Good afternoon. I always enjoy the WICWIRE lecture. It's a nice opportunity to find ourselves among friends. Welcome to the Schulman School of Law and Kim Brooks, the dean here at the faculty. We're pleased that you're able to join us this afternoon and that we're co-hosting this year's FB WICWIRE Memorial Lecture in Professional Responsibility and Legal Ethics with the Nova Scotia Barrister Society. This lecture is named in honor of Ted WICWIRE. He received his LOB here in 1962. The lecture honors a man who worked tirelessly to ensure that lawyers maintained a level of uncompromised professionalism. We're fittingly proud of his contributions to the legal academy, the university, and the profession. All the better that we have an excuse to do this lecture in combination with our friends at the Nova Scotia Barrister Society. This lecture reflects part of a rich, ongoing relationship between the school and the society. Speaking for the school, that relationship is one that enhances the richness of our program in people and that informs our daily understanding of law, legal education, and the legal profession. Finally, let me say I'm proud to have a lecture that focuses on professional responsibility and legal ethics here at the law school. We house the leading scholars on legal ethics in this country, dare I say, around the world with the exception of today's speaker. We're prepared to have one stray outside of the school. Our students have had a required course in this topic for years and discussed issues of ethics and professionalism pervasively in their time here at the school. Let me turn the floor over to my fabulous colleague, Richard Devlin, who will say a few words of welcome and introduction to the rest of you. Please enjoy. So it's pretty obvious that Kim is on some cold medication when she used the word fabulous associated with my name. So I think it's only cold medication. So I've been invited to introduce our guest today and the initiative is meant to be Jocelyn, but Jocelyn's got a poor voice at the moment. So she's asked me what I do and I'm delighted to have this opportunity. The only problem is that our guest has a 21 page resume. Which sometimes looks like some of the resumes I think some of the students submit for their law firm applications. So the question is, what do I pick from this? So I'm going to just pick a few highlights from your resume. It might take us all afternoon. But the basic background is that Professor Fortney has her Masters of Laws from Columbia. Then she liked the Academy so much when she went on to do her doctorate again at Columbia. Having sort of succeeded at Columbia she went off to Texas Tech University starting off as an assistant professor and then moving her way up over a 10 year period to being the interim dean for a year. She may have got wise on the virtues of deaning and didn't go for it full time. You'll see there's a little gap between Susan and him here. And as that leaves Texas to become the hard Lichtenstein Distinguished Professor of Legal Ethics and the Director of the Institute for Legal Study of Legal Ethics at Hofstra University in New York which is why she's so close to Halifax. And this is her destiny always to end up in Halifax. I could sort of add a few other things. She has three books and some of this may be of particular interest to those who are currently in practice. The first one is Legal Malpractice Law. So Problems and Most Importantly Prevention. So clearly a proactive thinker. Secondly, a Concisory Statement of the Law of Governing Lawyers. And then thirdly, I thought this one is very interesting. In pursuit of attorney work-life balance. And it's not fictional. It's actually a real boot, guys. So best practices for management. So starting something to look forward to. There is a long list of honors and awards both as a researcher and as a teacher. She has, I know, taught 19 different courses. I'm trying to imagine Kim trying to talk my colleagues and myself into teaching one new course per year. So over the course of the year she's teaching 19 different courses. So clearly a scholar, a researcher, a teacher who has much to share with us. And will today talk about management-based regulation of law firms, proof, and possibilities. Susan Fortman. Thank you. I appreciate it. Well, I appreciate that kind, generous introduction. I am absolutely honored to be here this afternoon. And to deliver this Wickwire lecture that's named in recognition of Ted. I saw it was Frederick, but now I know it's Ted Wickwire. And reading his background, I was impressed that not only did he serve the Barrister Society, but he also was a dedicated community servant connected to the law school. And also someone that was instrumental here with the Legal Aid Commission. And so that's very impressive. And so I, as I mentioned, I'm very, very honored thanks to Dean Brooks, to Richard Devlin, the law faculty that are here, people that I've met today. Also the representatives of the Barrister Society, the President, Daryl Pink. I appreciate all of you welcoming me. And I have to commend the people that are at the law school as well as the Barrister Society for the manner in which that they are approaching issues related to the delivery of legal services. Rather than bearing their head in the sand, as some jurisdiction, sometimes my own United States, various states have done, I think that you as a group and your representatives that work in this area have been very, very proactive. We'll use that word throughout this next hour. And looking at these radical changes in legal profession and what's the proper response. And you're fortunate when you go through this examination process in having people that are leaders in the field like Richard Devlin, the people at the Barrister Society. And so I think as Canadians, people that are here connected to this process, you should be very proud as to the way that they're undertaking this initiative in examining what's going on. And just to start with, as Professor Devlin mentioned, I'm going to be discussing management-based regulation of firms and largely drawing on work that I did in Australia. And so with that, I want to get you involved a little bit and we'll make this interactive. Typically when I teach large groups or conduct professional development programs, I have the responder units that way people can't fall asleep on you. And I know it's about 4.30, 4.45. So we won't have responder units today, but I'll ask you to raise your hands on this one question. Because what I'd like you to do is to consider what comes to mind when somebody mentions changes in the legal profession in Australia. So maybe you could just have a showing of hands. How many people think of Wiglas Barristers in federal court? Okay, nobody. How about... Oh, somebody. All right. You go to... You wake up in the middle of the morning thinking of Wiglas Barristers, right? Okay, but you've heard about it. All right. How about... Okay. Law firms selling stock in public offerings. All right. And how about the third? Lawyers systematically managing their practices. So a few of you, people maybe who've done work in the area. Well, what I base this on is there's a radio program some of you may have heard of in the U.S. typically on this radio program that's called Ask... Let's say Ask Ask. Don't... Oh, no. Wait, wait. Don't tell me. They have these quiz kind of questions and typically each of the answers presents something somewhat farcical and one of them's correct. In this case, all three of these are correct. So what we now have in federal court in Australia are Wiglas Barristers. When I was looking at this, I appreciated the fact that there is a four-page report that talks about attire and they say that it's a brief description of attire in federal court. So that's true. It's also true. Some of you have known about the firms that have gone public and so the first one was Slater and Gordon, followed by two others. That got a great deal of attention and play in the legal profession and in business communities. But the one that has gotten less attention, but in my opinion, is far more noteworthy is the movement towards management-based regulation of lawyers and it's this requirement that lawyers implement management systems within their organization. And so this actually goes back to the legislation that allowed lawyers to basically allow non-lawyers to have ownership interest in a firm. And this has developed over a period of time. But when there was legislation that allowed lawyers to bring in non-lawyer owners without restriction, there was a concern as to what would happen and what would that do to the ethical requirements that are imposed on lawyers, what our standards are. And so what we ended up with in Australia were provisions within their legislation to lay concerns about non-lawyer ownership. And basically what you get when you have these incorporated firms who now can bring in non-lawyer owners is three main requirements that I have on the screen. So your first requirement is that if you're one of these incorporated firms that have limited liability and also the opportunity to bring non-lawyer owners, you have the requirement that you appoint a person. A point person is a legal practitioner-director and it is up to that person to both identify and report professional misdeeds within the organization. But also it is that person's responsibility to implement and maintain what are called appropriate management systems. And the point of this third requirement is to have systems in place to ensure basically that any provision of legal services comply with the requirements of the law. So that's the basic three requirements under the legislation. And basically what we see is the statute itself set forth these requirements but did not really define the meaning of appropriate management systems. So what does it mean? We don't know, but what we had in New South Wales was a very creative regulator. Some of you may have met by the name of Steve Mark. He's visited here before and is coming back. He basically worked with practitioners to develop these ten objectives of sound legal practice. And it was working with people in the field what are the stakeholders, the practitioners, representatives of the malpractice insurance carrier, the law society to identify objectives of sound practice. And the point of these objectives was largely to address concerns that typically arise in client complaints and complaints that get processed by the regulator. So it was the regulator working with stakeholders to determine what are the objectives that should be met for a practitioner or firm to demonstrate that they have in place appropriate management systems. And so that was the first thing that the regulator did with these stakeholders. Then the second thing was to come up with a way of evaluating whether those objectives have been met and what they developed was this regulatory regime that involves a self-assessment process. And what was developed out of this consultation was a self-assessment instrument that covers these ten objectives. And the point of that self-assessment instrument was to allow the legal practitioner-director on behalf of the organization to go through a self-examination process and evaluate what is going on within the organization, what they have that meets the objectives, and what do they need to do to improve what they have, particularly if they determine something is lacking. And that they go through this self-assessment process using the instrument. When they do so, they basically are rating their compliance on the scale of non-compliant all the way through compliant plus. And it's really up to the director to just look at what is basically their organization and whether those controls they currently have comply with the objectives. And just to give you an idea of what the objectives are, the ten of them that there are, basically are ones that those of you that are in practice are familiar with, having competent work practices, a objective dealing with communication, something dealing with the process for liens and file transfers, documentation of fees and cost disclosure. So that's a few of the objectives. And then the last ones you see are also things that every practitioner is familiar with, including covering things like conflicts of interest, records management, supervision, and the proper handling of trust accounts. So that's the basic objectives. And so what you have then is a process where the firm works through these objectives and reports to the regulator. And the idea is to do it periodically. They started with once a year, and the idea is then for this process to be repeated. And the hope is that the practitioner, when he or she is working through the form, that this self-examination will allow them to learn from the process. And that's why it is now referred to as education towards compliance. The point is that the entire process now gives the firm, so it could in some ways force the firm's representative to engage in this kind of self-examination and go through the rating. And then if they determine that something is lacking, then they have the window to work with the regulator to improve, to get their house in order. So putting that together, it is education towards compliance. So it's focusing on more of prevention and mitigation, and that's why the program in New South Wales is viewed as being a kind of prototype for what is called management-based regulation of firms. And so this prototype is considered to be proactive because instead of swooping in after lawyers have violated some particular rule, the idea is that the regulator is educating the practitioners so they know what's required and can improve what they do. And so what has happened in Australia is that this started in New South Wales, and then what it did was to move into the other states in Australia, to Queensland, Victoria, and what we've seen is that each jurisdiction has done something a little differently. What we see in Queensland is that they've been, I think, very, very forward-thinking in not only having the one self-assessment tool, but developing a number of self-assessment tools for practitioners, and all of those are available online if you're interested in looking at them. So we have the other jurisdictions in Australia that now have gotten on board, and in addition, people like me who do empirical research have been very interested in what has happened in Australia and then starting with the first study on the New South Wales system. We see that the researchers now have gotten a good deal of play in terms of their study. And one study that I want to mention is one conducted by Dr. Christine Parker. What that study did was to focus on complaints rates involving the incorporated legal practices that went through this self-assessment process. And you see on the screen that I've put the results, the two key results from that particular study, and this was just basically crunching the numbers. And you see that based on the numbers, that the complaints rates for these incorporated firms that went through the self-assessment process went down by two-thirds, two-thirds after they completed the self-assessment process. I mean, that is a dramatic reduction in the number of complaints. So that speaks to education towards compliance in the way that self-examination can contribute to people getting their house in order and hopefully then not having the same number of complaints. And then there was also the aspect of the study that compared the number of complaints involving these incorporated legal practices and other firms. And you see that the self-assessed firms that went through this particular process, that the number of complaints were one-third compared to firms that did not go through this process. Very, very notable finding as well. And as I mentioned, this particular study, these results have gotten a great deal of attention. They got my attention because what the study didn't do is provide the why. Why did the complaints rates go down? And the researchers made the point of saying that they weren't... We could all speculate on the reason why complaints rates went down, but that wasn't one of the issues that they were looking at. So later in 2012, I designed a study to really focus more on the why. The why did complaints go down? What was the effect of implementing these... First of all, requiring the self-assessment process and the implementation of management systems. What I designed was a mixed-method study. So the idea is to survey as many people as possible that were impacted, so we conducted a survey of all firms that had two or more solicitors who had completed the self-assessment form. And then in addition, and we had a 40% response rate on that survey, but then a survey only gives you so much information. You really want the opportunity to ask follow-up questions, which you get in the other part of the study, which are the interviews. And so with an Australian professor, we conducted 41 studies of directors who had gone through this self-assessment process. And one thing that we attempted to do, both with the survey as well as the interviews, is to try to figure out that connection between the self-assessment process, the ethical norms within the organization, the conduct and culture within the firms. So one, I think, key question in trying to figure out what that connection is is just to ask the firms specifically what steps did you go through to complete the self-assessment process. And so I have those results on the screen. So the question that was specifically posed was, you know, what did you do in connection with completing the self-assessment process? And you see that 84% indicated that they had reviewed firm policies. 71% went beyond just reviewing them, but revised their firm systems, policies and procedures. Close to half, 47% actually adopted new systems, policies and procedures. 47, excuse me, 42% indicated that they strengthened firm management all the way down to 6% who went as far as actually hiring a consultant to assist the firm in developing their policies and procedures. So this gives you an idea as to the steps that they went through. And so when you look at these steps, you can better appreciate that from a risk management perspective that the improvement of these systems and controls is what helps explain that huge reduction in the complaints that were registered against firms that went through the self-assessment process. I think that a noteworthy finding here related to firm size, because what I determine when you analyze the numbers and do cross-comparison, cross tabs, is that there really was no noticeable significant difference in the firms that had taken steps in firm size. So that's another way of saying that regardless of firm size, that steps were taken and hopefully the practitioners and the people they serve benefited from those steps. So that was one aspect of looking at the connection between the self-assessment process and the development of systems. Another thing was to actually ask the respondents what was their impression of the impact of the self-assessment process. And so there was a scale there and what I did was to try to then look at their responses and I grouped them in four areas. So the first group were those things that related to firm management and supervision. You can see that was the greatest impact. Moving down, they noted that there also was impact on client service issues. So less impact as a group when you analyze the results, but there still was impact related to client satisfaction, client communication. Less impact in the area of ethical conduct and leadership and the area that had probably the least impact was what I consider firm dynamics. Now if you compare these results, I think it makes sense because the self-assessment process as designed was focused on management systems. Therefore, doesn't it make sense that the impact that's going to be greatest is on supervision, risk management, firm management. What I thought was most interesting in the discussion with directors was that they saw many of them saw management different from ethics and that they thought of ethical conduct as being something different than just management of their practices and therefore they focused more in their responses on the impact on management including firm supervision and risk management and less on ethics. I saw this in other results too when it came to asking about ethics controls that were not covered in the self-assessment form. There were fewer, far fewer firms that had controls that weren't mentioned in the self-assessment process. So that leads one to ask the question whether firms were just using the self-assessment process as tick the box, just go through the motions. And so I asked a question on the survey that related to this. I asked how many agreed or strongly disagreed with the following statement. The statement was that the self-assessment process amounts to meaningless box ticking. For that inquiry, 12% indicated that they agreed or strongly agreed with that statement. And so what I saw by looking at those responses, putting them together, trying to analyze how this plays out is that the directors seem to fall on somewhat of a continuum when it came to analyzing the self-assessment process, the impact on the firm, and what it meant to them as a representative of the firm. And what I've done in an article I've written, I've talked about the continuum, but for our purposes I thought I'd use a diagram instead to in some way capture the way that firm directors might embrace this particular process. And from the interviews from the survey data, what I learned was that you do have the number that are going through the motions that are ticking the boxes. That appears to be the smaller number. Then when it comes to embracing this entire process, you have a larger percentage who now are looking at this process and seeing its value when it comes to complying with the requirements of the regulator, complying with requirements of clients. Because increasingly those of you that are in-house know that clients now are imposing more requirements when it comes to management systems and controls within the organization. So that's a larger number. You have a percentage who also now are looking at this from the standpoint of risk management and are implementing management controls in order to lower their exposure to negligence claims. But the most interesting to me when it comes to the lawyers who have truly embraced this, they're the lawyers and their firms that see having management systems as a way that they distinguish themselves in the marketplace. It's what may be considered the business imperative to developing management systems. And this has occurred typically with midsize and larger firms in Australia. What I learned in New South Wales is that for the purposes of tenders, of beauty contests, that now firms are using their management systems to sell themselves to these prospective clients and to distinguish themselves in the marketplace. Some of them have actually sought now certification that's provided by the International Standards Organization. And so to me, they're the ones that clearly have embraced the development of management systems as a way of merging good ethics and good practice and good management. So to put this together, I think that all indications from my study and the earlier study conducted by Professor Parker is that this management-based regulation is successfully providing these firm directors, first this incentive to examine what they're doing, the tools to do so, and the authority to make changes within the organization. In effect, it's a matter of going to one's peers and saying the regulator is making us do this. We may not have a good system for conflicts, controls, but now this is something we need. That could be done in a larger organization. It could be done in a firm that has a solo or a couple of solicitors who need to go to their paralegal. I thought this was interesting in one of my interviews that a director indicated that the requirement for the self-examination gave that director the ability to go to the paralegal staff and say, we need to clean up what we do. And so in this case, it gave the person really the authority to make changes within the organization. As far as the director's perspective on this being a learning process, getting back to education towards compliance, the majority indicated that they learned from the process and 65% indicated that it helped them solve problems. And so putting this together, I think that in so far in Australia, starting in New South Wales, moving into the other states there, that you have a good system. And the challenge now is to make that good system better. And I think that the way they do so is by expanding the educational outreach and other aspects of what they're doing. And so I've made recommendations on how they can make those changes in terms of Australia, but I also think that the recommendations can help inform what other jurisdictions do as they consider management-based regulation. Here in Canada, different provinces, including your own here in Nova Scotia, are considering regulatory changes to respond to developments in the delivery of legal services. And what we have seen in the other provinces is that there's been a good deal of attention to alternative business structures and questions raised as to the best approach for dealing with alternative business structures if they're allowed. Just last week, the Professional Regulation Committee for the Law Society of Upper Canada issued a report to their convocation that recommended continued exploration of alternative business structures and development of models for entity regulation. Here in Nova Scotia, the Bearsters Society is engaged in what appears to be a very thoughtful evaluation of both regulation and governance. They're doing so pursuant to a strategic plan that I think is concise and informative. And that strategic plan, many of you may know, states two goals. And I'm going to state them slowly for the students. One is transforming regulation and governance in the public interest. And secondly, enhancing access to justice here in Nova Scotia. Those are the stated goals of the strategic plan. Impressive goals. I'm also, I think, taken by the manner in which they are approaching the process because it's very deliberate in inviting stakeholders to participate. We have here Daryl Pink and Victoria Reese. Some of you know that Victoria is the Director of Professional Responsibility for the Bearsters Society. And she's completed a 70-page plus comprehensive report. And it's called Transforming Regulation and Governance. And that report draws heavily on the great work of distinguished scholars and researchers like Professor Devlin. And I commend to you that report. Please read it. I think it concisely analyzes developments and concerns related to lawyer regulation and the role of the Bearsters Society. And I think it also does an excellent job. I'm not just, you know, trying to be complimentary. I'm calling it like I see it. It does a really good job opposing questions for consideration. It ends with a number of steps that should be taken, and they include adopting a proactive approach with lawyers and law firms that involves education and engagement and possibly the creation of an alternative management systems approach. And secondly, allowing firms the room to establish appropriate management systems that fit their practices. And that is meaningful because it's a recognition that one size does not fit all. And what the society has done in terms of being, I think, inclusive in this process is to invite feedback. And so I pulled for you the page on the website where you have the link to this consultation report that Victoria has written. Very well done. I once again encourage you to read it. And you also have a link to a survey instrument. And those of you that are practitioners, if you haven't done so, that survey instrument is worth completing. It gives you an opportunity to weigh in on these issues and for your feedback to be considered. So please do consider submitting your responses in response to this invitation. Now, as your counsel for the Barrister Society and other interested parties are exploring these different possibilities, what I'd like to do is share some recommendations as to what I would ask you to consider as you're evaluating what you do. And this is based on my work on the Australian experience. And so the first recommendation that I have for improving or designing a management-based regulation is to look at the role of the regulator and the possibility that the regulator is wearing different hats and how that plays out. One thing that I learned in particular in the interviews less in the survey is that there were directors that perceived somewhat of a problem with being candid on self-assessment forms with the regulator. It was that if you have the regulator as both an enforcer and an educator, then you may not be as inclined to disclose problems you have within your organization. And some very sophisticated directors recommended that the roles be divided. I know that Professor Devlin's have written a little about this idea of different roles served by the regulator, but here my recommendation for Australia in improving their systems and for other jurisdictions that are considering management-based regulation is to split the roles so that the personnel that are involved in the self-assessment process, the educational role, are different people, different arm of the office than those that are involved in complaints handling. And one thing that came through in an interview was just how this perception plays out in terms of the director's response to communications from the office. In New South Wales, the Office of Legal Services Commissioner used a distinctive color of stationery. And the practitioners associated that color of stationery with the complaint being lodged against them. So they pick up the envelope, it's that color, and what happens? Their blood pressure goes up because they immediately think a complaint's been filed against me or somebody at my firm. And so what this director said, one way of separating those roles is just to have a different color of stationery for the educational arm versus the enforcement arm. But so this is an example, really, of how dividing up the roles of the regulator could make a difference. And basically the educator is there to help, not to swoop in on people who are not necessarily in compliance, is to help them get into compliance. And in the words of one practitioner, the message should be that the only failure is the failure to learn. So that's recommendation really one, going to the role of the regulator. Another recommendation that I'm making is to take this education towards compliance to the next level. They've done a good deal, but more could be done in terms of providing these practitioners more guidance on what needs to be done. I got a great deal of feedback as to the interest in resources that practitioners were interested in. They wanted more assistance to be provided. And I think from the standpoint of the regulator, the regulator's response may be, well, all that sounds good, but it costs money. And so what I encourage those of you that are thinking about costs associated with providing more education and assistance is to compare the costs associated with providing assistance, being proactive, and what that compares to when it comes to adjusting and handling complaints. And what I'd suggest is that it's more economical in the long run to help avoid complaints, help practitioners stay out of getting in hot water as opposed to having someone go down the wrong path and then have to handle the complaints after the harm's already been done. And so there's various steps that could be done to provide this additional assistance. Recommendations from directors would include a comprehensive website that would have various links, the use of electronic newsletters, seminars, workshops, individual consultations. The directors were very interested in having the ability to call someone up and get guidance on what they needed to do. They wanted more in the way of templates. And once again, I think that if we're serious about educating practitioners, then it's a matter of investing in developing these kinds of workshops and resources to assist the practitioners. So that's recommendation two. Another practical recommendation relates to the form and content of the self-assessment instrument. And this is where, both on the survey as well as in the interviews, we got a good deal of feedback related to the way that the instrument should be designed. And one takeaway is that you want to design this form in a way that it just doesn't lend itself for box ticking. And one way of doing that would be to require more of a narrative than just having people rate compliant or through non-compliant or compliant plus through non-compliant is to force the respondent to do a little more when it comes to completing the form. Now that may take time and that's been one criticism of the process is that it does take time and this could take more time to require something descriptive as opposed to just checking the box or ratings. But if you basically required this description the first time through, then later you could ask the respondents, the directors, just to update what they provided. So that's one possibility, is change the form. Another thing that was very clear is that there needed to be different forms for firms of different sizes. Even though they, the Australians have taken the position that appropriate management systems means that what's appropriate for your firm, what the directors in smaller practices believed and many of them articulated was the concern that this form was designed for larger practices and that it wasn't really covering the nature of their practice. So as you're developing a management based regulation system one thing to consider is different instruments from firms of different sizes. Another possibility is to expand the coverage of the form itself. As I mentioned before the form that's used in Australia now, New South Wales and the other states largely covers client type of concerns with no coverage, effectively no coverage of matters related to duty of the courts and issues related to the dynamics of the firm relationship. So one thing to consider is to help directors consider these other issues by integrating those other issues in the instrument. And one self-assessment tool that does that is a self-assessment instrument that was developed for the Canadian Bar Association by Amy Salson who is teaching this semester at University of Ottawa and some of you know Amy. She's done an excellent job in developing this self-assessment instrument that is available and I have the link on the screen. And basically what that covers is not just client concerns but non-client concerns including equity within the organization duties beyond those duties to the client. So I'd encourage you to look at that particular instrument. One, as we think about instruments that are available my question would be when it comes to let's say the Canadian Bar Association instrument is how many lawyers will voluntarily go through the process? We'll go to the link, go through the process. Will they do it? Will they do it because they heard a lecture say this is a good idea? My concern is that lawyers need a push. We have limited time, limited resources and without a push, without incentives we may not have enough interest for people to devote the time and energy to go through the self-assessment process. So what I'm hopeful of is that we will have interested parties and decision makers try to develop different incentives so that lawyers are more inclined to go through self-assessment and to devote time to improving their management systems within their organizations. Now in Australia that push involved allowing non-lawyer owners and that legislation that I mentioned before. So the push, the incentive became the new legislation that required that lawyers implement management systems. So as other jurisdictions are considering the way they can encourage lawyers to go through self-examination, the possibility might be to include this kind of management-based regulation self-assessment process in any changes any new legislation let's say that allows alternative business structures. So that's a possibility is the features of management-based regulation get integrated in some kind of legislation that allows alternative business structures. Another possibility for integrating management-based assistance or regulation is to look at a kind of diversion program for lawyers that are struggling with management and practice controls. And so what we have in the United States in about half of the jurisdictions is a form of diversion for what is characterized as minor misconduct. And the idea is that if the screener of the complaint evaluates the complaint that has been filed against the lawyer and the screener determines that the issue that's involved is something that would qualify as minor misconduct and the screener can make this referral to a diversion program. And the purpose then is for the lawyer to stay out of the complaint side of the office and instead work on improving the way they handle their affairs. These diversion programs in the US started with assisting lawyers that were struggling with different types of impairments such as substance abuse and now some of the diversion programs have expanded to just generally assist lawyers that have issues related to their practice management. Here in Nova Scotia once again you should be proud that you do have a lawyer's fitness to practice program that allows for this kind of diversion better term for lawyers that have some kind of capacity issue so that there's a question as to their capacity to practice that they can go to the fitness to practice program as opposed to going through the regular complaint side. And so my suggestion is as you evaluate management based regulation you consider expanding the availability of diversion so it's not just limited to lawyers that have some kind of capacity issue, but that it would be lawyers who are accused of some minor misconduct that would benefit from this kind of assistance where they improve what they do and hopefully avoid problems in the future. So that's a possibility in terms of a way you can integrate these management based features in what is currently done. Another possibility to consider is just providing more practice management assistance. That's where I said before that I think that the resources devoted to providing lawyers assistance pays off in the short run as well as the long run. And one thing that I learned from the time that I actually represented lawyers when I was still in practice and represented malpractice carriers is that some of the most sophisticated lawyers in practice were concerned about the way that different materials could be used against them specifically when I represented Texas Lawyers Insurance Exchange which was the bar-affiliated carrier in Texas. We developed a self-assessment tool a good 20 years ago and when we then rolled it out and encouraged lawyers to complete it the lawyers that were aware of were basically familiar with what happens in a legal malpractice case were concerned because they didn't want that instrument being completed today and tomorrow being used against them in a negligence case. And so going back to that experience I thought about how we encourage lawyers to go through the self-examination without fearing discovery when they later sued for malpractice. I explored that concern when I conducted an empirical study on peer review in law firms and in that empirical study that involved managing partners of firms with 10 or more lawyers in Texas 36% of the managing partners indicated that they would be more likely to conduct peer review if the results of that peer review were protected and 30% actually indicated that they didn't engage in peer review because they were concerned about discovery. So clearly there's some reluctance to engage in peer review to go through a self-examination process because you don't want the material used against you and so what I'm advocating and I have an article discussing this is a kind of self-evaluation privilege similar to what we have in the United States for medical peer review so that lawyers can go through self-examination the results then would be protected so that they don't have to fear how it could play out in a malpractice case that might be brought later so if any of you are interested in my draft of a proposed self-evaluation privilege please let me know what we have I understand here in Nova Scotia doing some work is currently there is confidentiality that's provided for information that is obtained through the risk and practice management program or through the lawyers assistance program and I suggest that that limited protection be expanded to cover material that is covered and developed in audits including self-audits so that you don't have to hire an outside lawyer to conduct the audit in order for the matters to be protected instead you could develop materials and have that protected if it's done in-house and then finally the incentive that I wanted to mention that is of most interest to me is the possibility of developing a kind of certification program for firms that want to be recognized for their management systems and this goes back to the work in Australia and the feedback that I got from the practitioners that wanted to use management systems to retain clients and to woo new clients could we develop certification programs so that lawyers that were interested in developing their management systems get the certification and that way it is something they do because they want to once again merge good management with good ethics so to put this together as I'm getting to the end of the session here I think that the bottom line for me is that this regulation of lawyers that is proactive really has made a difference and it is and the verb that I've used coincidentally that is the title of the Nova Scotia report that Ms. Reese has written is it transforms that relationship between the regulator and the regulated practitioners because now we no longer have a regulator who is basically coming in after the fact reacting to complaints rather through this proactive approach the regulator is partnering with lawyers and the point is to assist them in improving their management system so it truly is transforming the relationship between the regulator and the lawyers the practitioners from my standpoint I think that we have seen that the proactive system has made a difference we've seen it in terms of the quantitative data on the complaints going down I saw it in the findings from my particular study and I think there's a result that this proactive approach promises not only to reduce the number of complaints and liability claims but also it promises to promote client satisfaction and the quality of legal services and so to me it comes down to public protection and that's somewhat of the drum that I'm beating on this is that if we really want to make a difference long term it will help to rethink the relationship between the regulator and those regulated and to devote the resources to assisting lawyers to get their house in order now one thing that I've done since moving to New York has learned that all good things get captured in a cartoon typically it's the new cartoons out of the New Yorker and I think that often that a lesson can be concisely shared in a clever cartoon so I had to find a good cartoon to capture this and so this one I thought helped us think about being proactive versus reactive so that would be my take away for the students, for the lawyers is to really think about what difference it would make to invest the resources in being proactive and it clearly can all indications lower your exposure for complaints for liability claims there are all sorts of tangible and intangible costs associated with both of those you also have I think longer term the ability to save yourself the headaches associated with those complaints and finally I think in the words of one of the practitioners in Australia the other thing it gives you when you devote time to improving your management systems is the ability to sleep better at night so with that I want to thank you again for including me in this affair today it's been an honor and I think we have a little time for questions so thank you


So, we've reached our final topic for the course, and this topic titled Internet Security is really a couple of examples that show some of the cryptographic mechanisms being used in practice, so in securing Internet communications, which we use on a regular basis, I'll go through really two examples, one securing web traffic, and one using secure shell if we get time just at the end, to demonstrate some of the communication protocols used, so HTTBS will use as an example, which we all use, we want to see how it works, and also when we go through and see how the protocols work, we'll see the algorithms coming into play, the public key algorithms like RSA and Diffie-Hulman, the symmetric key algorithms and Macs will come up and others, so we'll finish with these examples, and we'll focus on web security, but first, all right, some general issues with web security, so, and when I say web security, I mean browsing websites, but in fact some of these comments still apply to any type of Internet application, maybe email security, security of instant messaging applications, line and so on, so similar issues arise, so with applications that we use in the Internet, the Internet has been around for 40 plus years, and the protocols that are used to communicate between computers, and which the main one being IP, the Internet protocol, and another main one being TCP, the transmission control protocol, they were designed many years ago, 30 or 40 years ago, and they were designed assuming that the network that the users were using had no malicious users, okay, so the protocols that we use in the Internet today, which were designed a long time ago, were designed with no security in mind, they assumed that there was no one malicious, and in those days there was no one malicious, the only users of the Internet were the academics and the researchers that were using the network, NOM was maliciously intercepting traffic, there were no commercial transactions, so the design was appropriate for those days, but those protocols, IP, TCP, for web browsing, HTTP and many others, most of them were designed with no security mechanism built in, but of course as the Internet grew and the number of users and the different usage applications grew, then some security issues started to rise and malicious users started to be more prevalent, so many threats arise from people using these applications, and unfortunately the protocols we were using didn't support security, so the security issues in the Internet really, if we think about the three locations where they arise, the computers which are communicating, which we refer to normally as the client and server, can we keep the client computer secure, the disk, the memory, can we keep the server computer secure, and also what's sent between the client and the server, so imagine your phone with a web browser talking to a computer with a web server, the security issues that arise relate to securing your phone, the client, securing the server and securing the traffic between your client and server, and there are many different techniques that are tried to secure those three, we're going to focus on the traffic between client and server, not how to make sure that no one can log into your phone, but to look at the techniques to ensure that if someone sends data from client to server, that someone in the middle cannot intercept and see the data or modify the data without it being detected. There are different techniques to secure the traffic, and those techniques primarily are add-ons, add-ons to the original protocols, so the original protocols being IP, TCP, HTTP, which had no security features, people have created optional extras that you can use with IP, TCP, and HTTP to add security, and we'll look at several of them, not all, but for example to add security to the internet protocol there's an extension called IPsec, it allows you to encrypt your IP datagrams. To add security to your TCP traffic, there's an extension or an extra protocol called secure sockets layer or the transport layer security SSL or TLS, and also there are different protocols for specific applications like log-ins and email. This table shows some of the problems that can arise with internet security, and we will not go through all of them, I think some are almost obvious. Returning back to one of our first lectures, remember we talked about CIA, confidentiality, integrity, and the A was availability, and availability relates to denial of service. The fourth row in this table, authentication, we sometimes combine with integrity, so this table is showing if we want to keep our data confidential what are potential things that can go wrong? What are the threats? For example someone can listen in on the network and see our data, eavesdropping on the net. If someone does that, what are the consequences? Well I may lose information, that is others can access that information or I lose privacy. What are the things that we use to stop those consequences from arising? What are the countermeasures? Well we encrypt our data, we know in general if you want to send data across a network it should be encrypted. For privacy there are other techniques like web proxies. For integrity, how do we ensure integrity? We use check sums. Well check sums, what are they? Message authentication codes, hash functions, the techniques we have looked at. To provide authentication, well we have got different cryptographic techniques. What is the one we looked at most recently? How do we provide authentication in web browsing? How do we authenticate the server? Certificates, so the previous topic we finished looking at digital certificates where a server has a certificate which includes its public key and it is signed by some trusted authority. So the browser when it gets that certificate can authenticate and check that it is communicating with the right server. So that is one of the cryptographic techniques used for authentication. So check sums, message authentication codes we have covered in the topic, used for integrity, hash functions, used for integrity, similar and digital certificates used for authentication, encryption, mainly symmetric key encryption but sometimes public key encryption used for confidentiality. To deal with denial of service attacks, well we do not have any simple cryptographic techniques that we can rely on. It is something slightly different from what we have talked about in this course. Denial of service attacks are meaning our computer system is no longer available for its intended purpose. It is overloaded. The network is overloaded. The server is overloaded by an attacker. That is hard to prevent. So there is a different area of study to look at how to stop and deal with denial of service attacks which we do not cover in this course. So those are some of the general threats that arise in internet or web security and some of the countermeasures that we can use. We are going to look mainly at one example and if time this week or even next week one small example of an application level security. This topic requires some of your background knowledge on the internet because we are looking at how internet security works and some of the protocols we use in the internet. When we look at the protocols used for communications in the internet we organise them in a layered stack or a layered architecture. We think about what do the applications use to communicate. For example, a web browser application uses what protocol? Web browser uses which protocol? HTTP. Web browser uses HTTP. Your email client? SMTP is used. You may have heard of others like POP and IMAP. Maybe when you configure your device you need to choose POP or IMAP to connect to the email server. So they are some protocols used by email applications. Remote login applications for me to remotely connect to another server or computer? What protocols are used? And you have probably done it in some of your homework tasks. You connect into another computer like the ICT server. SSH is an application layer protocol to remotely connect to another computer. An older one was Telnet. So the many different applications we have in the internet often have their own protocols for communicating called the application layer protocols. But many of those protocols, so in this first picture, HTTP for example, for web browsing, SMTP for email, FTP for file transfer, downloading large files normally, and many others sit up here. Many of them require the same functionality. And one of those functions that they require is reliability.  I want to make sure it gets there correctly. It's not lost. And in the internet the main protocol used to provide reliability is TCP. TCP allows us to set up a connection from client to server and ensures that our data will be delivered correctly. TCP is a transport layer protocol. Another one which is less commonly used is UDP as a transport layer protocol. But TCP is used by your web browser, your email client, your remote login software, your database client, and many other applications. And everything is sent across the internet using the internet protocol, IP. And that provides the addressing, IP addresses, and the basic format of the packet to be forwarded through the internet. So a quick summary that we have application layer protocols, specific applications. We have transport layer protocols, TCP and UDP are the main ones. And then we have a network layer protocol called IP, which is used by all of the others. So then the question arises, I want to securely communicate between applications, client to server, where do I add the security mechanisms? And there are three options shown in these diagrams. Three examples. The first one which we call network layer security or network level security. We take the IP datagram and secure that. That is, my web browser generates a HTTP message. It's sent using TCP and IP. Then that IP datagram is encrypted. So we add a feature to IP to provide security of those IP packets. And that feature is referred as IP sec. It's an optional extra. We don't need it, but it's available. It provides a general solution for securing internet traffic. That is, every application irrespective of what protocol they're using or what transport protocol, because they all use IP, if IP sec is enabled, all of that data can be secured. The problem with IP sec in practice is it's not widely used. That is, well, why is it not widely used? It usually requires some configuration from the end user's perspective. You and I, when we want to secure our web browsing traffic, if we want to use IP sec, we may need to set up our computers in advance and set up the server in advance. And most normal users don't have the ability to do that or don't want to have to spend the time to doing some manual configuration. So we see for applications IP sec is not so commonly used. It is used for things like virtual private networks. You want to connect securely from your phone into the SIT network. Then you can use IP sec to do that, and that's a bit more common. So network layer security secures all of the IP packets using IP sec. Another option is transport level security, where we secure just the TCP packets. It only applies in the case we're looking at to TCP. Every application that uses TCP, which is many, web browsing, email, databases, many applications use TCP, what we do is we encrypt the TCP packets and provide some other security mechanisms. And again, there's an optional extra protocol that does that for us, and the old name was secure sockets layer SSL. The newer version is called transport layer security or TLS. We'll list in one slide later those in a bit more depth, but in this lecture you'll see sometimes I'll use either of those SSL or TLS to mean the same thing. There are slight differences between them, but at one point in time they were identical. SSL was the old name, TLS is the newer version. The idea is that it doesn't matter what application you're using, as long as it uses TCP as a transport protocol, we can secure that traffic between client and server. And that usually doesn't require anything from the user to set up. You don't need to configure your computer beforehand to use SSL. It's done automatically. And that means it's widely used today. So we use that as a major example in this topic. The third approach is application level security. For a specific application, we add some extensions to that application protocol to secure the traffic. An example in this picture is for email. Email traffic, when we send packets for email, is using a protocol called SMTP. And normally the email messages sent between email servers are not encrypted. There's an extension to SMTP or an add-on called SMIME, which allows us to encrypt the email messages. This is only for email. SMIME is not used for other applications, just for email. So here's an example where we add security extensions to specific applications. Any questions? So we've got three alternatives. The application-specific techniques are only relevant for an individual application. It means that we need to add, upgrade each application if we want to use them. The transport-level techniques are only relevant for TCP-based applications. But it turns out that many applications use TCP, so that is a widely used solution. The IPsec security works for all applications, but because it requires some configuration from the user's perspective, it's not so widely used. We will focus on the transport-level security as an example. TLS, SSL. And as a specific example of TLS and SSL, we'll use web browsing as the application, because that's widely used as well. So how do we support secure web browsing? What protocol do we use? Secure web browsing. HTTBS. I think you know when you use your browser, you see that HTTBS and the padlock. That is the protocol used for secure web browsing, as opposed to just normal HTTP. So we'll look at that as the example. It turns out that HTTBS is simply normal HTTP, but using SSL and TLS. So we will focus on SSL and TLS. The naming of the history. Originally, the Netscape web browser, one of the early widely used web browsers, implemented the extensions for securing web traffic. And it was called Secure Sockets Layer, SSL. So it was only implemented in Netscape, but it became popular in other web browsers, like Internet Explorer, started to add the features. And it went through multiple versions, SSL version one, version two and so on. And at some point, a standards organization called ITF said let's make it a standard so everyone uses it. And they named that standard transport layer security, TLS. At that point in time, SSL and TLS were the same, or essentially the same. So just two different names for the same technique. So SSL version three and TLS are about the same. TLS has gone through different versions, version one, 1.1, 1.2. So as TLS is changing, now SSL is no longer being updated. But in reality, we'll use, well, in reality, people use SSL and TLS to mean about the same thing. And in this course, when I say SSL or TLS, I mean the same thing. We will not look at the differences between them. Both are still widely used as the name. I will probably use SSL when I speak. What does SSL do? It allows applications that use TCP to use some additional security services. Security services, what do I mean by that? Encrypt is one. An application normally sends data to the TCP software. Before we send that data to TCP, we encrypt it so that if someone intercepts the data, they cannot see the original content. So encryption is one service. But we know to encrypt, we need a key. And if we need a key, we need to do some key exchange up front. So SSL also provides the ability to do a key exchange. And we also know with key exchanges, we need to be sure we're communicating with the right entity. We need to authenticate. So SSL provides ability to do authentication as well. SSL is quite complex. There are many different components to it. So we'll see in some of the next slides some of the details and that it actually consists of multiple sub protocols. So there's not just one communication protocol. It's made up of different parts. What we will do in this lecture is rather briefly present some of the overview of SSL. You will not be required to remember all the details, but then we'll go through an example of SSL and you'll see some of the details arise. So the overview of SSL is shown in this picture. Normally your application in this example, the web browser, your application uses an application level protocol like HTTP. Without SSL, the HTTP message is sent using TCP, which in turn uses IP to send the data across the Internet. That's without SSL. With SSL, we have an additional protocol called the record protocol that does the encryption of the data. So instead of sending the HTTP message directly using TCP, we send the HTTP message using the SSL record protocol, which will encrypt it, add a checksum or add a message authentication code for integrity. So that's the role of the record protocol to encrypt our data and to add max for our data. But to set that up so that both endpoints know which encryption algorithms to use, they know which keys to use, there are some other techniques. So there's a handshake protocol for SSL. Before we send any data, we must agree between client and server what algorithms to use, what parameters to use. Do we use AES to encrypt? Do we use RSA for public key certificates or some other algorithm? And that's the role of the handshake protocol to exchange those initial parameters and set up the secure connection. Then we can encrypt with the record protocol. So that are the main ones we'll look at. Also it turns out what we do with SSL is we use one algorithm for encryption for some steps and then we may change the cipher to another one. For example, for the key exchange we may use Diffie-Hellman and then for the data exchange we may use AES. So we may change the cipher during the connection, so there's a protocol for changing the cipher to say to the other side, let's change the other one now. And the last one, if something goes wrong or there are warning messages, for example, the client sends a message to the server, the server cannot decrypt it or the message authentication fails, then there's an alert message or an alert protocol for the server to send back a message to the client, if something went wrong, warning or error message. Sometimes it's just for notification, it's not an error, it's just to inform the other side about some event. So the main one is the record protocol and to support that we need to go through the handshake to agree upon the algorithms. Before we look into more details of that, let's look at an example of using web browsing. So we'll use that as our example throughout our study of SSL. And we access a website, for example, I access the index.html page on the ICT server using normal HTTP. I've done it before and if I record the messages being sent, for example, I capture the packets which were sent from my web browser to the web server, we can look at those messages to see how the communications took place. When we're using web browsing, the application level protocol is HTTP and the transport level protocol is TCP. I've got a record of the packets from a past class where I recorded what was sent between my browser and server, so we'll look at them just to remind us how web browsing works. And it's a slightly different example, it's a bit old but I think you'll see the idea here. This is, and those that have taken the lab or my course last semester will know this is the software called Wireshark which shows us the list of packets sent between some computers. And in this example, so we've got the first two columns identifying the source computer and the destination computer. In this particular example, the source computer was my laptop or office computer, I can't remember, it was done a couple of years ago, and the destination computer was I think the ICT server, ICT or IT again I can't remember, not so relevant. So the source computer of <IP_ADDRESS> was my computer, the destination of <IP_ADDRESS> was the IP address of the server at that point in time. So what I did is I accessed the website and these were the messages that were sent between browser and server. There were seven recorded. If we look at just the HTTP messages, we see how HTTP as an application layer protocol works. The source browser computer sent to the server a HTTP message and we call this a HTTP get request. It is the browser telling the server I want to get the page slash IT.html. At that time I accessed a page called IT.html. I send a request for that page and the second message we see is the server sending the response back. The server, the address starting with 203, sending a response to my browser computer and the response says everything is okay, 200 okay. What is inside this response message? When I open up the response message what am I going to see? When I open the response I'll see the reply but what's inside that? What's the main thing in the response? It says okay, meaning the status of this request was okay but there's a thing we want in there. The data, what is the data? It's the web page. With web browsing I send a request to the server I want IT.html, the server sends back a response inside that response. There are many things but the one thing that is of importance to the user, if I look at that response in detail, the contents of that include the web page, the HTML that was in the file IT.html. That's the normal operation for HTTP, send a request for a web page, get the web page in response. What port number does our web server use? Port 80, so port numbers are used to identify applications and server applications use a fixed port number, a web server by default uses port 80. Here we see the application layer protocol is HTTP, the transport layer protocol is TCP and the network layer protocol is IP, the other ones of interest to us. There's no security here, not yet. Here these two messages are HTTP messages but in fact there are some other things that happened as well. What are these three messages? Some of you are taking a class with Dr. Comet and I'm sure in his exam in the next couple of weeks you'll ask about this. What are the first three messages shown in this list of packets? The handshake, it's called a TCP three-way handshake. So this is the first part of my browser, remember, <IP_ADDRESS>, connecting to the server. Before we transfer any data, we actually set up a connection and the normal way to set up a connection, we're using the protocol TCP, we send a special message to the server saying I want to synchronize you with you, a SIN message. The server sends back a response saying I acknowledge that you want to synchronize with me and I also want to synchronize with you and the third message is the browser sends back to the server I acknowledge that SIN message you sent to me. SIN, SINAK, that's the three-way handshake with TCP, we always see that before we transfer data. This is to set them, to let them know that they're about to communicate. Why do we need this handshake? TCP, the protocol TCP has several main services. One thing that TCP does for us is when I send data, say from my browser to the server, I don't know if I got there. Maybe something went wrong in the internet, so I don't know if data got there, so what we'll normally do is we'll expect an acknowledgement to come back to say your data got there. If it doesn't, we may have to resend that data. The other thing TCP does is if the client sends data too fast for the server, it may overflow the server. So there are some mechanisms for the data transfer that require some initialization of parameters at the client and server. And that's the role of the connection set up, to synchronize some initial values so that they are aware we're about to transfer data. So every application that uses TCP will use this to set up. Once we've set up, then our browser sends data to the server. The data in this case is the HTTP message, even though the protocol listed here says it's HTTP, that message is actually a TCP message, but the data inside that is the HTTP request for that web page. This one, coming from server to browser is just a TCP act saying thank you for your data. Browser sends data to the server, server sends back an acknowledgement saying thank you, everything was okay. The next message is data going from server to browser. The data is our web page, the IT.html page. And the last one shown here is an act coming from browser to server saying thank you for that data. The point being is that from the application's perspective, HTTP, if we filter just for those messages, it's a request and a response. But to support that, there's actually a TCP connection set up at the start and for each data message there's also some acts. So sometimes we'll hide the TCP messages, sometimes we'll show them. To be clear, let's just draw that so everyone remembers the structure. When we're using HTTP, we have our browser talking to the server and the exchange of messages we see, we see there's a three-way handshake at the start, SIN, SINAC and ACK. Over the three messages, I'll just summarize them as the SIN message, the TCP SIN, the SINAC that comes back from the server and the final third message in that handshake called an ACK. This is to set up the TCP connection before we transfer any data. Then we send some data and the data when we're using web browsing is the request for the web page and I'll just list that as the HTTP request or the, in our case, the HTTP get message. Meaning I want to get a particular web page. Most of you know this already, your experts on HTTP. There's an acknowledgement that comes back saying thank you for that data and then eventually the server sends back the web page. I'll denote as the HTTP response and there was a final act that we saw there saying thank you for that data and I say most of you know this and if you don't you'll have trouble in your exam this time. Any questions on HTTP so far? No security yet. But what we want to look at is when we use web browsing how do we secure the communications? We have a request for a page we get the response but to support that we need to set up a connection at the start and we sometimes have some acts coming back. What we want to do is from a security perspective ensure all the data sent using TCP in our case the HTTP get and the HTTP response we want that to be secure. By secure I mean encrypted and authenticated that is make sure that when we receive it it hasn't been modified along the way. So that's the role of SSL in this case. With SSL we do some extra steps to ensure that we can encrypt this TCP data the HTTP get and response. So with SSL the HTTP get and response will be encrypted with the record protocol but before we use that we must do an additional handshake another set up to say let's agree upon some security parameters. The TCP handshake is to agree upon just the TCP parameters but in addition we'll need a SSL handshake to agree upon the security algorithms and the keys to use. So we'll see that come up soon. Just some terminology that we may see in the example that comes up. We saw when a client connects to the server we create a TCP connection. We set up that connection with that first three-way handshake. We send some data. What I didn't show in the example is that when we finish sending data we may close the connection. We skipped over that there's also a concept of an SSL connection which directly corresponds to a TCP connection. So we can say that we have a TCP connection from browser to server and we can also have an SSL connection from browser to server. But in SSL there's another level as well. There's called SSL session. In an SSL session again between client and server we would do a handshake. We'll agree upon the parameters to use. The algorithms, the keys that will be part of setting up the session. And once we set up a session then we can have multiple connections associated with that one session. The idea is I set up my secure session between my browser on my computer and the web server. And then I transfer some data securely and maybe a little bit later I have another TCP connection using the same session parameters, the same session. So we can have multiple SSL or TCP connections associated with a single session. We don't have to set up the secure session every time we want to create a TCP connection. There's an overhead of setting up the secure session so we want to avoid that and we can do that with sessions and connections. So we'll see that come up in one of the examples. So at the start of a session we'll perform a handshake, agree upon some parameters. Once we perform the handshake both the client and server will record information about this session. Some of the information they'll record is there'll be an ID of the session, something that uniquely identifies it. When there are certificates used they'll be saved in memory at the client and server. The algorithms used for compression although not part of security will often compress the data. The cipher spec will list the set of ciphers that we use. For example, the symmetric key cipher, the MAC algorithm, the public key cipher will be listed and recorded and the secrets will be stored. There'll be a master secret but there'll be also some other secret keys. So these are the keys. These will be stored for the session and for each connection a session may contain multiple connections the specific keys will be stored. So what we'll do, we'll have one master key actually there may be two master keys we'll see and they'll be used to generate session keys. It's confusing the session keys here referred as encrypt keys and MAC secrets. And there may be sequence numbers to keep track of the messages we've sent give them in order. Initialization vectors we remember from the modes of operation CBC and other modes we often had an initial value that value will be stored and often we will need some random values say for nonces set up the initial session so they'll be stored at the client and server. So the idea we establish a secure session using a handshake protocol store this information at both client and server then the data that we send between client and server will be encrypted and authenticated using a MAC. Let's see some of the steps involved there. First how do we encrypt the data? And this summarizes the operation of the record protocol. What we're talking about with the record protocol is after we've set up a secure session after some handshake we have data to send for example our HTTP get message is considered data. I want to send it from my browser to the server but I want to send it securely. So the record protocol is that data that entire HTTP get message and does this with it. So if we consider we start with the application data say the HTTP get message we go through these steps. The data may be different sizes in different applications. So first we fragment it we split it into equally sized fragments and the size will be defined for the session it's usually I think we'll see maybe 128 bytes of that similar to 128 bytes. We split the application into equal sized fragments. If my application data was a thousand bytes then we'd get our eight fragments. If it was 10,000 bytes we'd have more fragments. For each fragment of data we then apply the following operations. It's shown the first fragment but these operations apply to each fragment. We compress the fragment. It provides no security but it may improve the performance of the data transfer because if the fragment can be compressed we can save some space or the amount that we need to transfer. Compression is actually optional. We may compress with what's called the null algorithm but we'll see that we have the option to compress. We take that compressed data and calculate a message authentication code. Remember the purpose of a MAC is so that the receiver can verify the integrity of the data. If a MAC is attached then the receiver gets this compressed fragment and the MAC and the receiver checks does the MAC of the compressed fragment match the MAC received. We've covered that concept in the topic on message authentication codes. What does a MAC take as input? What does a MAC use as input? Here it uses the compressed fragment and importantly a MAC takes two things as input. If you go back to your slides on MACs you'll see the MAC function takes a key, a secret. For authentication MACs use a secret key and the data. When we looked at hash functions they just apply on data but MAC functions also have a secret key. So there is a MAC secret that is needed to perform this operation. So when the client has its compressed fragment the data it calculates a MAC using that data and a secret key and that secret key of course must also be known by the server. So that will be one parameter stored and known and agreed upon from the handshake. So it's referred to the MAC secrets here. We take that compressed fragment with the MAC attached at the end and then encrypt all of it. What's an encrypt function take as input? What's an encrypt function take? A key and a key and the data. So that what do we encrypt? We encrypt this component and we use a key to encrypt that and we're using symmetric key encryption to encrypt here. For example AES may be used but others may be used. So there's also an encrypt key or an encrypt secret. So in fact there are two secret keys here one that's used for MACs and another that is used for encrypting the data. And they're usually different and random values. So we have two keys that both the client and server needs to know here. One for a MAC, one for an encrypt and to add some more complexity for the direction from client to server we use one set of keys and from server back to client we'll use a different set. So in fact there are four keys now. MAC for one direction, client to server a MAC key from server back to client and also encrypt key for client to server and encrypt key for server back to client. How do we get these keys? Anyone want to guess? How do we generate our MAC secrets or our encrypt keys? Random. So with symmetric key encryption and they should be random values. So if our client generates a random value, how does a server know it? We may need some key exchange to send the value to the server. Well we don't do that for each of those four values. We don't do it for the encrypt keys and MAC secrets. We'll actually have a master key. So we'll say generate a master secret key perform a key exchange of that master secret we'll see an example using Diffie-Hulman and then once both the client and server have that master secret key they will use a known algorithm to generate encrypt keys and MAC secrets. So we'll use the master generate the other sub keys and the algorithm they use is usually applying a hash of some known values. So the encrypt keys and MAC secrets are generated from the master key. The master key is the important one there. How do we get the master key at both sides? We'll see that in the handshake protocol. So we've encrypted our authenticated compressed fragment. The last thing we do is we add a small header to the front indicating the fragment order this is fragment number one the next fragment and so on and to indicate that this is using SSL it's called append the record header. Fragmentation there are some limits on the size. Compression you may have an algorithm or it may be a null algorithm that is no compression. It's lossless compression we can't compress data and throw parts away it's not lossy. The MAC is normally we use HMAC and there's a secret used in the MAC encrypt we have a secret as well a separate secret in the MAC one and the SSL record header includes a few fields like the version of SSL we're using what content type is included in here and the length of that message the compressed length shown in sort of summary version there the entire SSL message there contains the plain text optionally compressed then the MAC is attached and then all of that is encrypted and then we add some header fields at the start that will be sent across the network instead of the original HTTP get message that was for the record protocol for when we send data there's also some additional structure of the messages for the handshake the change cipher protocol and the alert protocol which are listed here but not relevant to what we want to the detail that we need to discuss yes so where does this occur so the application data comes from your application so your web browser for example your web browser you click on a link your web browser generates this HTTP get request that is what we list as the application data here normally that is then sent to your operating system to your OS and your OS uses the TCP software to set up a connection and to send the data what we do with SSL there's something else inserted between your application and the operating system and that something else it may be implemented in the application or more commonly nowadays it's a separate library or a separate piece of software on your computer that your application sends the data sends to this library that implements SSL that library software on your computer fragments compresses adds the MAC encrypts generates this SSL fragment sends that to your operating system so the application data comes from your application the end result of all of this goes to the operating system and is then sent using TCP so these steps are done by the SSL software on your computer what SSL software what's the name of some SSL software a library that you use OpenSSL you've used on the command line is actually intended for this purpose it's built to originally to provide a library to insert between an application and your operating system to do all of these steps on the command line but it's more commonly used automatically by applications so to visualize that that was the exchange with HTTP let's draw a different perspective from the client's perspective with HTTP we start with our application so our browser generates some HTTP get request this is our application data and it sends that to our operating system I'll draw it down here so we can compare and the operating system then sends a TCP message TCP data that's the normal approach browser generates application data HTTP get request for example it's sent to the operating system which generates a TCP data message actually before it generates the TCP data it does the TCP connection and then generates data and sent what about with HTTPS well our browser does the same there's nothing different generates the HTTP get that's the application data but then we have the SSL software in the middle the SSL library and that sends the I'll say the encrypted fragments encrypted to the operating system so the operating system or the TCP part of the operating system receives these encrypted fragments and it just treats it as data and sends as TCP data but the data is of course encrypted and authenticated it's not the unencrypted or plain text from the application so SSL we insert this extra component or layer between application and operating system the SSL software maybe it comes with your browser so maybe it's provided by your browser or maybe it's a separate piece of software on your computer a library a standalone library depends upon your system so the question why do we use port 443 so you're jumping ahead see the slides we'll come back to the handshake later we're talking about SSL in general but the example SSL we're using and it's the widely used one is HTTPS so HTTPS is an example of an application using SSL HTTPS all it is send your HTTPS messages using SSL so what's the difference well I think you know from the URL perspective your URLs start with HTTPS as opposed to simply HTTP that tells your browser whether to use normal HTTPS or the secure HTTPS that is if you if the URL includes HTTPS your browser knows send this HTTPS get request to the SSL software don't send it direct to TCP in the operating system when your web server again the web server may receive requests using the normal HTTP and be processed and sent back or it may be receive requests using HTTPS and the way that the web server distinguishes between them is using a port number so when the browser sends the first message to the web server a web server normally receives on what's called port 80 with HTTP but a separate port number port 443 for a secure web server HTTPS why do we have two different ports what's the answer you ask the question why need two different ports what the port numbers use for to be not ambiguous between applications that is we now have two different applications on the web server really the one that handles normal they are treated separately so we actually have two different port numbers there so that's some of the details of the implementation of the web server while we're here what else we will see when we use SSL to send our HTTP get request and to receive the response back everything is encrypted what does everything include the URL remember in the get message it says get but that is encrypted so if someone intercepts that they don't know the specific page you're accessing they don't know if you're accessing it.html or abc.html so that component is encrypted the file is encrypted someone still knows the server you're accessing you cannot hide the server you're accessing because that's identified by the IP address but you hide the the rest of the part of the the URL the contents of the web page are of course encrypted so when someone sends back it.html all of that is encrypted so someone cannot see the contents of the web page you're accessing when you access a website and it has a form you fill in the form and press submit all of that data which is submitted with the form would be encrypted so no one can see the data when you type in your username and password and press login that is implemented with a form that would be encrypted websites often use cookies so that the website can track your recent communications keep track of your communications with this website those cookies are sent using HTTP so they are also encrypted and the HTTP messages contain headers and sometimes that gives revealing information that is all encrypted so if someone intercepts using HTTPS they cannot see any of this information but if you're using HTTP if someone intercepts your communications they can see all of this let's go back we'll see what we got to and set up for the handshake our picture HTTP using a browser directly operating system HTTPS we have SSL software in the middle this is an example if I wrote my own game application I want to create a new game I write the game client and the game server not using HTTP but they communicate using my own protocol then I could have the communications between the game client and server secure using SSL I would have my game software my game client that generates messages to be sent to the game server instead of me encrypting those messages inside my game client software I simply send those messages to the SSL software which sets up the secure connection and crypts them for me so that's one of the benefits of transport layer security the application doesn't have to implement that security and the application developer doesn't have to implement that security you leave it to an existing library which is well being well tested and is shown to be secure in as many cases as possible so when you develop your own application you can use SSL to provide security across the network before we can do any encryption and when we're applying the MAC we must decree upon parameters and that's the role of the handshake protocol so we'll briefly summarize the steps and then after a break we'll go through an example but let's just summarize the steps first what's the purpose of the handshake protocol two main things we want to perform authentication we would like to be allow the client to be sure it's talking with the correct server and also sometimes for the server to be sure it's talking to the correct client so the authentication of both sides is supported with SSL and it's done in the handshake protocol and we often need to negotiate or agree upon algorithms we're going to use and keys we're going to use and as well as other parameters so that's the other purpose of the handshake agree upon what algorithm we'll use for key exchange for example RSA or Diffie-Helman what algorithm are we going to use for the MAC and the two common ones that we use HMAC with either SHA or MD5 and what are we going to use for encryption and you can choose from many different ciphers to encrypt symmetric key encryption so there are some messages that happen in the handshake protocols that both client and server will agree upon these values and the handshake protocol goes through four general phases first we establish the capabilities of each other the client proposes algorithms to the server the server chooses one that is the client will say I can support RSA and Diffie-Helman for key exchange I can support HMAC with MD5 and I can support RC4 DES and AES for encryption the client will send that information to the server the server will choose one of those which of course it also supports so the server may support multiple it will choose the highest one as preferred by the client and send back a response saying let's use this set so it's not one algorithm it's a set of algorithms for key exchange MAC and encryption also compression so they agree upon algorithms authentication of the server the client wants to be sure it's talking with the correct server how do we do that commonly certificates the server can send it certificate to my client and the client can verify the certificate we'll see that's common with web browsing and key exchange what key are we going to use for encrypt so we'll actually exchange a master key usually and then use that to generate other keys so step 3 we may and this is not used for HTTPS but it's possible that the server can authenticate the client that is the client sends its certificate to the server and the server verifies that it's talking with the correct client so that's also supported we don't normally use this step 3 for web browsing because to authenticate a client with web browsing we usually use forms so we don't use certificates but it's supported by SSL then we do some final exchange to say we've set up the connection and after that we apply the record protocol and encrypt all of our data so with HTTPS we're going to see an example where we see the step phase 1 phase 2 there will not be client authentication and finally we'll finish setting up the connection there are many different message types sent let's just list them this summarizes the main exchange in those 4 phases the client and server establish capabilities sending hello messages client says hello server says hello back the server authentication the server sends a certificate and then some messages to perform a key exchange and then it's eventually done and if there's client authentication it's not necessary but if there is the server may request a certificate the client sends a certificate and there's a key exchange and a final verification usually we will see there's only one message here the key exchange the certificate is not sent then at the end to finish up they say let's change from this previous cycle we've used and now let's start encrypting our data with AES or the encrypt cipher chosen and they both do that they say let's change the cipher to the new one I've finished the set up of the session after phase 4 now we send our encrypted data this is easier to see with a more detailed example and we'll use the example of web browsing to see this exchange and we'll look at a capture of web browsing


Grab that white shirt bring him here now put him down. Just take a knee.  Who did it? Why did you do that to me? What's good y'all? It's your boy Ross back again with another video. So we're gonna check out LA night most savage moments outside of This should be a very interesting one LA night is one of if not, he may be The most over person in wwe right now. He is Arguably up there right now. It's any time his music hits the fans go crazy and people have been supporting him in All these Feuds and him losing matches. It's like every negative thing that wwe creative has done To la night. It doesn't matter the fans Have clearly chosen him to be the guy, you know And they want him to be the guy and be successful in the company and they won't take no for an answer And I love to see that the fans are choosing this it feels good It feels organic So we're gonna check out some of his moments where he was going crazy and being savage in other Promotions, you know I'm saying that's another good thing about LA night. He is really good when it comes to his promo ability He makes you actually care about what he's saying. This is my venom wrestling late to the original video down below Skip right into this one Walk behind me because you're the guy that stands in the background I'm the guy that wrestles the main event.  This is my show I own this show, but more importantly than anything.  Okay, okay Why is that it's because of guys like you But at the same time here you are Just waiting to die. What that means is if I need to I can be sure that's her own game I'm gonna be the best at his own game and that's exactly how it's gonna go down There's no other way it can be at home coming Eli knocked over the board You make sure you watch I want you to watch this die Watch your creation die You want to talk about how you're the one pushing this company? You're the one but I'm the one pushing this company Don't make mistakes. Wow Hands will be raised in victory Not here Wow It's just a fact of life Everybody in the FSW has been beaten by this cross I have with He knows his place.  I appreciate that sir I see a lot of bad hombres here a lot of bad dudes in his mouth except his own You've done a lot of stuff for what you've been given, but that's the key It's what you've been given Because you walked in here from day one. They put you on the elevator straight to the damn top I've had to take opportunities. I've done what it needed to be to get to the top to get to where I'm And I'm still not there pal.    That is just a fact of life Disrespect I look at James storm. He kind of reminds me of a Roomba He keeps going till he hits the wall then he goes somewhere else in the entire time.   You did this to yourself Is that christmas Because We got three men standing right here now who have a common bond We're not superstars.   I'm talking Don't talking like that you might end up in the hearty hospital Hey, man This was dope seeing like some of these clips of him in in a tna impact Oh, well, I don't know if they call it tna impact I think they just call the impact wrestling at that point But just seeing that and him with uh, karen cross and drew and christmasters. That's that's actually Pretty damn dope man. He always had that charisma about him You know, he always had that that type of mannerism in that it looks like he's been a heel Majority at the time the way he talks his trash. I can appreciate it. It definitely gets some old school wrestling vibes And I think that's why A lot of people gravitate to him because it reminds them of a different time In wrestling when people deliver promos like that Like it seemed like a lot of that stuff is just off the cuff And you can appreciate that it gives me old school rick flair vibes where he would just He would Go in on an opponent. He'll interact with the fans sometimes like it was it was just everything seemed to flow just Off the top of the dome man. So I can appreciate that so comment down below Let me know some of your favorite la night Moments or as he used to go by elie drake moments Let me know down below if they weren't listed in this video And I appreciate all of the support you guys shown on channel road 250k and i'm still here and speedy you to rest in Chipwreck appreciate your kicking me see you next one. Peace