like the current social climate It seems like one of the first things that's gonna happen that you're gonna receive our demands from various parties that you Start deep platforming various users for various reasons. Do you have a plan for dealing with that? I'm not sure I understand deep platforming Just saying that certain people should not be allowed to publish on the internet because some people don't like what they're saying Well, so our if you're talking about sort of censorship as a general concept here So we recognize that you know We think probably that actually one of the biggest use cases for our platform right now is to be anti censorship because sorry Yes anti censorship because we can see thank you. Thank you. All right. I should have started with that I guess but but You know look we see a lot of censorship on social media right now It's like actually really interesting that a lot of like Voices are being silenced on social media That's a real problem and that's actually I think the biggest problem and it this is very much related to earning money Because what's happening on YouTube for example a lot of the people that are being silenced what's actually happening is They're creating compelling content that turns off these third-party advertisers And so they get shut off from being able to be funded by ads on YouTube So that is one way voices are being silenced.  We're not beholden to third-party advertisers So that problem doesn't exist on our platform. So I think that is probably the biggest use case That's true right now You know on our platform so Another question Hello, just a really simple question. Just wondering how does yours dog make money? Yeah, so we take 5% of payments on pieces of content So this is still an open question exactly what we're gonna do long term But we think the simplest thing we can do is we allow free Transactions because you can always go to somebody's profile and send them money directly for free But if you take advantage of our cool features like the paywall we take 5% of that. So that's our business model for right now Final question for Ryan. Hi Charles. Have you seen any clever clever exploits that people have done to abuse yours Clever exploits like just in in terms of how they use it or you mean like a security thing Yeah, I mean that's sort of let's see if I can find a cool example here. I'll start I'll do this one I think this is kind of cool. So this is I'll use his handle because that's what he used on the platform singularity Use our platform and a number of others to raise money for what would become the Bitcoin cash fund And yeah So this was at the time so singularity. So what happened? This is really interesting So he published this article on our platform and on Reddit a few other places and at the time we had like a tipping button that was like like 10 cents or something like that and It was just by definition 10 cents and the number of people like clicked the 10 cents button over and over and over again to give him more money So we're like well, we should let people type in any amount of money So we added that feature so anyway here in 20 $200 with our platform itself And also I think it on that day and he can correct me if I'm wrong. He's probably in the audience I don't see him right now, but they earn like $15,000 or something like that within a couple days Both on our platform and a number of others, but not via the platform specifically So so anyway, we this was a cool use case that we then realize Oh, let's make that easier for people to crowdfund on our platform in the future And that is our presentation today from Ryan on yours. Thank you. Please give Ryan a great hand and congratulations on yours


All right. Well, hey everybody. Thanks for coming out last talk of the first day everyone have a good time at Defconn so far. Yeah, all right, cool So great. Thanks. Thanks for coming out. My name is Eric Smith And I am the assistant director for information security and networking at Bucknell University in Pennsylvania and with me today But not on stage is Dr. Shannon Dardan stand up. Say hi She is the assistant professor of information systems at Susquehanna University Just down the street from us in Pennsylvania. So we're going to talk to you today about medical identity theft So here's the agenda for our talk. We're going to give a little bit of background talk about what is medical identity theft and what's actually going on in the world of medical identity theft We're going to talk a little bit about HIPAA and how HIPAA is designed to stop what's going on even though it's not actually stopping what's going on And then we'll look at what we can do to fix it So let's get started and talk a little bit about the background So what is medical identity theft? What is an electronic medical record? Well, here's a typical example of something that your doctor is probably already using This is an electronic protective health information system, electronic medical record system And this is just a picture we found out at Wikipedia. It's pretty typical of what nurses and doctors and what not are using today And basically it stores all of your medical records in some easy to use way that non-technical people such as doctors and nurses and billing managers and what not at your hospital Can have full access to your medical record So things it contains are comments about your medical record itself, lab results, lab tests, that sort of thing Pretty much everything about you that the hospital or the doctor knows is being stored electronically in a system like this What's interesting is that these systems are also storing your billing information So it knows your home address, you know your phone number, your social security number, your health insurance information, it's all in here So how many people are using these? Unfortunately the latest statistics we could find for this were from 2006 but it gives you a good idea In 2006 29.2% of all physicians were using electronic medical record systems and 25.9% of all practices were using them So within the last two years it's certainly gone up, it's about 10% increase per year And the reason for this is obvious, it's a cost savings for the hospitals to do this They don't have to go pull paper records to find out what shots you need or what's wrong with you So it's financially beneficial for your healthcare provider to use an electronic medical record So what is medical identity theft? Well you've probably all figured out what medical identity theft is It's like financial identity theft except someone stealing your medical identity So somebody wants to go to the doctor and they don't have health insurance Or somebody wants to go and get a prescription for OxyCotin but they don't want it on their record Or somebody needs to go get treated because they can't lift 50 pounds And their job requirement as a laser printer technician says you have to be able to lift 50 pounds There's something that they want to be, that a person may want to have kept out of their medical record That may affect their ability to get or keep a job So these are some of the reasons that people might be doing medical identity theft And we'll talk a little bit more about that in a slide Alright so you're a victim of medical identity theft, someone's come along and stolen your medical identity Unfortunately a lot of people say well I don't care I have insurances it's not my money Well it turns out it really can affect you and it really can ruin your life And here are just a few examples of why this is a horribly bad thing You could receive the wrong medical treatment if somebody pulls up your medical record And there's an entry in there saying well you were seeing last week for problem X And it was somebody else, that could definitely affect the kind of treatment that you get You could find that when you actually need to use your own insurance that you've run out your co-pay for the year And you're no longer covered for your actual symptoms So someone else has used your insurance up and you have nothing left for yourself Like I mentioned with the laser printer, that's just one typical example But if there's items in your medical history that could affect your ability to get or keep your job The results of a drug test for example, obviously that's going to be a problem for you Same sort of thing could cause you to fail a physical If somebody looks in your medical record and says well you have poor eyesight And your job is to drive a forklift or something like that That might affect your ability to keep your job based on failing a physical exam And of course there's a financial aspect of it all You're going to get billed for co-pays You're going to get billed for anything that the insurance doesn't cover That someone who's stolen your medical identity has received So we've kind of already gone over this Why would somebody want to steal your medical identity? Well most of what's going on today, most of the actual medical identity theft cases Are as a mechanism to get the financial identity theft I mentioned earlier that the electronic health records contain not only your medical information But your financial information, your billing information So a lot of the medical identity theft cases now where people are stealing medical records That's being done simply to get credit cards and open credit in your name Based on the billing side of those records So again you know you can access to health care and health insurance You can access narcotics, you can go to doctor Convince them that you need some sort of prescription drug that is hard to get on the street Or you might be getting just to sell it, that sort of thing And again covering up health records and hiding things that you don't want to have In your permanent record that might follow you around What's really interesting is that the identity theft perpetrators are taking note to this And realize that health care facilities are really prime juicy targets for identity theft Not only medical identity theft but also financial medical theft Here's a quote from the health care information and management system society To address this, it basically says that the data stored in hospitals and health care facilities Contains more data in one record than any other source So instead of going after a bank or going after a school We go after your medical record because we're going to get all of your financial information All of your medical information And these records are stored in institutions that typically haven't been targeted for this sort of thing Banks know that people are coming after you Hospitals maybe not so much So is this real, is this actually happening or am I just making this up so I could talk at DEF CON Well, it is actually happening So here's some numbers These are from the identity theft resource council So in 2007 they estimate that these are the breaches that they know about So obviously there's a lot of breaches that happen that get covered up But these are the ones that have been published So 2007 there were 65, about 4 million records exposed And so far in 2008 there were 59 breaches and about 6 million records exposed Now these are not necessarily malicious attacks A lot of these are stolen backup tapes Letters sent to people with the wrong addresses on them, that sort of thing But there are some actual malicious attacks going on here as well Yeah, I do not know I have to check the file Well then I would probably say no, it doesn't contain that So, you know, do the math This number is based on up to August 4 So if the trend continues by the end of the year We're looking at about 8 million medical records lost Yes, we should Almost none A lot of this is things like backup tapes were stolen Printed records were stored in a storage facility And they forgot to renew the lease And it got sold at auction, that sort of thing Most of it is just sort of slopping us in the care of the healthcare provider Now, okay, so I think we're going to talk a little bit about where this is trending But so far a lot of this is just slopping us on the side of the healthcare provider We're going to talk to HIPAA to death, trust me So everyone's been to the doctor, they've given you one of these Everyone's gotten one of these, right? This is the warm and fuzzy, we care about your privacy document That they're required to give you And the doctor here, he looks really happy He's confident that they're taking good care of your medical records And we'll see that that may not actually be the case Question I can tell you based on my own empirical study Of one data point of me, I read mine So I would say 100% Okay, so here's HIPAA HIPAA is a Health Insurance Portability and Accountability Act of 96 Okay, it's 2008 So this is kind of old But this covers a wide range of issues related to the electronic processing Of medical records and billing information So since we only have an hour today, we're going to really zoom in And just focus on one tiny little subsection of this We're going to focus on the technical safeguards Under the security section, under the administrative simplification section Of Title II of HIPAA So if it's not clear that this thing did not come from our government then There we go, so like I said, we're going to focus on Just the technical safeguards and see where we're at Okay, so moving on in our agenda We're looking at Section II, HIPAA security requirements So this is the entire text of HIPAA That relates to the technical measures that must be taken by a healthcare provider To protect your medical identity It's about a half a page double spaced Okay, give this a comparison Anyone here, you know, work with PCI compliance Probably a lot of people, at 17 pages Yeah Does that include the cover sheet? Okay, so the question was does that include the cover sheet? So there is no cover sheet on the HIPAA section So okay, we'll say it's 16 pages Thank you But it's still considerably more detailed than what we would find in HIPAA So let's compare HIPAA to PCI while we're on the topic And what are the penalties for not being in compliance with the rules? We'll talk about the rules here in a minute, but I just wanted to frame this And compare HIPAA versus PCI So what are the differences between failing to comply with securing medical records To failing to comply with securing credit card information So under HIPAA, if an entity is blatantly out of compliance on a requirement They're fined $100 And if they don't fix it, they can be fined $100 over and over Up to a maximum of $25,000 a year Under PCI, PCI is not a government standard It's negotiated with the credit card companies themselves And the fines can vary based on your own merchant agreement with the credit card companies But the fines can be huge and can be assessed monthly Basically trying to force you to get into compliance It's $100 every time they catch you doing something Maximum of $25,000 a year if you keep doing that same thing Say for example, one of the requirements under HIPAA, and we'll get to this Is that everybody who accesses a medical record has a unique username and password Say there's a hospital somewhere that has a terminal that's logged in 24-7 And all the nurses use it, and somebody complains and they get cited Every time they complain, somebody complains they have to pay the $100 Up to a maximum of $25,000 a year So obviously in a lot of these cases, it's going to be cheaper to pay the fine than to fix it That's true, right? Can you speak up please? Well, when it defines a person, an entity can be a person There's actually a definition of a person in the HIPAA language, a government document So we have to define a person So here's a table, this is basically just the distillation of the half page technical requirements And we're going to run through this a little bit But what's interesting to note is that of all these technical requirements in HIPAA They're not even all required, there's requirements that are not required So we're going to look at these, and the Rs are required and the As are addressable And we're going to talk about what that means here in a second So let's just look at the required ones first Here are the required implementation specifics And you'll notice that half of them have no implementation detail It says you have to do this, but we're not going to tell you anything about it So one of them is unique user identification So basically, we looked at HIPAA, we talked about the half page document And then there was a series in the Federal Register that went into more detail Because people were saying, well, you know, you gave me a half a sentence, what does that mean? So they elaborated on a lot of these points in that document And that's where this information comes from So for example, for unique user identification, basically it says that An entity can use any appropriate access control mechanism that's allowed And they gave some ideas, basically what it comes down to is that If you're a hospital, you can come up with whatever you want for unique user identification You can have single digit user names, fine You can have that sort of thing as long as everyone has their own In the initial draft of HIPAA, it required things like key fobs and multi-factor authentication But people complained so they took it out There's a requirement for emergency access Basically what this means is we need to get into your medical record All the nurses are on vacation, what do we do? But it doesn't tell you anything about how you do this So it's completely up to the hospital And I keep saying hospital, it's any medical institution But I'm just going to use hospital, any medical institution to do this Just has to come up with some policy And that policy could be, okay, we wrote the root password of the server In Sharpie marker under the keyboard And that would be perfectly acceptable in HIPAA You just have to document that as your procedure And I don't suggest using Sharpie because if you change it, you have to cross it out You might want to use the post-it note Another requirement is the audit control So the initial draft was really looking to say, okay Who's accessing these medical records when and why? Completely got taken out And it's up to the entity to determine what sort of audit controls if any are required So there's no specifics about how long we have to keep logs What kind of logs we have to keep It just says you need to have some sort of audit controls Write down what they are, good to go And that's HIPAA compliant And then personal or entity authentication Personal or entity meaning an employee or a business partner, that sort of thing There must be some system in place to identify who they are And the initial draft of this had lots of language in about using multi-factor authentication Artificates, whatnot People complained so they didn't want to do that So they basically said, okay, well It actually says whatever is reasonable and appropriate is fine So you again come up with whatever you think And you're in So if you want to just assign username and passwords That's completely sufficient under HIPAA And that's what most people are doing Well actually most of what happened was They had the initial draft of HIPAA out He said where did most of the complaints come from And he just asked if they came from the AMA And actually, no, it was mostly just individual entities Doctors, hospitals, that sort of thing They opened it up for public review They collected, it was like 2,600 comments They distilled them down into a bunch of categories There are many similar questions And basically if enough people said We don't want to do X What they did was say, alright, you don't see that And they took it out So those were the required implementation specifics And you can see that the required ones have really have no teeth And it gets even better because there are more that aren't even required And these are the ones that you would think are really important Like encryption, totally not required So what does it mean to be addressable? It means you should probably do this But if you don't, that's okay Just write down why you can't do it So let's talk about encryption This is one of my favorites So in the Federal Register it asks There are a lot of questions in the initial review about encryption People were asking what sort of encryption strengths should we use Where should we use encryption? Why should we use encryption? So at the end of the day what it came down to They actually said that the use of encryption in the transmission process Is an addressable implementation specification Meaning you don't actually have to do it So covered entities, your hospital, your healthcare provider Are encouraged to consider the use of encryption For transmitting your EPHI over the internet So you don't have to encrypt your medical information When it's sent over the internet Plain text FTP, fine So long as they have an item written down somewhere that says We can't do this because our system doesn't support it Fine, HIPAA compliant No, there are absolutely no specifications Of what type, what level, what kind of encryption Needs to be used, it just says encryption And they actually went on to say that They didn't want to specify details Because certain entities may not be able to do SSL What if this entity wants to do ROT 13 You know, that's encryption, that's fine The question was what about doctors keeping their lab results On blackberries In essence in the current version of the law You could do whatever you want so long as you Write something up to justify what you're doing So if you said, well, blackberry is not a system We don't own the back end to it It's a third party, they've assured us that They're using encryption and the data is safe You're fine, so if something was to happen As long as they said they had a document like that in place They couldn't be cited for that Data integrity, this is another great one The initial version of the draft talked about data integrity This is really addressing things like Database journaling to make sure no one's coming in On the back end and mucking with your medical records Again, people complain, so what they turned it into was that If you use things like CRC 32 Or a checksum on your file system, that's good enough So it really took out any sort of malicious attack Vector and just turned it into random data corruption And it kind of took all the teeth out of it So as you can see, one of the big issues with HIPAA Is that it's really up to the healthcare provider To determine what it means to be HIPAA compliant They can come up with whatever they want And it's HIPAA compliant And so here's a quote from the healthcare information Management system society again They have lots of good information And basically says that it allows the healthcare provider The latitude to do whatever they want And say it's compliant, and that's good enough So there's HIPAA in a nutshell Just the technical specifications, there's lots, lots more But we only have an hour So just focusing on the technical specifications We were curious, what does it really mean in the real world? What does it mean to have a healthcare provider Be HIPAA compliant, have an actual There's companies out there that are coming in And doing audits to say, yes, you're HIPAA compliant So we had an agreement with a healthcare provider To come in and do a penetration test Right after they had a HIPAA compliance audit done So they got high marks, it was a really high class place Doing a really good job And so they contracted with us for a penetration test And so we went in and we decided to see what would happen So I think it was 23 minutes that it took us to Completely dump their database Something like that We were able to completely pull all the medical records HIPAA compliant, and everything that we did During this penetration test We never used a vector that was there Because of them being out of compliance Everything that they did was HIPAA compliant And yet we're still able to get in and dump everything out Yes The question was how do we do the penetration test I can't talk about that The question was, could you speak as to whether a hacker Could have gotten the information Well, I could have put it on my black hat that day And had been a hacker, so I got the information I'm sorry, I have no idea Any ideas, guys? He asked about HIPAA 2, I'm not familiar with HIPAA 2 Is it a draft? I'd have to look at it But it's not anything that's in place right now So we don't look at that So we decided to summarize what we found Into a couple of slides here to talk about Some really common attack vectors That are completely permitted by HIPAA Things that HIPAA says, you're good to go But are really common in a lot of medical institutions So I want to talk about that here today And I want to talk about a new kind of wireless attack And everyone here has heard, you know All these boring talks about various wireless attacks Sorry, I shouldn't say boring, they're very exciting But a different twist on a wireless attack And we'll talk about that here in a second So hospital networks, what's special about a hospital network? Well, hospitals are open to the public You can walk in off the street 24 hours a day The security staff at a hospital are used to Random people coming in off the street 24 hours a day People are coming in because they're sick People are coming in to visit, people are in the hospital What have you? So they're used to having random people Mulling about And recently, because most hospitals are putting in Wireless networks which have an SSID for the public use For patient use or for visitor use or what not It's pretty common these days to walk in And see somebody sitting in the ER waiting a room On their laptop, updating their MySpace profile Whatever So it's pretty easy to come into a hospital Sit down and blend in and see what you can find So physical attacks against wireless networks We're going to talk about now So we're going to look at a couple of different Standard wireless network implementations I'm guessing a lot of you are dealing with one Or both of these types of networks on a day to day basis So first we're going to talk about the old style Decentralized wireless network And I'm going to talk about Cisco stuff Because that's what I use But this applies to whoever else you might be using So in a decentralized wireless network The access points themselves are the devices That make the decisions about who gets on the network And what network they get on And what types of encryption are used And what kind of authentication is used So a wireless client comes along Here's a pretty typical example of what you'd find In a hospital There's an SSID for the doctors and the nurses To use with their laptops or PDAs That has access into the core Access into the juicy back end There's often a wireless voice network For VoIP phones And like I said earlier There's often a network for guests Because the access points themselves Are the ones making the decisions about Who gets on the network and how they get on They have to have access to those networks At the access point So how's this done Usually done with an 802.1Q trunk Right into the access point So you have a bunch of access points They're all trunked They're all out there So what happens if you have a facility Where your access points are sort of out in the public And you can just walk up to one of them Well, an attacker can tap into the uplink Of one of these access points Establish an 802.1Q trunk into the network itself Establish the correct VLAN interfaces on their machine Start launching attacks So now you have effectively, for example Say we're getting on VLAN 100 right here Where's my mouse Which is using ETLS And we've issued certificates of both ends Top shelf, wireless, encryption We totally bypassed it by just plugging into the uplink To an access point So now we're in We can attack the wireless clients We could attack the access points themselves We could attack the network infrastructure And we can of course go after the back end So how hard is this to do Realistically, you know You're thinking of your own networks now You're thinking of where your access points are hanging up You're thinking, okay I would notice that somebody did this I would notice that somebody plugged into one of my access points But we walked around a number of institutions And found pretty much this in every place You go down Take the elevator down to like lower level two Maintenance where they're washing the sheets Or something like that And there's some access points Just in some random hallway Nobody around, nobody watching you And you can plug right into it And do your thing So this totally works Okay, now talk about centralized networking And this centralized wireless network For example, LWAP How many people here Are using some sort of centralized network LWAP system? A lot? Hands? Nobody? One guy, okay, great In an LWAP centralized network Basically what happens is that the 802.1Q trunk Goes to a centralized controller In the back room somewhere In your machine room And then what happens is Each of the access points Is connected to the network Using a regular access VLAN So they boot up And what they do is They tunnel the traffic from the wireless clients Back to the wireless LAN controller So this sounds great This is much better You don't have to have trunks To the access points You can just have access VLANs You can ackel this off So the only thing that that network can get to Is a wireless LAN controller You have a lot more security options Available to you than you did before But you can still do All sorts of nasty things So what happens if we tap into this? Okay, we're going to tap in We're going to connect our machine To this uplinked port We're going to get on the network And in this scenario What we're going to do Is we're going to launch An ARPS move attack Against all the access points In this VLAN Typically when this is deployed You have a wireless access point VLAN You put a bunch of APs in it They're all available on that VLAN So we can redirect the traffic From the wireless access points Through our machine Dump it off the disk And play around with it later But I said earlier that it's tunneled So it's not terribly useful In its native form So this is what the data looks like If you open it up in Wireshark Wireshark correctly identifies it As wireless LWAP packets But you can't really do anything with it You can't run it through DSNF Or anything like that Because it's not native packets It's LWAP packets With the data encapsulated in the end So that's boring So here's the complete text Of a Perl script I wrote Take that file And turn it into a regular PCAP file So you can grab the LWAP packets On the back end Run through this script Get your regular PCAP on the other side And now you actually have a PCAP Of anything that the wireless clients were doing So if you want to copy this script You can download a PowerPoint And copy and paste right there So I'm going to show you how this works With a voice over IP demo And hopefully this works So I just have a few PCAPs here That we're going to look at So this is going to look a lot like The screenshot that you saw earlier Wireshark being very cool It knows what all these are It sees them as IEEE packets But again, you can't really do anything with them You can't do any sort of forensics On these directly You can't use any other PCAP tools on them It's kind of anti-climatic So what happens when we run it through The decoder script I apologize for saying decryption Because it's not encrypted It's just encapsulated So we run it through the script Turns it into regular old PCAP files So now we have direct packet dumps Of whatever the wireless client was doing In this case, it was a wireless IP phone That we grabbed the data from Scroll down here to the bottom We'll see And there are other clients associated on here At the same time You see some random broadcasts and whatnot Wireshark being very cool It knows all about RTP So we can ask it to analyze that for us If anybody was at our Shmucon presentation Last year, you've already seen this When we were talking about attacking Vonage adapters So apologies if this is the second time For some of you seeing this So like I said, Wireshark is very cool You can pull these audio streams out And we can save the payload out And hopefully this works Hospital operator How may I direct your call? Okay, so just an example of Your ability to completely intercept Any data that's going on On the wireless side That you've now been able to bypass If it's wireless phone, it's probably LEAP You've been able to bypass LEAP Just by tapping into the AP Question, you can't do GRE tunnels From an LWAP access point But if you're doing WISOM And you're booting up your APs In native LWAP You don't have that option It's LWAP That's what you get Yeah, so to do what you're saying You basically have to put another device Between the AP and the network And then on the back end Do the same thing again So that's typically done If you have a remote office And you want to put up an access point You'd have a point-to-point VPN solution in place So you couldn't capture these Off the internet in that scenario Okay, so I'm going to try to do this live And this is just sort of asking for trouble We're going to give it a shot Because I need to do some stuff on wireless And you guys are probably going to de-authenticate me But we're going to try it So here's what we're going to try I have a test rig set up here On the bench top That gives me a tunnel from The con network back to the wireless LAN controller That I've set up in my office Back in Pennsylvania And there's an AP set up here That AP is booted doing LWAP The whole way back through the tunnel To the wireless LAN controller Back in my office at Bucknell And basically what we're going to do Is do an automated artist-proof attack Against this AP Try to collect the packets And then while that's running We're going to go log into an ERP system Do some sort of medical query Something similar to what might happen In a hospital And see what happens So nobody de-authenticate me please So here's like I already showed you a part of the rig What we're going to do We have the Cisco AP on the left That's connected to a WRT54G Running open work and open VPN Creates a tunnel And then we have the attack software Running on this second WRT54G And again if you were at our Shmoopcon talk We talked about the SIPinator Same software Just we gave it a different MAC address Prefixed to attack But otherwise it's pretty much the same As what we did before So we're going to try this And let's hope it works Okay so this is a serial console Into the WRT54G That'll do the automated artist-proof So we're just going to start this up And hope it finds it Now I've got a DHCP lease From the tunnel access point And it's looking in the address space To see if it can find any LWAP access points And we found one So it's targeting it It's now artist-moving it Dumping the data to local flash And then it updates, dumps that file To a remote host in the background So now you're all going to see My totally not-leet AS-400 skills And this could be any sort of Back-end system that's being used And we're going to go run a SQL query here And of course this would In a real world you would have Some sort of nice front-end You're not generally having Nurses running SQL queries, but At least in the hospitals that I've been in Okay, so we're going to do A very efficient SQL statement here To select the records that we want And not create any undue stress On our database system So we're going to dump every record Okay, so this is just some fake data Of course, so I'm not actually Revealing any real data But this is really typical Of what would be going on In a wireless network in a hospital And querying back-end Pulling up somebody's medical records And what not, so Let's see if this worked So this is a Linux box I have back home That's the files being uploaded to Okay, so And yes, I am using Zmodem I'm going to pull that down To my local machine And again, this is going to look A lot like what we've seen already Just, you know, it's this LWAP Encapsulated pack It's not very exciting I sure hope my session's in there Okay, so we're going to Strip this stuff out Okay, so we got 657 packets decoded So that's a good sign I'm going to send that on The decoded version down here So we can take a look at what's in there Okay, that looks a lot more like regular Apparently my machine was doing something there I was doing this Okay, so there's the TCP stream Anybody know why I can't read that Any 400 people in the room? What's that? Episodic, all right If I had a prize I'd give it to you So the bit order is all wrong, of course So we just switched it around But there you go So good example of, you know Data being leaked out from a completely HIPAA compliant facility And that would work pretty much everywhere If you can get physical access To one of the APs Okay, yeah Okay, the question was When he's worked with some LWAP access points There's been some issues with Digital certificates That's true when you work with LWAP APs There is a digital certificate in place That's used to encrypt just the headers Of the packets, but the payloads are not encrypted So the control structure in LWAP is encrypted But the payload is not All right, so going back to some non-demo More PowerPoint-ish stuff here So people are starting to notice That there's a problem with HIPAA There's a problem with medical identity Information leaking and getting out So here's some information From a Harris survey Approximately nine million Americans Believe that they or a family member Have had medical information lost or stolen And 69% of those same people polled Have heard of a specific incident Involving medical record leaking Or being stolen The graph here shows the HIPAA complaints That come into Health and Human Services For 2008, and you can see That's definitely trending up So we talked earlier about the 59 breaches I want to talk a little bit about some of the specifics So this map shows where those 59 breaches occurred And you can see this is not specifically A big city problem This was happening all over the country And big cities, small towns Wherever medical information is being stored That's what makes it a little more unique Than like PCI is that PCI, you generally find that People who are processing credit card numbers Are more concentrated in certain areas But turns out people everywhere need to go to the doctor So this is going to happen Violations The question was, is there any way to look up Violations about a particular practitioner I haven't found anything, but I don't know You would think it would be public information But I haven't seen anything on it That would be nice So I want to look at a couple of these And take a look and see what's actually Been going on with these breaches This is a pretty good one In April at the UCL Medical Center An employee was fired And then later charged For snooping through the medical records Of a number of celebrities Including Britney Spears, Farrah Fawcett And Maria Shriver There were 33 celebrities involved They only ever released those three names And basically she was accused Of selling that to a national media outlet They never said who it was But coincidentally the next day There was an item in the National Enquirer About Farrah Fawcett's cancer coming back So you can piece that together for yourself What's interesting about this case Is that she was actually charged under HIPAA For accessing medical records With the intent to sell them for you know Evil doing, and that carries a pretty heavy Penalty, it's up to 10 years in prison And $250,000 in fines But what's interesting is that the hospital Who allowed this low level like front desk Employee complete access to their database Faced no penalties whatsoever Question The question was have I seen anything Where HIPAA compliance shields someone From litigation I haven't seen that yet but I bet That would work Because this is all they're required to do Under the law so they can't really be held Unless it's like they're grossly negligent Or something like that but if they're Compliant that's all the law says they have to be So I'm going to hold these questions to the end Because we're kind of running out of time Okay Here's another case, this is kind of interesting Some poor cis admin whose job involved Taking the backup tapes home And had the tapes stolen out of his Minivan parked in his driveway And it was a full backup of the ERP system And it contained all the medical records About on 365,000 patients So that was a big deal But the theory is that whoever Stole it was just looking to steal His laptop for drug money And there were no incidents of this information Being used inappropriately So most likely it wasn't leaked It wasn't used for identity theft Financial or medical However, this is the first case where Health and human services actually find A hospital, find a health care system And it wasn't actually a fine, they called it An agreement and they got Their agreement was to pay $100,000 And to change their policies And procedures to prevent this from happening again Health care system of course said Accepted no wrongdoing for this And said well it was an unfortunate Accident And this one is one of my favorites This is real medical identity theft This woman was Arrested for receiving nearly $180,000 worth of medical care And prescription drugs by Impersonating someone else By using her Medicare insurance cards And what not It was a low-level, low-tech attack She was living with this woman at the homeless shelter And just stole her medical information Out of her wallet or whatever it was But what interested me in this Was the amount of money this one person Was able to get from one record So if you're thinking of organized crime Looking for new sources of revenue If one inept person can get $180,000 worth of oxy-cotton Out of one medical ID Then I think this is something that we're really Already worried about And there's a great quote here too That she became skillful at presenting Doctors with symptoms that would lead it That would result in prescriptions for narcotics So she knew how to go in and Make them give her prescriptions Alright, so we're Rapidly running out of time here So now what can we do to make this Better? So I think We've pretty well established that the current rules under HIPAA Are insufficient. The breaches Are still too easy, even in a HIPAA compliant environment We've already talked about that The emphasis that the health care Providers are putting is on Compliance, not on security They're doing this because they have to Not because they want to Okay So obviously there's too many addressable Imimitation specifics. The health care providers Can come up with whatever they want In order to meet The requirements and They can just decide not to meet The ones that aren't even required So there's a lot of play there And they can do pretty much whatever they want When it comes to these things Way too much emphasis on the phrase Of reasonable and appropriate Again giving the end user The entity, health care provider Community The job of figuring out what it means For them to be compliant And of course there are not enough details In the implementation specifics So even if encryption was required Which is not, we don't even tell you What kind of encryption to use To read through some of the federal register stuff There's a lot of talking there about Why they didn't want to do that That they need to be technology neutral They don't want to specify any particular implementations They won't even go as far to say Yes or something like that So there's absolutely nothing in there So what's happening What's happening is really interesting We're kind of coming full circle HIPAA came in to address the fact that There was no central clearing house Of okay this is what it means to be secure So HIPAA comes in place says we're going to be These are the new rules We're all HIPAA compliant But a lot of states are realizing That that's not enough now they're coming up with their own laws So we're kind of back to where we started You have a different set of requirements Than if you're in another state So this is just in 2007 There were over 250 health information Technology bills introduced 74 of them passed So it's going to get even more scattered Than things are now Trade groups are lobbying For increased legislation Obviously they probably just want to sell more hardware But they're still lobbying for it Alright so That's my talk We probably have like one minute now And then we'll be somewhere I don't know where we're going to be for the Q&A But we'll take some questions Oh yeah tons of them Yeah a lot of breaches happen at the third party Definitely smaller entities or even larger entities Are outsourcing their processing And then the guy who loses the tapes Happens to work for the third party Instead of for the hospital Yeah if you look through the slides If you want to look at the references on the page And you actually get the full details Of all the breaches that we talked about today One Just that Providence was the only one that I know about Yeah If you look through the details A lot of them will, the details of the complaints Most of the resolutions say We talked to the provider and they're going to change Their practice and they're not being fined Not until we told them No The gentleman standing up I hadn't thought of checking Google Yes sir Okay we're getting booted out So we're going to go over to room 106 Anybody who wants to Ask us further questions Tell us they don't like our presentation We'll be over room 106