Okay, and let's go ahead and bring in David Cantor, a criminal defense expert as well, who's helped us put things in perspective here, David. The jury was able to ask, as we've laid out for folks who are just joining us, hundreds of questions of those witnesses who came to testify. We had dueling psychologists going back and forth on what they thought, PTSD, borderline personality disorder, by letting the jury ask questions directly before those witnesses were dismissed. Did that really cut the length of deliberations when they finally sat down to determine her fate? Yes, absolutely. I think by allowing the jurors to ask questions, they're cutting to the chase of what they're really looking for. So I believe the jury questions tell you exactly where they're leaning whenever it comes in. David, let me ask you. Some people were very surprised that the jury in this case was not sequestered, especially with the length of the trial and the intense media coverage. It would be almost impossible to believe that the jury members didn't accidentally, at some point, see some media coverage of this trial. How do you think that may have impacted not only how they tried to stay away from that type of material, but then also knowing how big of a circus it is outside the courthouse, how that may have impacted them as well? Well, I think absolutely the jury should do their duty and not watch the media, but it is almost impossible if you're clicking through the channel. And I do think it does have an effect. And if I were to judge, I would ask the question to the jury, especially once national media gets phoned. Okay. And I want to get back to what you said just a moment ago about those questions that the members of the jury asked of the witnesses being kind of a tell-tale sign of which way they might be leaning. How did you read their questions as a prediction of today's verdict? Well, the questions were definitely favorable to the prosecution. I don't believe they're favorable to the defense. And a sheer number of questions that were pro-prosecution, in my mind, indicates that they're probably leaning towards the first-degree verdict. If I had to guess, I also thought if they would have drifted in the next week, it would have been more likely that a second-degree verdict was coming. But this is incredibly fast for a 16-week jury trial. And the rule of thumb is the quicker the jury verdict, the more likely it is going to be guilty. Now, there's exceptions with O.J. and K.C. Anthony. And it was another one, yeah. So I think I would not be shocked if they came back with first-degree and then it goes to the penalty stage repair. Juan Martinez, the prosecutor in this case, had a very different style than the defense attorney. It was very aggressive, especially early on in the trial. Sometimes the questioning was even somewhat bizarre as we got into snow-white questions with the domestic violence expert. But how do you think that his style and his aggressive style played not only to everyone who's watching this case at home, but to the jurors specifically? Well, I think his aggressive style plays well to the people watching at home because that's the Nancy Gray style of questioning where he's just attacked.  Now, in this particular case, he was provided with a treasure trove of cross-examination because she had lied on videotape and she had given interviews where she challenged any jury to find her guilty. So in this case, she was probably OK about 95% of the time. I don't think it backfired because I think you'll get the first he was looking for. However, in other cases, when I was a prosecutor, you got to learn to back it off a little bit and you got to learn to let the question just hang in the air and not necessarily do every question as a nail that needs to be hammered. All right. Well, David, thank you so much for joining us. In fact, I'm sure we'll be tamping your knowledge a little bit later.


welcome to the HR online surgery. We have with us today Gary Morrison who's a senior lawyer from Co-op's UK. He has extensive knowledge of employment law. We have Kate Fielding who's the Co-op's UK HR Reward and Policy Manager and a member of the Chartered Institute of Personal Development and we also have Tim Knowles who's an expert in employment law, HR policy, employee relations and a qualified solicitor and so without further ado I'm going to let you just hear the panel speak just say a little bit about themselves and what they've been dealing with in the past couple of weeks and and then we'll take your questions from there. Gary, Gary would you like to unmute yourself? Sorry, apologies for that. That's all right thank you. I'm Gary Morrison over the past couple of weeks and I've been dealing with a number of queries in a number of areas. First of all it was self-isolation and SSP moving on then to things like furloughing and what should be paid, shielding and even had some queries on the working time regulations and whether they still apply at the moment. Thanks Irina. Hi everybody yeah so for me it's more around the HR and employee relations side of things so looking at your relationships with your employees if you're needing to furlough employees whether or not they're amenable to that whether there are issues between different employees if you're asking some employees to go on furlough leave and other employees to continue working and any impact that that has in the employee relations between your teams. And Sam, thank you. Good afternoon everybody. I've been working in three areas phased over the last three weeks really. I think the first week was concentrating on leave and pay and the second week was dealing with flowing in the main and this week it's moved on to preparation with employers for what could be the more disturbing side if cases develop and thinking about welfare measures for staff where either they or somebody close to them becomes unwell. Okay thank you and I think there's a combined experience of about 35 years between you so that's useful to know. And also Tim did you say that there was some kind of disclaimer to the advice that's given today you wanted to share? Of course thanks for reminding me Irina. Most of the attendees that I saw on the list are members of Cooperatives UK and there's nothing preventing us giving legal advice to members of Cooperatives UK. That's fine but a few of you have signed up for the webinar. We can answer questions generically but we can't give legal advice on the specifics of your own issue or the circumstances of one of your employees if you're not a member of Cooperatives UK but generic advice our understanding of the guidance that's been published and you will be able to get information from our website as well. Okay thanks for that so we've got a few I know we've got questions coming in thick and fast we've got a few that have been emailed to us prior to the webinar and I'm sure that it'll be relevant to many people so you wouldn't be surprised to know that most of the end discussions have been about furloughing and the questions coming in. The furloughing issue seems to fall into two camps the questions related to the technicalities of furloughing and then there's a second section that's kind of unfolding which is all about the creative ways of how to deal with furloughed stuff. So just going on the technicalities side of things first I'll just go through some of the questions that are coming in hopefully they're relevant to others as well. What are the sensible examples of selection criteria for selecting furloughed workers when will we be able to apply and when will wages be reimbursed to them? In the guidance HMRC talks of retrospective audit to confirm eligibility is there any further information on this so over to you. Well I'll start with the first ones if you like. I think in relation to the furloughing scheme this is going to be administered by HMRC it's going to be an online system you calculate your claim in accordance with guidance and input the details. It's scheduled to become opened at the end of April so it's in development by HMRC and they're saying that they will establish back's payments very quickly. You can claim three weeks at a time but no more than one claim in every three weeks. We don't know what the retrospective audit will look like. What I strongly suspect is that because they hold PAYE information already about staff there will be some kind of background checking system where they'll see whether the claim that you've made is within certain parameters and if it falls outside those parameters I suspect they will look at things. We don't know what the HMRC audit process will be and I think we'll have to wait and see. Any HMRC audit process tends to be quite intimidating. They ask for a lot of information and they follow up on that information once they have the details from you. In terms of selection for following I think one of the main selection issues is going to be where has work ceased for one reason or another. Trade may have gone down in particular areas. Business units may have had to close and I think a primary selection criteria is going to be led by who is unable to work because of COVID-19. You can put other selection criteria. They may be forward-looking in terms of skills or knowledge and experience that you need to fulfil what work is left to do but other than that it's trying to adopt selection criteria that don't in any way discriminate against anyone indirectly and as with any I think the best guidance to look at online because you can't see immediate guidance about fair redundancy selection process, fair following selection processes, but there's plenty of information online about fair redundancy and the type of criteria you might use in those circumstances and I think you could adopt a similar approach when choosing people to follow. In terms of eligibility is the firm eligibility criteria apart from considering laying off due to the COVID-19 impact? For example do you have to be down 50% before it kicks in? I guess that's before you feel eligible. 50% down on takings? No I mean my understanding is that you don't need to demonstrate that you're in a position where you may cease trading or you're at risk of ceasing trading. The whole purpose of the following job retention scheme is to avoid redundancies effectively. As Tim said in respect to the selection, any sort of selection for who should be followed really will be very similar to who might be made redundant. There's no criteria as far as I'm aware that says you need to be down in trading or have ceased trading or be on the verge of ceasing trading and it is just a matter of ensuring that you can demonstrate that the whole purpose is to avoid making people redundant. Other questions again on the kind of technical side of things they would like to make use of the scheme. Are they able to back date the following to the first of March if staff have been working throughout the month of March? You can only back date if actually staff have not been working in that period. You can back date to prior to the furlough and coming into the first of March provided your employees were already employed or before the 28th of February. So effectively what they're saying is if you have made some the redundant prior to the furlough and scheme coming in and you would like to retain that person's employment then you can back date to the first of March. I think that's a great point you make Gary, but the trigger to beginning these payments is agreeing with staff that they're going to be laid off. So whilst you can claim back to first of March that's intended to cover those staff who have been laid off. Yeah and then quite quickly we're going into a lot of the questions which are all around kind of the creative thinking around furloughing. So they range but I'll go through some of the ones that have come online at the moment. So can furlough staff volunteer for the organisation that has furloughed them? What are the limitations of this including the number of hours and how can this be checked or how will this be checked? Do we know even? I can answer that if you like. So we know that furloughed staff can't work for an organisation if it's going to further them economically or help them in that way. So volunteering for your own organisation my understanding is that that is a no-no. They can volunteer for other organisations. So obviously for the NHS for other key organisations at this time but not for their own organisation. Other questions around the use of furloughing as well. Can directors be furloughed and if so do they still have decision-making powers if remaining members of the co-op hold meetings to discuss important topics in their absence? So to furlough somebody they need to be on PAYE. So if they're employed and subject to deductions on PAYE they can certainly be furloughed. As far as we can see there will be a distinction between directors duties and work as an employee and therefore it should be possible for you to undertake governance duties whilst you're furloughed. The key point that Kate already mentioned is that whilst you're not allowed to work and the way that they're defining that is making money for your employer or providing services to your employer. So the only exceptions to that we think are going to be governance duties for directors and as you'll have seen in the guidance you can also undertake training. I suppose it's possible to do voluntary work for your employer but not if that involves making money or providing services. I've certainly read some guidance that says as a director provided you're an employee you can be furloughed but you are able to do or carry out or continue with your statutory duties as a director. Okay so just checking for any problems if worker is furloughed for three weeks then works for one week then furloughed for further three weeks and then works for one week and so on. We've had this question before coming in via email as well basically can we furlough for three weeks after working for one week and then furlough for three weeks? My understanding is that yes you can. The minimum period of furlough is three weeks and you can rotate staff to avoid again the whole purpose is to avoid permanently laying them off or making them redundant so yes you can rotate staff to the extent that they will come in and out possibly even on a rotor but there's a minimum period of three weeks furlough. I mean one thing I would emphasize as well is if you are going to furlough employees then you have to have their agreements unless you've got a provision within the contract or perhaps a collective agreement or some relevant agreement that allows you to lay employees off you have to have their agreements to lay them off or furlough them but as I'm aware there's no reason why you can't rotate provided the period that any particular employee is furloughed for is a minimum of three weeks. Okay and will they need proof of contracted hours? How does it work with dates and timings? Do we start on the first of the month? Does it matter? If anyone can help on that? Yeah well I think the way the area to look at is not about how's it work it's about how much you can claim and how you can calculate that. It may be distinct from what they would have worked had they carried on working but essentially you can claim back what the the hire of what they were paid in the same month a year ago or average earnings for the last 12 months so it's not really a question of how many hours or what the working pattern is or would have been but for this happening it's a question of what you can claim and how you calculate that. Okay I'm keen to invite other people to talk as well those that are phoning in and those that want to verbalise their question so Kelvin if yours is I can see your hands up if yours is in the same remit let's get you to um to pose your question to the panel. Can you hear us Kelvin Tebs? Yes I can hear you. Hello?  All right I've been listening to this I just want to know I've been guided as one of the Irish people and I've been told to self self isolate for 12 weeks all I want to know is do I need to pay for them 12 weeks or not? Hi Kelvin I'll do my best to help you. Which co-op do you work for? Skirbit Road, Boston. That's one of the Lincolnshire Food Centre. Yes that's correct. We can only give advice to member organisations I'm afraid Kelvin so what I suggest you need to do is speak to the HR team and indeed you're doing that because there's two of them on the webinar today who are participants like you are. So what I suggest is about your self isolation or rather the social distancing the 12 weeks that you've got to do speak to Lincolnshire co-ops HR team you should be able to give you some guidance. Okay thank you for that. There's a kind of related question how should we treat employees who ask to stay at home even if they can't work from home because they live with someone who is in the vulnerable or extremely vulnerable group where they can't be furloughed? Well my understanding is that is it the employee who's in the vulnerable group or the person who's who they're living with sorry Arina. Who they live with so somebody they're living with is in the vulnerable or extremely vulnerable group? Because the people who've been identified as being in the vulnerable group have had letters or the high-risk people which takes them into the realm of what the term is shielding. My understanding is that if they're living with people who are within the vulnerable group then they may be self isolating and may be due to SSP under the new regulations. Okay could I just add something to that the so we've a lot of different technical phrases popping up in the guidance and the policy announcements that have been made. So self isolation is the seven or 14 day period may even stretch to 28 where you're showing symptoms or you live with somebody that's showing symptoms which we know is clearly going to trigger sick pay even if it's not you personally that's showing the symptoms.  If you're in a vulnerable group you'd probably be advised to work at home where you can. If you're in one of the extremely at-risk groups you'll have been told to isolate for 12 weeks. The living with somebody and supporting them through social distancing perhaps particularly stringent social distancing so you don't want to go to work the legal position is SSP is not triggered and there's no right to pay if you choose not to go into work in those circumstances but many co-ops are adopting different solutions to this so there are many examples of ways in which people are trying to support their employees one of the ways that they're doing it is through having special provisions another way that a lot of employers are doing it is through investigating this following scheme to see whether or not it could be agreed that somebody is followed because they're stringently social isolating and thereby some employment costs could be recovered and the government guidance seems to indicate that that could be done by agreement. Somebody's asking can we require encouraged staff to do training while following I think you've answered that is that yes. Yeah that's one of the express things that's mentioned the only thing that to remember about period time for if you do choose to reduce wages to 80% because it's the maximum you can claim back whilst they're not working that might be below the national living wage and government has said that's okay because they're not working but the only proviso on training is that everyone must at least be paid the national living wage for training time. Can you confirm if the maximum 2500 gross is these gross or net pay? It's gross pay I think yeah. So you can claim as far as we can see it the 2500 is the cap on the gross pay that you can claim but there are some on-costs that you can claim on top of that and it seems on top of that you may be able to get for example employers national insurance and some other on-costs of employment. Pension contributions Tim. Pension contributions. Yeah thanks Kate it's pension contributions up to the auto-enrollment level but nothing beyond that that you pay as an employer. Thank you for that question Kate. So employees need to agree to be furloughed if they withhold agreements so the employer is forced to make them redundant are they entitled to full pay for the delay and consultation period? Yes it would be my answer if an employee doesn't agree the whole purpose of the job retention scheme is to avoid redundancies if somebody's not able to if somebody's not prepared to agree to be furloughed and if you haven't got any flexibility within the contract which may allow you to redeploy them elsewhere then you may be faced with a redundancy situation and that would be dealt with as you would deal with any other redundancy ordinarily you'd need to go through the formalities of consulting with them and meeting with them to try and avoid the redundancy and that would be a process which whilst ongoing the employee would remain an employee so they would continue to be paid following which you'd need to provide notice and perhaps a redundancy payment if applicable. As we're unsure what to do about holiday we notice the guidelines for key industry are relaxed but we're not in that category can we still carry holiday over and we're trying to work out an approach on how we use the holidays? Yes so in fact the the government have announced that you they are relaxing the work time regulations to allow you to carry holiday forward when you wouldn't normally be allowed to so the first four weeks of holiday entitlement you're now allowed to carry forward for the next two years if need be but they remain in 1.6 weeks of holiday leave which you can currently by agreement carry forward for one year is still only for one year but obviously you need to you'd need to think about the well-being sides of allowing employees to to take their holidays as and when they're able to so we wouldn't advise you sort of forcing employees to carry holidays forward unless you really needed to from a business perspective. Okay and we've got some more questions coming in about statutory sick pay I'll come to those in a moment so again just more creative ways of thinking about the furloughing and if a worker signed a contract a month ago begin on the 1st of April and that staff member still be furloughed if COVID-19 has resulted in all work being cancelled by Mayans. So you must have been on the payroll on the 28th of February the following scheme won't cover you if you were employed after that. The only circumstances somebody could be brought back is where a few weeks ago you made somebody redundant you can now bring them back and furlough them no guidance on what you do if you've paid them a redundancy payment or anything like that but we know in those circumstances people can be reengaged and furloughed but it won't cover somebody beginning work on the 1st of March or the 1st of April. You may be able to look at in those circumstances maybe the statutory layoff scheme that existed before furloughing came in to operation again you would need some of these unless you've got a contractual right to lay some of the off you would need their agreement to lay them off as Tim correctly says the furloughing scheme doesn't apply unless you're employed on or before the 28th of February so you're left with this statutory layoff scheme which means that you will lay an employee off or a worker off and you've got to pay them guarantee pay which is a period of five days within a three month period and each the daily payment for each day is limited to £29 so it's the daily rate of pay or £29 which has the lower you've got to pay that for one week in 13 and then you're liable to pay that again and it's not much pay for the employee but it does actually avoid them being made redundant and they can during any period of that statutory layoff seek to claim benefits from the benefits agency. Okay any more on that then email us and if you're needing the support of our staff and you want to become a member then just let us know the membership at uk.coop. Similarly other people wondering whether they can challenge the start date of furloughing they have two part-time staff that would have started with them on the 2nd of March but if the 28th or 29th of February had fallen on the Monday I guess that would be the 2nd of March and not on the Saturday they would have been eligible. Interesting question about whether to challenge. You won't be able to challenge it with HMRC I don't think so the only route that I couldn't think of would be to lobby government perhaps through members of parliament etc but the rules would need to change to be able to challenge that. Yeah another one can furloughed staff in the filling the government furloughing portal or does that count as work? I would think it probably does. I think in some some employment they're going to have to aren't they and it does say you're not allowed to make money for your employer but I think given that you're just recovering costs and the purpose of the work is avoiding making redundancies I can't see that causing an issue. Do we need one person to keep working in order to apply for the government help? I'm sorry we've done that one. Anything from the new COVID legislation that we need to be aware of and could we have a quick summary about the statutory sick pay section? I think in terms of the if you're talking about the coronavirus act that was put through parliament last week there's actually not much in it from a HR perspective. We've updated our website with all of the content about volunteering for the NHS or for social services so there's lots of FAQs on our website about volunteering and those provisions were actually set out in the coronavirus act. Unfortunately in relation to SSP and things like that all of the provisions in the act just give government the power to lay regulations down so they can do that much more quickly than an act of parliament and all the act does is enables them to do it so we're going to have to keep an eye out on changes to SSP so at the moment we're waiting for those. They have said SSP is going to be a day one right that will be backdated to the 13th of March and if you're an employer that employs less than 250 people a number which they take from the 28th of February again another reference to the 28th of February if you employ less than 250 people you can claim back statutory sick pay payments and the main points I'd take home about SSP are that it's going to be payable obviously where somebody's ill whether it's coronavirus or something else but it's unique in relation to coronavirus because you might not be ill if somebody in your house is showing symptoms you should be self-isolating the household should be self-isolating for 14 days and so even if you've no symptoms whatsoever and you don't get any symptoms within the 14-day period you're deemed sick for SSP purposes. I think that's the best overview of what we know about the statutory sick pay provisions so far but there is more to come on that and we will update the FAQs on our website when they bring in that subordinate legislation.  So with respect to the selection for furlough in the the guidance clearly indicates that a furloughed somebody who's shielding can be furloughed and I think the risk for me and something that would need to take into consideration is the actual nature of the condition that means they're shielding and whether that may amount to a disability within the meaning of disability in the Quality Act and clearly if we're selecting them on that basis and perhaps only paying 80% I think it does open the door to a claim or possibly an argument that they're being treated less favourably i.e. being paid 80% as a consequence of their condition but certainly the guidelines say that furloughed employees who are shielding can be furloughed. Can I just add something to that as well in some circumstances particularly if somebody is isolating themselves they're not sick nobody in their house is sick they're just with somebody that's vulnerable or extremely vulnerable to this condition. If they are facing circumstances where they might be unpaid if they isolate for a period the next four, eight or 12 weeks in the cases of extremely vulnerable groups and I think there will be some pressure to furlough them in that they will be requesting it. The guidance doesn't prevent an employer furloughing somebody as Gary said it would be very difficult to have a selection criteria that furloughed people have particular health conditions that would probably be discriminatory in some cases but employees might request that rather than be told to stay at home without pay they may well request or why can't you put me on furlough leave and I think if you've certainly if you've got people requesting it or volunteering and you're happy to accept their request or their their voluntary application for to be furloughed then I think it can be done. One co-op in an unfortunate position they've got no cash reserves and a trade no income no likelihood of obtaining the loan it seems likely we would not be able to furlough our workers is it possible to either lay people off or make them redundant until the situation changes even if not mentioned in their contracts? Going back to the if they're not going to furlough then the choices are really the statutory layoff scheme which provides for guaranteed pay and you could also if they're agreeable to it reach some arrangement where they're laid off without pay there's nothing to prevent an agreement being reached where an employer and employee agree that the employee will be laid off without any pay not even guaranteed pay but that certainly would need to be an express agreement and failing all of that then yeah we're into the territory of unfortunate redundancies but yeah there are sort of a couple of options other than furlough the last one is redundancy but there is the possibility that you could agree with them to be laid off with the guaranteed pay that we discussed earlier or in fact laid off without pay if they agree to it that would mean their employment would continue but just without pay and if there may be clearly you would need to go through a procedure and make them redundant whether they'd be entitled to a redundancy payment would depend on the length of service but actually that latter option redundancy would mean that their employment then ends it's a no longer an employee and kind of link to that is they cannot afford to pay workers until they receive a furlough payment um any advice I guess that's not business advice but that it does go to show what sort of situations people are dealing with out there these are tricky aren't they um obviously if you go on our website there are links to different types of support that are available and the government's position is that you should try and get one of the other kinds of grants you should be speaking to your local authority to see if there's a a means of in some way bridging that gap if you've tried all of those things um and there really is no other way out you might need to consider putting people on unpaid leave until you recover um some's uh some's paid um so it's a tricky tricky one but the government are saying do not uh make people redundant um for the time being um so if you can't pay them um it's not really having an agreement that they will be on unpaid leave it's sending them home and you can't pay them because you don't have the money and you can't get access to those grants but they are saying don't make them redundant um the scheme will come through um in terms of annual leave then as well and um in relation to furlough and can you continue to accrue annual leave whilst on furlough leave okay yes my understanding is as a furlough employee you remain an employee and all the terms and conditions of your employment continue to apply during that period of furlough thank you okay did you want to add anything to that no thank you I was going to say exactly what Gary said but I was too slow getting my unmute button just to go back to the point Tim was making about employees laid off without pay I mean clearly if an employee's agreed that with you then there's probably not going to be any difficulties um one of the things should point out and it it doesn't appear to apply with the the job retention or the furlough schemes with the statutory layoff scheme um or were perhaps an employee's agreed to be laid off without pay um those provisions provide that if you're on less than half a week's pay um for any four consecutive weeks or any six weeks in 13 um the employee can come back and ask to be made redundant so if they're not on the furlough scheme if they're just on layoff because perhaps you can't afford to pay them um there is a provision in in that legislation that allows the employee if they're on half a week's pay for for any four consecutive weeks or any six weeks in 13 they can come back and ask you as the employer to make them redundant okay that's a really interesting point um some asking whether we're going to produce uh either a checklist or some kind of resource template letters that can maybe available to help um to furlough employees um there is no particular template on furlough employees as i understand it can anyone help there i've certainly drafted a letter um for um our members certainly have used forwarded one to one particular member who asked me to draft one and there is a standard one an expert hr actually but he just explains that you are being followed um um and there will be some resources as well on the um on the website so keep looking at that uk.coop um if it's not exactly what you need it's always been updated so it's worth checking back into that website and just seeing what's available at that time um it'll be about timing on furlough and will it last more than three months do you think it's likely do we know the um furloughing scheme is is three months so it's first of march to the end of june will it be extended um we don't know the answer to that um but it's in for a fixed period and it will be reviewed near the end i think we'll just have to see um whether the economy is moving again and people are back in work and we're we far less restrictions by the end of june um but we can't speculate but we do know this scheme is in from the beginning of march to the end of uh to june sorry it's first it'll be March April and May three months and um more questions on uh both zero contracts and also very few hours that you're employed in so is there a minimum threshold for claims can we claim for staff who are only contracted for eight hours per month for example and also on a zero contract with varied hours does the employer make ongoing payments based on the average or is it just a one-off payment so zero if you've got people on variable hours or zero hours um you're looking at um average earnings um i said earlier that uh you can look at how much they earned in the same month the previous year or an average of their monthly earnings for the last year um but it does say in relation to zero hours um they then average earnings can be used does it say anything more about um do you pay the employee or does the employee get paid in a one-off payment or does it kind of is it ongoing um as as would normally a salary thing so i think what you've got an average earnings so say if somebody i think in the example you gave there it was eight hours per month on average you'd make um uh you'd pay them eight hours a month it'd be up to you whatever normal pay cycle you use whether that's weekly or monthly um but you'd pay them those eight hours um and provided their for load for more than three weeks uh you can make a claim for 80 percent uh of their average earnings you follow an employee who can't and doesn't want to work because of your child care responsibilities related to COVID-19's nursery school closures i think i think we've gone through that one haven't we it's it's the same point about people that are vulnerable somebody in your house that's vulnerable at the moment there's there's nothing um suggesting that it cannot be done but it'd be very dangerous as a selection criteria for forced for where you're trying to impose following on a number of people but where you're trying to deal with things through agreement you might seek volunteers i don't say anything wrong with seeking volunteers or responding to requests can i be furloughed i don't see anything wrong with uh considering those as an employer no matter how they were motivated uh yeah so it's the same answer we gave for vulnerable groups earlier okay um do we know when employers are likely to receive their first access grant payment from hmrc um so i guess that's small business grant i'm not aware of when that'll be paid i don't know that you've got anything i think it's going to be once the scheme comes into play in april you're going to be able to put claims through and you're going to set up some of the details they require from you are things like your bank account details and they're suggesting that these are going to be paid very quickly indeed um by backs transfer okay do we need agreement in writing from our employees that they accept the furlough conditions um it's what it's wise to get anything in writing if you can possibly i can't imagine i mean the alternative and if people are agreeing there's no reason why they wouldn't document that certainly in advising employers it's wise to document every agreement really but um and i do think you will probably need at some point when they're carrying out the audit um in fact i think having said that i think the scheme does require you to provide some evidence uh to um hmrc that it has been these employees have agreed and have been furloughed so you would need something in writing yes yeah i've seen that gary in the guidance it says um the point you made earlier you must agree it um once it's agreed your employer must write to you confirming that you've been furloughed and uh certainly we can put a very generic template uh on the website uh quite quickly if people are interested in seeing what a phone letter might look like we're just coming to the last five minutes of the webinar obviously there's a lot of questions um to go through still just to note that these questions are all going to be recorded so we can um go back to these and um have a look at them and then provide them as a resource later for everyone that's on the webinar so if you haven't been if your question hasn't been asked at this time um bear with us we'll probably be sending all of this out to your email anyway that you've registered with so um there's a couple more as I understand it's staff whose fixed term contracts end today can be furloughed as long as we extend their contracts today is that correct yeah you wouldn't treat a fixed term employee differently than anyone else um if you're going to extend the contract then um you would do so if you're going to extend the contract and they need to be furloughed i can't see that um that would make any difference and certainly you know you wouldn't be not extending it just because they're fixed term employees that might cause some difficulty i don't know whether you've got anything to add on that same no i think so long as they were on pa y e on the 28th of february um there's no reference to employers having to stand by fixed terms and let people go um and that would seem the opposite of what they're trying to achieve there's nothing suggesting that there'll be any restrictions on you uh extending fixed term contracts um okay in the last few moments as well if you if the participants want to upvote any burning questions that you've seen that hang in there for a while and you just want us to make sure that we get those asked first please upvote any questions that you can see there um Giovanna i know that you've got some specific inquiries there i think if you want to email those to membership at uk.coop um we can look at that um offline um how do we distinguish between full-time and part-time employees and employees whose pay varies you should have in your contracts um some reference to what a full-time working week is um and if certainly if you're prorating anything you must be working on a full-time working week to be able to prorate things for part-timers um there's no distinction between part-time staff and people whose um whose earnings vary um as i say the focused obviously a salaried employer a salaried employee who doesn't have variable wages it's going to be pretty easy to um see which was the higher i.e. their pay in the same month a year ago although their last 12 months of earnings usually it would be the average earnings of the last 12 months so for somebody salaried it will be quite simple but as soon as we get into zero hours part-time staff that occasionally work overtime we're into the um averaging i think um but it's the same essential calculation there's one calculation of how you calculate how much you can claim we are coming to the last couple of minutes i just wonder whether there's um any overriding comments that the panel want to make before we um call off and um and then i'll just let people know how else they can get in touch with us um but yeah um tim gary kate you wanted to say anything before we leave so it i think my concluding point for people would be to do keep checking on our website because as we learn more and more information we are updating the FAQs that uh that are posted up there um i think it's probably the best way of keeping live FAQs um in one place um and certainly as new legislation or guidance comes out um you will find information about it on there gary i just echo what tim says really it's um it's certainly been a bit of a change in landscape in the last couple of weeks um we've given sort of general information and you know the the guidance has been coming out and it's been more detailed so um keep looking at the website we will be updating it on a frequent basis as that new guidance and new details of the schemes come out thank you anything from you kate um yeah so i was just going to add obviously it's a really difficult time for everybody and um you know hopefully we've been able to answer some of your legal questions today if there are any other questions but around general policy or employee relations through this time please do continue to send them to our advice mailbox and you know we'll get to them and we'll answer them as we can we do have some information on our website around um employee well-being and considering your employees through this difficult time so also please take a look at that um and like i said any other questions that that are more around sort of how you support your employees through this difficult time please do um point them to our advice mailbox and we'll come back to you okay thank you and that's to advice at uk.coop so you can email either to advice.uk at uk.coop or membership at uk.coop and well we where we'll build a lot of these inquiries coming in if you think that actually we could do with more of these webinars and perhaps another hr webinar um please let us know we're reacting to what our members require and what our members are asking for so we've we've been quite agile in the way that we've converted all of our physical events and have now converted them online we can certainly add more as we go so if that's something that's really important to you you think you would be um subscribing to these webinars then let us know again at membership at uk.coop um you can also subscribe to our newsletter and that's a really good way of keeping up to date with the information that's been fielded out so that's um you can find that on uk.coop slash email so that's on our website just go in there and subscribe to our newsletter at uk.coop slash um email and um just make sure that you're aware of some of the other things that we're doing in terms of bringing cooperatives together so the co-op connection series of events which begins on the 7th of April in Bristol the 8th of April in London and so on um we've got a whole raft of those going on perhaps somewhere near you thankfully now you don't have to travel to those we can get more people involved in those and it's a really good way of connecting with those in your region um again we'll be guided by what our members require of those and uh we'll certainly be um available to answer some of the or at least talk about some of the challenges that you're really facing um so thank you everybody and apologies to those that we haven't managed to answer questions they are recorded we will try and get back to um as many as we possibly can and keep in touch with us and we hope everyone stays well and healthy thanks very much to everyone thanks to our panelists and to all our participants we'll see you again soon thank you bye everyone


Ladies and gentlemen, good morning. My name is Lieutenant Commander Sarah Nugreschel, and I am the outgoing Chief of Plans Policy and Partnerships at US Cyber Command Office of the Staff Judge Advocate. As you heard in Colonel Hayden's welcome remarks, we can't do anything without our partners, and that's especially true when it comes to our partnership with the Cyber Security and Infrastructure Security Agency, or CISA. So I'm thrilled to introduce Mr. Brandon Wells, the Executive Director of CISA. As Executive Director, Mr. Wells serves as the Senior Career Executive, helping oversee execution of CISA operations. He is responsible for leading long-term strategy development, managing CISA-wide policy initiatives, and ensuring effective operational collaboration across the agency. Some highlights from his illustrious biography include, in February 2022, he was appointed as the lead for the federal government's domestic preparedness and response related to the Russian-Ukraine crisis. And prior to that, from November 2020 through July 2021, Mr. Wells was the Acting Director of CISA. In that capacity, he led CISA's efforts to defend civilian networks, manage systemic risk to national critical functions, and work across both the public and private sectors to raise the security baseline of the nation's response to the SolarWinds Orion supply chain attacks, Microsoft Exchange vulnerabilities, and the Colonial Pipeline ransomware attacks, amongst many others, while completing this standup and reorganization of the agency following the passage of the CISA Act of 2018, which established CISA as an independent agency. Joining Mr. Wells is our very own Colonel Nate Kearns. Colonel Kearns currently serves as the Air National Guard Assistant to US Cybercom's Office of the Staff Judge Advocate, as well as the senior lawyer and advocate for the Commonwealth of Massachusetts. As if that wasn't enough in his civilian capacity, Colonel Kearns is the Director of Operations at the Defense Institute of International Legal Studies, where he has planned, managed, and executed over 150 international missions in over 100 countries. And when Colonel Kearns is not globetrotting, he's also an adjunct professor of law at Boston College. Colonel Kearns, I'll turn it over to you. Thank you very much. Director, thank you for joining us today. So what I'd like to do is just kind of run through some topical areas and questions. And at some point, if we have extra time, we'll hear from some folks from the audience. Sure. So the first thing I'd like to ask you about is some of the current cyber and operational challenges faced by CISA, and if you wouldn't mind addressing both domestically and internationally, sir. Sure. So first, thank you for the invitation. I think as was noted, this mission is one that's built on partnership. And the work that we do with Cyber Command, the National Security Agency, DOD more broadly, is essential to the work that we do both domestically and internationally. In terms of some of the challenges that we are facing, I would say it's at the intersection of a couple of trends. The first is over the last decade, the increasing digitization of everything, meaning that IT systems, things that are today enabled by IT systems that weren't a decade ago, create increasing risk. Secondly, the increasing complexity of the technology in general has meant that a large portions of our critical infrastructure are operating using technology that they really have no business using, because they don't have the innate capability to actually secure it. And third is the level of sophistication that our adversaries pose now to this technology has all come together in a perfect storm. And so these are challenges that face us not only here domestically, they are the same ones our international partners are grappling with. I was talking this morning with colleagues from across Europe at an event that the Lithuanian Government Ministry of Defense was holding, and it was the same exact topics, how to grapple with the challenges of emerging technology and cybersecurity in the face of growing threats. I'll remind everyone that the director was on the phone with Lithuania, probably 0-3-30, so I'm sure thanks for being here for us. So I was wondering if we could also get your thoughts. You mentioned it briefly on the current threat landscape, I would say if you wouldn't mind addressing some of the radical transparency, the international collaboration, communication, and you sort of touched on it, what we didn't have in the past, we now have a lot more folks, agencies, governments with access to previously things that we hadn't had before. Yeah, so when I look at the threat space, and I think many of you know this very well, trying to deal and grapple with going after these threat actors, when I look at the threat space, I see kind of two unique challenges when it comes to the specific threat actors that we're facing. On the one hand, the nation states what we are dealing with today have grown a lot better at what they do. They're able to hide more effectively, they're able to obfuscate their activity. It is harder to keep track of the specific threat actors we have good insight thanks to our intelligence media partners about strategic intentions, but a lot less insight in terms of what they are doing tactically day to day. And that is because they've grown better, their tradecraft has improved, they're operating, they're no longer developing custom malware as often, they're now living off the land, and so it makes it a lot harder for us to discern exactly what they are doing, where they're doing it and how they're doing it, and they're able to burrow in and hide in networks in ways that we didn't think they were able to do in the past. On the other hand, the kind of democratization of capabilities for criminal organizations have kind of lowered the barrier entry for criminals to get involved in more sophisticated cyber type attacks because they'll utilize ransomware as a service or other tools that are developed by more capable criminal actors and who sell or lease those to lower skilled actors. And so it has meant that the scourge of ransomware ramped up over the last two or three years as criminal organizations have specialized. And all of that is now hit against this, what is a largely an insecure technology base. As I mentioned before, we have dramatically increased the digitization of everything. However, our technology infrastructure today is not designed with security and mind up front. What gets technology to the front of the market today is based on cost, speed and innovation and it's not around security. And that has meant that every day thousands of new vulnerabilities are discovered in technology and it is not sustainable that any company, any government is gonna be able to keep pace with the scale of vulnerabilities that they're the technology base that they're dealing with. So we have been pushing, thanks to our director, Jen Easterly, a new focus on kind of secure by design and secure by default, that technology needs to be developed upfront that is more secure and that it is by design and by default deployed in the most secure way possible. And it needs to be easy enough that small and medium sized businesses or small and government agencies and local governments around the country, municipal hospitals and water systems, that they have the ability to use this technology in a secure way. And that's just not the case right now. And we know that because as soon as new vulnerabilities are identified, we can see the malicious actors exploiting those vulnerabilities at scale. And we're never gonna patch our way out of it. So it is great that we're identifying those and companies are deploying patches, but the scale of those vulnerabilities mean that we're always behind the eight ball, we're always chasing the adversary. And so the only way to get ahead of that is this focus of kind of getting ahead of it. We want companies to be designing and deploying technology that is as safe and secure as possible upfront. So I guess along those same lines, you're mentioning some of the challenges we're seeing out there. Could you maybe address some of the strides and some of the successes we're seeing or partnerships on the way ahead both domestically and internationally as well? Sure, and I think this is a place where as I said at the beginning, this entire mission space is built around the notion of partnerships and CISA as an agency was designed to be a partnership agency. We're not a law enforcement entity. We're not really a regulator. We're not an intelligence community. Our real, the reason why we were created was to build and sustain partnerships between government and industry. We do that in a lot of different ways and at its center is kind of establishing this strong trust that when we provide this useful information around cyber threats or incidents, tactics and tradecraft, that it will generate useful outcomes. So we have seen this in a number of cases, whether it's our response to the vulnerability in the log for J software library at the end of 2021 where we served as kind of an authoritative source for what products were vulnerable, which ones were being patched and provided that information in a transparent way to the community. Similarly, we stood up our joint cyber defense collaborative in 2021. This was something that had come out of the cyberspace Larry commission was authorized by Congress at the beginning of 2021 to create this joint cyber planning office. So we call the joint cyber defense collaborative today where we bring in industry starting with the largest technology, cloud, ISPs, cybersecurity firms brought in the US government entities that focus on cyber from across the interagency. So folks here at Cyber Command, NSA, FBI, DOD, to all work together with the idea of we wanna reduce any barriers and we wanna reduce the kind of previous work to be done with the private sector that tend to be one-on-one. We share information with one company, they share some with us, we do that 50 times and by then we piece together a story. Well, we decided to go to a multi-to-multi sharing environment where in the early days of the Russia Ukraine crisis when one of the companies in the JCDC was seeing the initial malware being used by Russian government actors, they were sharing it with all of the members of the joint cyber defense collaborative in real time, reducing the amount of time it takes to get information out from kind of days to hours. We think that those are real successes. It is also enabling us to kind of build trust with that community so they're sharing new insights with us. So one of the new things that we've just announced that was based upon individuals from across cybersecurity firms coming to us to say, and technology companies, they started seeing things happening because they had access inside of some of the adversary infrastructure. So they were seeing ransomware operators connected to US critical infrastructure but they didn't have relationships to go touch those critical infrastructure entities. So they came to us and said, hey, we believe that these entities are being targeted by these ransomware crews, they have access in there but we don't think that they have encrypted their networks yet. Can you go let them know? So just in the last four months, we've notified over 120 US and international companies that they had ransomware operators on their network prior to an encryption happening. And we've had at this point numerous examples where the companies have come back to us and said, thank God you told us because actually we just saw them try to activate the malware they had put in our network. And it was only because they had early warning that they were able to stop it. And this is, there's been about a dozen schools, hospitals that have benefited from this as well as 20 international partners around the world. So we think this is a model where, this is not doing the heavy lifting here where we built a relationship, we've established trust and now people are coming to us with information that we think is really game changing in terms of getting ahead of some of these challenges. And so I think it demonstrates the power of partnership to advance the cybersecurity mission and the importance that building these kind of trust based models with both industry and government, why it's so essential. Well, those are great examples. Thank you for sharing those. I know one of the things that folks in the room that the cyber command is interested in and it just happened to coincide with this conference is the new national cyber strategy. And so there's a specific area I wanted to ask you about because critical infrastructure as you know is a key element. I wanted to ask about that relationship of private enterprise and if you could address the responsibility to protect and sort of elaborate on that for us. Sure, so CISA, I've been around with the agency from before when it was known as CISA when it had much more complicated and less discernible names. And we were always around, our mission has always been around critical infrastructure. We started, our agency was formed, its predecessors in the wake of 9-11 attack to focus on the physical security of critical infrastructure. In the aftermath of Hurricane Katrina, it kind of expanded from the original CT mission to focus on more all hazards resilience related to critical infrastructure. But still today, when we talk about the homeland, we talk about cybersecurity, we're still predominantly talking about what we need to do to protect and secure and make more resilient our critical infrastructure. The new national cybersecurity strategy recognizes as one of the key pillars, the protection of US critical infrastructure because it's so essential to our way of life, our economic security, our national security, the work we're doing with DOD, focusing on defense critical infrastructure is an example. And the national cyber strategy recognizes that we need to use a variety of tools to get after this problem. We need to use regulatory authority where it makes sense, where we have the authority, where we think we need to get it. I think you've seen some examples of that. For example, TSA in the aftermath of the Colonial Pipeline incident, decided to use authority that they had but had not previously deployed to regulate, have minimum baseline cybersecurity standards for pipelines, for rail, for aviation. EPA has put new responsibility on state authorities that conduct sanitary surveys of water utilities to put in place, they need to do cybersecurity reviews when they conduct those surveys. But regulation is one part, largely done by key regulators across the US government, some independent, some part of underneath the executive branch. But CIS's role as I referred to earlier is more kind of helping to coordinate the voluntary efforts across the government. So we build these partnerships, we've established these mechanisms, we were given these unique authorities to create information sharing mechanisms that are in some cases protected from regulatory law enforcement use to encourage industry to come to us, share information on critical vulnerabilities so that we can use those to make the entire ecosystem more secure. It's the reason why we brought critical infrastructure into our joint cyber defense collaborative because they have unique insights into this and they can also take action at scale that the US government can't take alone. So getting 100,000 water utilities in the United States to do something is hard. Getting three cybersecurity companies to take action that is used on hundreds of thousands of companies across the world is comparatively much easier. So I think we look at this from a variety of perspectives and try to figure out how we harness our kind of strong capabilities with that of our other agencies, how do we lend our expertise to regulators while still maintaining our ability to have real trusted relationships with industry. So I think that there are, you can certainly ask Steve Kelly when he comes and gives his talk since the White House has been at the forefront of thinking through how to utilize all of the different expertise and capabilities across the US government to achieve this mission. It's complicated. There's not gonna be one size fits all to these challenges we face because of the unique authority structure, because of the unique challenges. What will work in a highly centralized small sector is not gonna work in a highly diffused sector made up mostly of small and medium sized businesses or municipal authorities. And so it's gonna take a lot of work and a lot of thoughtfulness about how do you employ these strategies. The National Cyber Director is now working on an implementation plan for how do you take some of these ideas, identify what's working now really well and where are the gaps that we need to continue to work to build a stronger ecosystem. So you just talked to quite a bit about private industry and I'd like to kind of head down that road for a second. What role or where do you see private industry say the next five to 10 years and looking at the companies that everyone in this room knows, the Googles, Apples, and Microsoft, what role are they playing and how do they partner with us and what are your thoughts on that? Yeah, so those large companies have been kind of key partners to us because they have unique visibility, they have the ability to scale solutions very quickly. That being said, kind of going back to the National Cyber Strategy, one of the key policy shifts that identify the National Cyber Strategy is putting the burden of cybersecurity on those best able to handle it. Today, almost the entire burden of cybersecurity is on the end user and whether you are a small business of three people or you are a Fortune 50 company, you both have the same burden of cybersecurity even though the requisite capacity is far different in those two entities. We don't think that that's sustainable and the National Cyber Strategy reflects that. So I think we believe that technology companies, because of the reasons I mentioned earlier, have a unique responsibility here to take on a higher burden of providing products that are more secure and make it easier for those small and medium sized companies to be able to utilize their technology. And even for large companies today, still dealing with a relatively insecure technology ecosystem, oftentimes you'll talk to one of the large companies in the country that's in critical infrastructure and they'll tell you that they're using 150 or 200 different cybersecurity tools to protect their network. And now they have to figure out how to integrate 200 tools to provide their analysts with actionable insight about how to protect their networks. And then they have to hire consultants to help them improve their integration of those 200 tools. And it's all because we have an insecure technology base. So I think we think it starts from there. Secondly, it moves to thinking through how does corporate America look at cybersecurity? For CEOs, for boards of directors, is this just a problem that they can assign to the CIO and think it goes away? Or is this something that they have to take core responsibility for? Because ultimately this is not just an IT problem, but this is kind of core business risk. And the companies that have had significant breaches, significant incidents, they know that it's core business risk. Unfortunately, sometimes it takes getting to that point before a company will be kind of galvanized into action. And so we think that there's a, and we've kind of been pitching this concept of cybersecurity, corporate cybersecurity, corporate cyber responsibility. Sorry, that's the 4 a.m. showtime with Lithuania talking. Corporate cyber responsibility, the idea that you as corporate leadership have a kind of unique responsibility here to make sure that you are addressing these systemic risks to your operations. And those could be first order, how well you're doing protecting your networks, but also when I talk to business leaders across the country, the thing that most often comes up is third party risk. They think that they've got their network under control, rightly or wrongly, but they're concerned about the suppliers, the vendors inside of their supply chain that they think exposes them to a risk that they're not able to sufficiently manage. And so that is a place where I think it is the unique responsibility here to work between government and industry to figure out how to expand that protective umbrella. What can those companies do to help the small companies in their supply chain? What can we do to help bolster them? So we have some initiatives that we have launched this year, focused on what we call target-rich cyberpore. The idea being these are companies and segments of the economy that are often targeted by adversaries, but they don't have the capacity. So hospitals, K through 12 schools, water facilities. And so we've been spending a lot of time thinking about how do we provide them more services? Congress gave us the ability to expand some of the shared service offerings that we have previously provided just to our federal civilian partners out to some of our critical infrastructure entities. So we're looking at doing that starting this year using some of these new authority from Congress. But we think it is super important that both the government and large companies together take that responsibility to figure out how we broaden this because ultimately every company in this country relies upon a network of small companies that are the weak underbelly of our cyber ecosystem. Sir, along with these public-private partnerships, how would you say that extends to the challenges with our international partners? Yeah, so I'd say all the challenges we have here, they're just magnified overseas because they often have less capability, less capacity when I think about the amount of expertise and capability that resides in the federal government between CISA, the FBI, NSA, Cyber Command, DOJ, DNI, and the really vibrant cybersecurity ecosystem in the private sector here. When we start working with international partners, some of those folks obviously have a lot of capability. We work extremely closely with a number of our Five Eyes partners, have done a lot of joint production with them on guidance, but when you start talking about country in America, Southeast Asia, there's a lot of capacity that's needed to be built and these are countries that make up critical supply chains for the United States that we rely upon for US companies. And so there is a real appetite out there across the world, whether it's countries in Europe that I was on the call with today or countries in the kind of global South that want to get better at this because they're seeing challenges when you've had countries like Costa Rica that have been ravaged by a ransomware incident affecting their government that lasted for weeks. They recognize that they need to get better, but they don't necessarily have the capacity and so I think we are looking at what we can do to help build that. Obviously our focus is still here at home, but there is a lot that we learn in terms of early warning from working with our international counterparts. We have relationships with over 200 certs, the computer emergency response teams around the world that we share information with regularly, but there's a lot that we're trying to figure out how we give back. We've been doing a lot of capacity building with Ukraine. Obviously right now we've got some work that we've done through Singapore, to Asian countries to expand capacity, but there is just a lot more work to do out there because there is a real hunger and just not enough capacity. So you've mentioned a little bit about DUD's role in cyber comms role just to take it to the folks in this room, to the SJs here, a bunch of the staff are here. Where is SZA, where is Cyber Command? Where are we going together? Where do you see the next few years is that relationship? Yeah, so I mean we think that the relationship between the offensive and defensive work is really essential and I think our goal over the next few years is to make that the information flows and the tipping and queuing back and forth even faster, more ingrained because when it works it's worked super well and so there's been real world examples and since we're going out to the world I'll be circumspect here, but there's been real world examples where the activities that you're doing overseas has given you insight into actual incidents here in the homeland. You've handed over to us SZA and the FBI go out and talk to the victim. Maybe we do some incident response. Now we're identifying additional, whether it's additional activity that the adversary was doing, additional infrastructure that they were utilizing. We're passing that back to you guys that you're using to expand the scope of your mission to identify additional targets to go after and back and forth and I think that type of symbiotic relationship is really critical and I think it has worked extremely well when it's worked and I think we now need to figure out how are there gaps, what we need to do and grain that type of relationship so that it is smooth. Frankly, it is new. Cybercom is a relatively new entity certainly at full operating capability. SZA in its current incarnation is relatively new and I think we need to make sure that we build some muscle memory where this is just happening as a matter of course. The other area that I would touch upon here is obviously the relationship between Cyber Command with the various Cyber National Guard units around the country in part because we've got a very close relationship with our state and local governments. We do a lot of work to provide support to those state and local governments and a lot of state governments will utilize their Cyber National Guard units to help buttress and support state level and incident response activities within their jurisdictions and so I think it is more important than ever that we've got good relationships so SZA has a growing footprint across the country about 600 field-based personnel mostly made up of various types of security advisors both physical security, some of them focused on emergency communications and about 100 cybersecurity advisors spread out across the country who are there to do assessments and build relationships with our critical infrastructure and state and local partners and many of those folks do have good relationships with their tags and other National Guard related leadership at the state level but kind of thinking through what is the future of that relationship? What does it look like for information flow? What does it look like when you're actually conducting operations at the state level? How do we provide mutual support in those situations? So I do think that there's a lot of growth. One of the things that we have rolled out over the last year is a new grant program for state and local governments. Congress gave us as part of the Infrastructure Investment Act billion dollars over four years to give out again cybersecurity grants focused for state and local governments and they're using that in a variety of ways. The first tranches of money actually just started going out the door a few weeks ago because we approved the first 12 plans that were submitted by states that had to submit pursuant to the law and so there is more capacity that's going out and being built to the state and local level and we know that National Guard units are kind of a key part of that ecosystem at the state and local level so the more we can do to understand what that looks like so that we can have where we need to have consistency where we need to have unique state tailored efforts so that we can do that. No, Brandon, thank you very much. I really appreciate it, especially the plug at the end, I will say through the Cyber Nine line, through the establishment of state and local partnerships, the ability that I hear across the 54 states and commonwealths and territories is they have never come across an agency that they've reached out to that hasn't had a constant support or an ability to proactively help them or reach out to them and it's been fantastic so thank you for that, sir. What I'd like to do now, I think we still have a couple of minutes, is open it up to some folks in the audience, I know that there's some folks that would really want to take advantage of this opportunity. If anyone has any questions, we ask that you just turn your microphone on so that those virtually can hear as well. Morning, sir. Frank Shaw from Army Cyber. Ms. Wales, you had mentioned larger companies taking on a greater responsibility for cybersecurity when you have this three-person small business who does have the capacity for that. Since those larger companies are ultimately accountable to their shareholders, what is the incentive for them to do that outside of their organic supply chains? How has that conversation been to incentivize them to do that? Yeah, it is a good question and I think it'll likely depend upon kind of the criticality of those small and medium-sized businesses in their supply chain. The ones that are obviously more critical, the ones that have less substitutability. You may feel maybe much more willingness when there are kind of more single points of failure for their operations. I also think that it is a question of what exactly you're doing, how complicated is it? There are some things that could be relatively easy. You have certain services you might pay for from a cybersecurity vendor to provide protective DNS for your network relatively inexpensive to add some protections for another party if they're willing to do that, whereas more intrusive capabilities, probably not true. But you also think about kind of what your due diligence is, what your ability to provide some support and mentorship for what they need. Ultimately I think it's going to be, they have to represent their shareholders but ultimately if they think their business is at risk to think that their operations could be compromised because of weak cybersecurity at one of those vendors, then I think arguably it is in their shareholders' interest to provide that just like it is in their shareholders' interest to invest in their own organic cybersecurity. And frankly, as I mentioned earlier, this is third-party risk is the number one issue that I have heard consistently across every critical infrastructure sector. And so if every critical infrastructure sector says I am worried about third-party risk, they can't then say, well, but I can't really fix it because my shareholders, ultimately if it's one of your top cybersecurity risks, then you need to be willing to invest. And if that's not just in your organic capability, if that's in helping third parties that are critical to your business, that's where it is. Good day, sir. Lieutenant Commander Mike McCarthy, Canadian Armed Forces, Office of the Judgment General. Very fascinated by the use of National Guard in assisting with local and state, I guess, cybersecurity. And I'm just wondering how that came to be and whether there's been any pushback from private industry who also would provide those services normally. Thank you. Yeah, I mean, I really think that this is something where I think it probably most likely started in some, and maybe there's some here who can actually answer that question better than I, but my sense is that it started with a lot of the ransomware incidents that started affecting municipalities around the country. And when a governor looked at this problem and said, what assets do I have in my disposal that can try to deal with it immediately? Cyber National Guard units under state authority were able to be activated to help. And I think that makes good sense. At the end of the day, I don't believe that those National Guard units are really displacing at large scale cybersecurity vendors throughout the country. In many cases, if you're responding to a large scale incident, like a ransomware incident, you're most likely, you could have the National Guard helping out for a period of time, but you're still gonna bring in private sector vendors to finish the job, to rebuild parts of your network, to focus on long-term security. I think in many cases, National Guard has been sent in there first, kind of stabilize the situation, begin to get things back up and running, and then this transitions more long-term to a private sector vendor. But I think it is a recognition that there is a lot of need out there and that the National Guard was a ready source of real expertise in a place and a time where governors do not have a lot of their disposal. But it's not consistent because we've engaged with states that have had incidents and they've immediately brought in one of the large cybersecurity vendors, and other states will bring in their National Guard and later bring in a contractor to come help and finish the job. So we've seen a variety of different types. There's no one-size-fits-all in terms of how states or municipalities will address this problem. But I think it is one where we are likely to see consistent use of the National Guard across the country because it is a real source of expertise that is under the authority of the governor and can be readily deployed when they have a significant incident. I'll just add one thing as the Air National Guard Assistant here at the US Cyber Command is there's a direct liaison relationship to CISA where our folks across the 54 states, Commonwealth and Territories can directly reach out through the Cyber 9 line directly to members of CISA. The members of that team have been incredibly proactive in the sense of if you think there may be an issue or you think there may be a malware, for instance, you know, reach out proactively and they will provide guidance information, et cetera. Also, under Colonel Hayden, US Cyber Command has a specific division that the Guard can also reach out to. As Brandon put, there are, you can imagine like different companies, some that are more robust, very well-developed, some who full-time work in the industry, but there are also some that are nascent in learning and so having both the support of US Cyber Command and CISA's instrumentals to the 54. Good morning, good morning, Sir. Dane Blocks from Joint Task Force Aries. I was wondering about your agency's relationship with CISA and Joint Force headquarters, Doden, and then a follow on if you all run into any impediments when it comes to information sharing and classification. Yeah, so two good questions. So first, on the relationship with DISA, yes, we have an extremely close one, so I didn't talk a lot about today, but part of CISA's core operational responsibility is kind of the operational lead for the security of the Federalist Civilian Executive Branch, which are the 102 civilian federal agencies, everything from large cabinet agencies like DHS or Department of Justice, down to micro-agencies like the Marine Mammal Commission. We are not the ones who ultimately manage the security for their network, but we are responsible for providing support. We provide a lot of technology. We've got some new authorities to do more proactive hunting and assessments on those networks, and one of the things we do issue are things like binding operational directives when we see an emergency directive, when we see a real acute problem, we can issue an emergency directive. So for example, in the aftermath of solar winds, that Sunday night after it was discovered on Saturday, that Sunday night we issued an emergency directive to remove all solar winds devices that were certain version numbers within two days. We issued binding operational directives, more long-term strategic focus areas, things like that every federal agency needs to have a vulnerability disclosure program so that security researchers can know where to provide critical vulnerabilities on federal agency networks. And we work very closely with DISA to make sure that we are sharing information on the action that each other is taking related to the operation of our various networks. We don't have exactly the same challenges, so we're not going to be issuing every single directive inside of SISA or the STIGs and other actions that DISA and General Macassone does as his responsibility to be the national manager for classified networks. But we do share information very routinely on what each other is doing so that we can understand if there's actions that we're not taking, whether we should take any lessons learned from actions that you are taking, what's working, what's not. So that relationship is very strong. Your second question was on... Any impediments on information sharing? Classification. So this is something where I think if you would probably ask me this question seven years ago I would have given you a different answer but I think today the relationship is such with kind of the key producers of intelligence that we are able to kind of get information downgraded that we need to at speed. I mean, so NSA, when they produce intelligence for the most part and almost all of their non-compartmented intelligence is generating unclassified, tear line, victim identifiers for CISA and the FBI to go do victim response, immediately oftentimes we'll get those, start working on exactly the language that we wanna use, work that with NSA and within hours we're gonna be getting our teams in the field on the phone with the potential victim of an incident. That is happening literally today in hours. I think if you would ask me that question five or six years ago it would have been a potentially a multi-day fight to get to where we need to be but I think we both have recognized the value of operationalizing this information as quickly as possible and when there are times where we can't release information as quickly as we want there's good reason and that is part of a kind of ongoing dialogue with us and the relevant producers. We understand what the challenge is and we kind of work to see well if we can't release X how about Y and Z? Can we get that out there if we can't get some of the key information? But I do think that today I can tell you that I do not think that there's any significant impediment to the execution of our Cyrus creator responsibilities because of classification. Thank you so much for joining us. That's all the time we have today for questions but on behalf of the Office of the Staff Judge Advocate thank you so much. For the live audience we are on a break until 11.15 so please be in your seats a few minutes before 11.15. We would like to talk to you about what makes working a U.S. Cyber Command Office of the Staff Judge Advocate so unique, challenging and rewarding and why you would want to join the military cyberspace operations legal community. Experience in any operational field is an outstanding foundation for dealing with cyberspace operations. No matter the domain of operations international humanitarian law applies in all armed conflicts and as a matter of Department of Defense policy it applies to all operations. Observing the principles of military necessity, distinction, proportionality and humanity is always required no matter the means or method of operations. However, the way we implement these principles and protect their underlying values are often challenged by cyberspace operations that can achieve strategic effects without rising to the level of a use of force or armed attack. Laws designed primarily to protect life, limb and property from kinetic attacks do not translate easily when applied to comparatively non-destructive effects. The role of the military cyberspace operations legal community then is to interpret an imperfect regime in real time offering careful consideration of international law, domestic authorities and policy implications and their impact on national and international security. The work of this community stands within and at the forefront of some of the most complex operational legal issues today. Cyberspace operations legal practitioners have the ability to, through careful and thorough discernment, shape the evolution of practice. It is not uncommon for a cyberspace operations legal practitioner to be asked to weigh in on questions of international sovereignty, domestic criminal laws, constitutional principles and under certain circumstances what may be lawful as part of a single mission. Take non-intervention for instance, in cyberspace, borders are porous and threats can emanate from anywhere and everywhere. As a result, the physical domain does not neatly translate to cyber. This can make working in the cyberspace operations legal community a challenge as oftentimes legal issues may be cases of first impression. Additionally, cyber lawyers need to be able to effectively distill what can be complicated technical jargon and translate it into language that is accessible to a broader audience. After all, not everyone speaks in ones and zeros. As a result, cyber lawyers must translate technical information and apply it within our domestic and international legal framework. The cyberspace legal practitioner is not limited to reacting to events but is also tasked with helping lay the groundwork for a future. The practitioners asked to weigh in on the ramifications of policy, of potential legislation, of interagency cooperation and of partnerships with industry, the private sector and our international partners. The reality is that this is only the beginning. Legal and policy parameters for governing state behavior in cyberspace, domestically and internationally will continue to evolve in order to keep pace with the threat. Recent events have demonstrated that these issues are not mere hypotheticals or academic exercises but instead are stark realities that require serious and proactive measures. We look forward to continuing this conversation through our practice and through the thoughtful dialogue demonstrated here at the US Cybercom legal conference. We welcome you to join us in the cutting edge legal practice of cyberspace operations.