OK. Good afternoon, everyone. I am Li Mi Wang. I am a tech leader in Istio's security team at Google. And this is Torin. OK. And I'm Torin Sandel. I work for a startup called Stira. I'm the tech lead on the Open Policy Agent project. And I love talking about policy and rules at 4.30 on Friday afternoon. So take it away, Li Min. So today, Torin and I are going to talk about Istio's mixer, policy enforcement with custom adapters. This talk has two parts. In the first part, I am going to give an introduction of Istio and the policies in Istio. And I'm going to talk about how to enforce your custom policy in Istio through mixer's adapt model. In the second part, Torin is going to talk about how this model is used to integrate Open Policy Agent to Istio.  So what is Istio? I'm trying to keep it brief, because we already had a lot of excellent talk on Istio. So Istio is an open platform to connect, manage, and secure microservices. You can find more information on istio.io and github.com slash istio. Istio service mesh can be split into data plane and the control plane. Data plane is composed of a number of annual proxies that are deployed as side cars. And they are mediating and control all the traffic between services. Control plane has three components, pilot, mixer, and Istio-Auth. Pilot is responsible for managing and configuring the envoy proxies to route traffic. Mixer is responsible for enforcing access control policies and usage policies and collecting telemetry data from envoy proxies. Istio-Auth provides service-to-service multi-teriors authentication. And it also provides a built-in identity and a credential management. Istio is a policy-driven system. What are the policies? Policies are the rules that control how the system behave. Istio supports many different kinds of policies. For example, route rules allow you to specify load balancing policy, traffic splitting rule, request timeout, retries, and fault injection. Quota policy provides the fairness between service consumers when they are contending for limited resources. Monitoring policy allows you to specify how the metrics are collected and how the logging and tracing are done. The existing security policy allows you to enable service-to-service multi-teriors authentication for the service mesh. And it also enforces the simple authorization rules like denier request if a certain condition is met, or whitelist or blacklist the service consumers. And we provide an expression language for you to define conditions. We are continuously adding more policies in Istio. Take security policy as an example. We are adding authentication policy, authorization policy, and auditing policy, which we call AAA policies. The upcoming authentication policy will allow you to enable or disable multi-teriors for each service and configure end-user authentication. On authorization side, we are adding row-based access control, which provides the namespace-level, service-level, and method-level access control for services in Istio mesh. I'm going to show an example of how RPEC policy looks like in the next slide. And we are also integrating with Open Policy Agent to address more complicated authorization use cases, which Tori is going to demo next. And in the meanwhile, we are also working on improving the expression language to provide a richer semantics. The auditing policy will allow you to specify when to audit and what to audit. Here is an example of how RPEC policy looks like. On the left side, I define a service-row object. It's called a review product viewer. It allows you to read a review service and read a product service on the path slash books slash books slash star. On the right side, I define a row-binding object, service-row-binding object. It assigns the review product viewer row to a given service account. You can specify other identities, like a user or some joint claims or other attributes to specify the subjects. You can find more information on Istio RPEC design doc, or you can talk to me afterwards if you're interested in RPEC. Now we have a look at all the policies Istio provides. What if you want to support your own policy? Well, it is pretty easy to do that through mixer. Mixer is the central point for policy evaluation, and it is designed for extensibility. Mixer exposes two APIs, check and report. Check allows you to do precondition check, quota check, and report allows you to telemetry reporting, such as logs and metrics. Mixer achieves high extensibility by having a general-purpose plugin model, and the plugins are called adapters. In this picture, I show some example adapters that Mixer supports today. Mixer is an attribute processing and routing machine. The attributes are the pieces of metadata that describe the environment and the traffic. For example, request.pass, source.ip, source.user, destination.service, these are all attributes. Request arrived at Mixer with a set of attributes. Mixer processes these attributes and maps them to adapt the input. We call them instances. Mixer invokes the adapters based on the configuration and passes this input to the adapters. Mixer supports two types of adapters. The standalone adapter, run in Mixer process, they do not have a backend. For example, the main quota adapter and the open policy agent adapter that Tori is going to demo next are standalone adapters. The other type of adapters that interface to a backend system. For example, the stack driver adapter belong to such category. In order to provide a custom adapter, you need to determine several things for your adapter. First, you need to determine your adapter type, whether it's doing a precondition check or doing quota check or telemetry reporting. Second, you need to determine the runtime input for your adapter. In Mixer, we use templates to define the schema for mapping attributes to adapt the input. You can apply multiple templates for a single adapter. You can either use the built-in templates or provide your custom templates. Next, you need to determine how to configure your adapter. What are the parameters your adapter takes? A configured instance of an adapter is called a handler. And lastly, you need to determine the business logic for your adapter to handle the runtime input. You can find more information on adapter developers guide, which this GitHub link points to. Okay, now let's quickly walk through the steps of building a custom adapter using a very simple example. Suppose we need to build an adapter to verify a string is present in a list. So the adapter type is a check. The adapter input is defined by the built-in list entry template. We can take a quick look of the list entry template. It is very simple, as you can see. It only has one value, one stream value, which specifies the entry to verify in the list. The adapter configuration is a list of strings. And at runtime, the adapter looks up the value in a list of strings and return the check result. Okay, so the first step is to write the basic adapter scaling encoder. You can copy it from our online tutorial or any built-in adapters. I highlighted the part that you need to provide the adapter information, including the name of the adapter, the description of the adapter, and the templates the adapter supports. And you can also provide the default configuration for the adapter. In the second step, you need to write the adapter configuration. These are the parameters for the adapter. In this case, it is a list of strings. And in the third step, you need to validate the adapter configuration. In our case, we simply make sure that the list is not empty. And in the last step, you need to write the runtime logic for your adapter. So in our case, we simply check that if the stream value is in the list and return the check result. Okay, now you have built your custom adapter. Let's configure a policy using this adapter. So we want to check that the source version is in a specified version's list. So first you need to create an instance of list entry template called a source version. And the value is mapped from the attribute source.labels.verging. Then you create a handler of the list checker adapter. It's called a version checker. And you provide the parameter which is the list of versions, v1, v2. And then you create a check version policy, which simply passes the source version instance to a version checker handler. And you can also specify the condition when this policy applies. So in this case, the check version policy applies to the ratings application. And now you can apply the policy and it still will enforce the policy at runtime. Okay, now I'm going to hand over this presentation to Torrin to talk about how policy agencies integrate your tools. Okay, so thanks, Li-Man. Li-Man, give a great overview of how you can take mixer and extend it to enforce your own custom policies. And the other thing that we wanted to do in this talk, though, is sort of highlight this ecosystem of integrations that are being built up around Istio. And so to do that, what we thought we would do is show how the open policy agent project has been integrated into Istio and give you guys a sense of what you can do with that. Okay, so I'm going to give everybody a quick overview of what the open policy agent is, how we built the adapter, and then show how you actually use it and how it works. So the open policy agent is an open source general purpose policy engine. And what that means is that you can use it basically in any system, in any layer of the stack to offload policy decisions. And so one of the obvious applications for OPA is API authorization because pretty much every single organization has to be able to control who can do what across their microservice APIs. So OPA, you can use it for things like Kubernetes and Cloud Foundry and Docker and so on, but here we're going to be focusing on Istio and this new integration that's been built. So the core of OPA, though, is this declarative language that lets you codify your policies. And when it gives you these policy languages, let you write rules and answer questions like, is X allowed to call Y on Z? Now when you're actually taking OPA and integrating it or using it, you can take it as a library and embed it into your applications or your services or you can run it next to your service as a sidecar or you can run it on a host and have all your services on that host call into it and ask for policy decisions. Now it's designed to be as lightweight as possible and so we don't have any external dependencies at runtime and so all the policies and the data and so on that it uses to evaluate are all stored in memory. So it doesn't introduce any dependencies onto an external database or an external service or anything like that when you take it and you deploy it. So it's very easy to get up and running and use it. And so the whole goal with the project is to give the community this reusable building block that people can leverage to enforce policies up and down the stack using a unified holistic approach with a language that is suitable for all these different kinds of things. So what we did and what the team at Istio did was take OPA and they integrated into Mixer as an adapter, as a check adapter. And so the way this works is that when Envoy receives incoming traffic, it executes this check RPC call against Mixer.  So things like the method and the path and the headers and so on. And then when that RPC request arrives at Mixer, Mixer looks at the adapter to run and it dispatches it to the adapter, in this case OPA, which makes a policy decision. So it takes all that input, all those attributes and it decides whether or not that request should be allowed or denied. And then that decision is passed back to Mixer and ultimately back down to Envoy where the request can either be accepted and forwarded or it can be dropped or rejected. Now, when you configure OPA, as an operator, you tell it what inputs you want to provide to the adapter. And so you can basically map any of the Istio attributes, anything in the Istio vocabulary into these collections, these subject and action collections. And so it's very flexible and you as an operator get to decide what data you pass off to the policy engine. Now OPA itself is actually embedded into Mixer as a library, so it's totally standalone and it doesn't have any external dependencies, which means it's nice and easy to deploy. Okay, so when you actually have to configure OPA, the first thing you have to do is create a rule. And so this is an Istio concept and Mixer concept. And so what these rules do is they tell you, or they tell Mixer when to send requests off to adapters. And so in this case, we've just created a single rule that says send all the requests to the OPA handler or OPA adapter. And when you do that, supply the authorization instance data. So then we have to define what the authorization instance data is. And so in this case, we specify values for the subject and action collections and we're mapping Istio attributes into those collections. And so here we've decided to include the user ID and the target namespace, for example, and the target service and the path from the request and the method from the request and so on. And so all of this data is actually loaded into Mixer through the Istio config store, which is, it can be Kubernetes or it can be other backends as well. And so we'll see how this works in a minute. Okay, so then the last thing you have to do after you've configured, you know, when to send requests to adapters and then what to send to adapters, you need to describe what to do when the adapter receives traffic. And so that's what the handler configuration is for. So the handler configuration is always gonna be specific to the handler because it's, in this case, it's saying, okay, first of all, the check method to run inside the policy is authorization.allow. And then we actually take the OPA policy and we embed it directly into the configuration here, just as a string. And so this is just a really simple policy that says, by default, requests should be denied, but if they're performing a read operation, then you can allow them. Okay. All right, so let's see how this actually works. Okay, so what I have here right now is the Istio control plane deployed on top of my laptop or on top of Kubernetes running on top of Minikube on top of my laptop. And I've got this very exciting application called Bookinfo deployed on top of Istio. And that's because Lehman and I are running a bookstore. And then we have our authorization rule here. And so this is just saying, when incoming requests are received by Mixer, they should be forwarded all the time to the OPA handler using the authorization instance data. So then we can take a look at that instance data. And so here we've configured it so that it sends in the source and destination namespace and services, the headers from the request, the method from the request, and the path. And then finally, we've got the OPA handler configured. And right now, this is the same kind of configuration you saw before, but in this case, it's just allowing all the traffic by default. Okay, so I've got the product page here. And great, it loaded. That's exciting. Okay, so what I have right now is the policy on the left and the application, or sorry, the application on the left and then the policy on the right. And I have a script that's watching the policies on my machine and then reloading them in Istio whenever they change. And so right now, we just have a simple policy here that says that by default, requests should be denied. However, if this other service graph policy allows the request, then you should go ahead and allow it. So let's take a look at the service graph policy. So the service graph policy defines the allowed connectivity for applications running on top of Istio right now. And basically these allow rules below here interpret that data structure to decide whether the incoming service is allowed to talk to the destination service. Now, the thing is that right now, the allow rule is defaulting to true, which is probably not good from a best practices point of view. So let's change that to false. And we can see that the policy reloaded hopefully. And now if I refresh the page, it still works, but we don't see the product reviews anymore. And so the reason for that is that the product page is not allowed to talk to the review service. So let's change that. And then once the policy reloads, the reviews show up, which is great. And so this just shows how you can write these high level policies that are very dynamic and can be reloaded on the fly without requiring you to write a bunch of go code and then do a whole software release, especially after upgrade mixer or anything like that. This is all based on configuration. Hopefully that comes back. Okay, great, it's back. Okay, so this is like a relatively simple policy. This is something that you can enforce with Istio without OPA. So let's look at something a little bit more interesting. So I have this organization chart policy and this is an org chart for a bookstore. And this is a weird bookstore because they don't want their people that work on reviews and shelving to be able to see book reviews. And so right now we have this org chart where Alice is a manager and then Bob is a reviewer and he also does some shelving and then Ken is only doing shelving. It's very boring for Ken. And so right now by default, this policy is going to deny all incoming traffic.  But if you're just on shelving, if you're not a manager, then you'll be denied if you're trying to access these sensitive book reviews. Okay, so in order to make that actually take effect, I need to hook it up to the top level here. So I'm gonna say now, basically, deny by default. However, if the service graph policy allows it and the organization chart policy allows it, then go ahead and allow the request. And so if I refresh the page, it still works, but we can't see the reviews because we're not signed in. We're an anonymous user right now. So if we try to sign in as Bob, he's not allowed to see them. But if we sign in as Alice, who is Bob's, or rather who's in management, and the performance reviews show up. And so this shows how you can enforce different kinds of policies with OPA that aren't necessarily coupled to roll the waste access control or just simple expressions. This organization chart data is hardcoded into the policy right now, but there are other ways to get data and so on into OPA that are more efficient. And so this is just here because it allows us to easily change during the demo. Okay, and so then the last thing I wanna show is how you can enforce policies that take into account some kind of context. And so the bookstore has developed a strange idea. They wanna allow reviewers to look at book reviews after 4 p.m. for some reason. And so we can add another policy here. And what it's gonna do is check whether or not the incoming user is on the reviewer team. And then it's gonna check whether the current date and time is between 4 p.m. and midnight. And so because this policy is part of the organization chart package, that answer gets composed with the previous one about sensitive APIs. And so now if I try to sign in as Bob again, we should be able to see the reviews. Okay, so that worked, but if I try to sign in as Ken, the poor guy doing book shelving, he's still unable to see those reviews. So that's the demo. Switch back to the slides. So OPA, it gives everybody this reusable building block that you can use to enforce all kinds of different policies across the stack, but it's particularly useful for enforcing authorization decisions in your microservices. And this is super important because it's not enough to just authenticate users, you need to be able to control what those users can do. Istio is great because it has this fantastic plugin framework that allows you to plug in things like OPA as well as other adapters for authorization and quota and telemetry and so on. And the plugin framework makes it pretty easy to get up and running with this and the documentation's great. So I encourage everybody to check that out. And so finally, if you're interested in security, you're interested in Istio, please come and join the security SIG and check out the projects on GitHub, star them, and yeah, so thank you very much. So we're happy to take questions, of course. Okay, we'll just go front to back, I guess, so in the blue. So is the question about how do you prevent people from changing policy when they're not supposed to? Oh, okay, no, it's about authenticating users and getting that data into OPA. Okay, so for the first question about how you get external data into OPA, so it provides APIs that allow you to push data in, okay? So you can load arbitrary JSON data into OPA and then write policy over it. So if you can get your data out of LDAP or Workday or whatever that describes your organization, you can load that into OPA. The other thing you can do is stick like an authenticating proxy in front of OPA that goes and gets that data and when it does the authentication check and then passes that in. Beyond that, it's sort of up to you to design that part of your system. Yeah, so in the Istio case, the identities are identified using the attributes. So Envoy is going to process the request and get all the attributes. And you can have the combination, any combination of the attributes to identify identity, yeah. And then so then for the second part of your question, so OPA gives you a test framework to write unit tests for your policies in and then it gives you a test runner so you can like execute all of unit tests in your policy code base, if you will. And then yeah, we're looking to improve that to give you things like coverage and profiling and so on. Yeah, okay, next. So the question is how do you log decisions that have been made inside of Istio or OPA? So OPA has a framework that allows you to plug in and figure out when a decision's been made, like the top level decision. So if you're integrating OPA, you can get that and you can send it out however you want. But I think that Li-Man can probably answer how Istio helps you there. Yeah, I think the logging part, we have some logging adapters like the Stackdriver or other StatsD logging adapters. And we are looking to also into providing some auditing policies so that you can audit all the authorization, all the authoritative requests you have done in the past, yeah. Okay, Grace, whatever. Okay, so in the demo, the username is passed in a very secure way through the cookies in the header. And then the policy like parses the cook, I didn't show the policy that parses the cookies, but there's a little helper that's parsing the username out of the headers. But then I think that Istio's got... Yeah, right now Istio is working on, Istio team is working on enabling end user authentication. Yeah, but it's not at this stage yet. Not ready yet. The policies are actually stored in the Istio Convict Store. Actually, currently it's the API server. And the policy can be either enforced on Mixer or on Envoy. So if it's enforced on Mixer, then the policies are pulled by the Mixer. If it's enforced on Envoy, then pilot is going to push all the policies to Envoy policies. Pilot is going to get the configuration from the Istio Convict Store directly. It's not going through Mixer. Yeah, and Opus designed to be as lightweight as possible, so you could run it at the edge, like next to Envoy or something like that. It's being embedded as a library inside of Mixer, but Mixer does a whole bunch of caching, and so does the Envoy filter for Mixer. So, maybe Lin can talk about that a bit more. Yeah, so on Envoy proxy, we have a lot of caching, and the same as on Mixer side. So, yeah, so OPA can be embedded either to a Mixer or on the Envoy side. In this case, we integrated with Mixer because Mixer is more extensible. It's actually designed for extensibility. So, it's easier to integrate any other policy engine to Mixer. Sorry. For Java. So, OPA is written in Go, and you can embed it into your Go services. If you're using Java or any other language, you can use it as a sidecar, and then it has a REST API that you can use to ask policy questions. Yeah, Istio Mixer is written in Go, actually. And the pilot is written in Go as well. Yeah, so the question is whether the decision that OPA makes can be cached. So, I think it's cached in two places. So, it's cached at Envoy in the data plane. And then inside of Mixer, there's a more sophisticated cache strategy where it caches decisions for each of the adapters, basically, that have run. And so, it's got very fine-grained caching in Mixer. So, there's two levels. Yeah. Yeah. Yeah. A question? Probably a better question for Linan. I think on Envoy side, we are caching the request going out, and basically the request going out and the check result. So, Envoy calls Mixer check and the report APIs. So, whatever the check request sending out and the check result, and also the report sending out, it's all being cached. And on the Mixer side, I think in the OPA case, we can cache the authorization results like what are the authorization request and what are the result? And because Mixer is a centralized component, so it can have a centralized cache, and Envoy is caching for the local service, whatever for this service, the request sending out for this service. Mixer is deployed as a single pound. Or what does that mean? Oh, no, no, no. Mixer is a service, yeah. Mixer is, yeah. It's a standalone service. It's... Yeah, DAG is actually the, yeah, technically the Enmixer team. Maybe like one more question. Which API are you talking about? The policies? The authorization, configuration, the rules. Okay, so are you talking about the policies I showed these policies? Is that what they're talking about? Yeah. Yeah, so Rano is 0.3, as Chenliang said. And we are actually going to have monthly release going forward. And yeah, next year in June it will be 1.0. That's it, yeah. That's the plan. Otherwise there's a problem with time. Thank you. Okay, thank you very much. Thank you.


Our crew had worked on a job in Adale and we had completed the job and on the way back to our headquarters We had to pass through Lenox and we had put in a mobile unit at the Lenox substation a week earlier And as we pulled in a vacant lot across the street from the convenience store by the substation Wesley noticed a commotion in the parking lot. What initially caught my attention was a backfire and I looked over there and I saw a flame coming out from under the hood of the truck So I told Dennis I said look we got a truck on fire. I immediately told Wesley grab the fire extinguisher I'm gonna I'm gonna head over there and get them back from flames By this time the girl had jumped out ran around to the hood and she had her shirt fanning the fire trying to put it out Of course, it was flaming up When it ignited it ignited on the Fella was pouring gas in the carburetor on his arm and same tip hairs By the time I got there and got them back with it was right there spot on and extinguished the fire, you know, I guess Through the years of sitting our safety meetings and you know absorbing what what goes on that just it makes it second nature to you To you know react or respond to something like that makes you feel glad that you were able to help When somebody needed it and she were there you could take all your training and just use it To help prevent something from happening No, I don't consider myself a hero I think what I've done or what Wesley done is what pretty much anyone would do in the in this situation We were fortunate that we were in a company truck and had a fire extinguisher available to go over there and Stop something before it turned into something really tragic So know what we done was pretty much just acting on instinct and training. I Feel like in that situation I just done what I would want anybody to do for me if I was in need not a hero with just Average Joe I reckon


Now, we will discuss some Making Role Blending Decisions. It is believed that Role Blending is responsible for significant part of therapists' most effective or careless decisions or actions. Role conflict arise when expectations in one role involve actions or behaviors that are incompatible with another role. This is very sensitive because human beings perform in different roles and when one role's compatibility is incompatible with another role, then it is a little challenging to take the decisions of Role Blending. Let's say if we talk about that an individual who is a mental health professional is treating a young teenage girl who is coming with a self-harm complaint and she has a lot of negative thoughts about self or negative self-image. She is giving treatment and while giving treatment, she has her own daughter who is of the same age and she is also seeing her as a father. She is telling her as a father that your parents are very good to you, they love you, they provide you with a lot of resources, you are studying in the best school, you have a lot of privileges. Basically, the role she is sharing with her is the role she is sharing with her as a father's role. So at times, sometimes it becomes very difficult to understand the negative person who is sitting in front of you and her parents are probably not the same or she is not perceiving them. So the role's incompatibility can create a lot of problems in understanding. Three guidelines could be used to assess the amount of damage which is being created by the role blending. First, as the expectation of professionals and those they serve become more incompatible, the potential of harm increases. Second, as obligations associated with the roles become divergent. Now, every individual has a role assigned to them and their obligations are different.   And a mother will take care of her daughter, her sleep, her food, her education.  In fact, this role will change and they are the daughter who is supposed to take care of the mother. So when we talk about roles, they can be very divergent and the expectations related to them can also be different. So risk of loss of objectivity and divided loyalty arise. Here, this problem is created that how much of a loyal role can you take on that role?  It depends. Because it depends on the loyalty which is divided and not everyone can expect the same thing. Then third, when the power and prestige of the therapist exceed that of the client, the possibility of exploitation is heightened. Now this is very important to understand that if we look at it, a therapist is very powerful, has a lot of community name, has suggestions of therapies, has a holy word, if there is any kind of role blending, then most people won't believe that a therapist can do something wrong. So here also a lot of problems can be created because we think of big names, we don't expect them to make a mistake. Then the goal of an ethical decision is not to avoid any or all violation of boundaries because it is impossible. If we talk that there can't be any role blending, there can't be any people's loyalties that can't be divided, then it will be impossible. But instead the goal is that to stay on the more safe end of the spectrum where the misuse and exploitation of the therapist's power is kept to be minimum. Our only effort is to try to understand these roles as clearly as possible. And to perform them in a new way so that an empowered therapist doesn't have a lot of negativity on the client's life because of any mistake. In fact, he can be a part of his therapeutic relationship and take a safe exit from it.


Yes sir. Yes sir. Please come sir. Mr. Tewari, why did you wish to join the service? The primary reason for joining the service is service to the society which has contributed in my emotional development. Other reasons are financial security, job security, social recognition and a challenging job. So what qualities will you bring to this job? So the primary quality I would say is my versatility. I can adapt to situations. In my 10th class, I had 11th and 12th class, I had physics chemistry and mathematics. Then my graduation and qualification I did with biotechnology. And the optional subject for civil service was philosophy. So I can adapt to various situations. You can adapt. Yes sir. Good. And other than that I also possess the qualities of compassion. And I appreciate the constitutional values of pluralism, diversity and friendliness. So is this your first attempt? Second and third. Mr. Tewari, what is happening in the UK on the Brexit issue? When we did we find that sometimes seven members of the Labour Party have created some members of the Conservative Party have created. What is happening there? I believe they are confused as to what should be the course of action now. In 2016 they had referendum. Where marginally people had that they should exit the European Union. But now they are unsure as to how to exit. They are suggesting a deal. And some of the cabinet members plus majority of parliamentarians they are opposing that deal. So there is this possibility that the Brexit which will happen will be a nodal Brexit. Which would not be a good sign for the party. But there are also some talks of a re-pwn on this issue. And also extension of the time for Brexit. The last date is 29th of March I think. They are also saying that maybe they will ask the EU to extend it. But what is the crux of the issue? Where are the talks stuck on this? There are two or three main issues. First is that Irish Backstraw Mechanism. As to where there should be a hard border between North Island and Republic of Ireland. And second issue is the rights of European Union citizens in Britain. And third issue was regarding payments that Britain has to make to European Union. Now our relations with China. There are a number of irritants in our relationship with China. When you list some of them, on which China has been opposing us on various issues? So there are multiple issues between India and China. First is your undissolved border issue. That is the primary issue. Then we have Pakistan support, sorry, China support to terrorism. Indirect support to terrorism by blocking our bid to list Masood Azar as a UN terrorist. Then I would say in South China Sea as well. We have our differences of opinion with China. China wants to work on what issues are these for security reasons. So China claims entire South China Sea to itself. We basically say that freedom of navigation has to be ensured. But NSG? Yes. NSG to NSG? Yes. Okay. Now this, what is the CPEC and what is it, why is it of such significance for China? CPEC is China-Pakistan economic corridor. It will link with the Xinjiang province of China. And it is important for China because they want to avoid this Malacca dilemma. And they want to create alternative routes so that their energy security can be ensured. And they will be done by Pakistan. And it is of concern for India because of reasons like it voids its territorial integrity and solidarity of the country. Because it passes through POK and Gilgit-Burkistan, which we claim as ours. Now when we talk of China, very often this concept of string of pearls comes up. What exactly is that? So string of pearls is a strategy adopted by China to encircle India and to contain its rights. Okay. By creating its influence in countries like Poland of Africa, Djibouti, Naval Base, then Maldives, then it is the landmark of the Maldives. Where do they have that idea? Maldives? They are increasing their stakes like China-Maldives friendship bridge. True. But that doesn't mean surrounding India. Basically, when we talk of string of pearls, it means naval bases from where China can pour the threat to India. Maldives warships can come there. Maldives, they don't have anything yet. In future, sir, it can happen. They are trying to buy an island which will go through. In Chinese submarine presence is also possible. Okay. Now tell me, is there a procedure laid down for removal of the Supreme Court judges in the Constitution? The Constitution provides for removal of Supreme Court judges. And it has to happen on what grounds? On what grounds? On two grounds. Two grounds, gentlemen. I can't. It was very... It was very... It was very interesting. It was very interesting. It was very interesting. Now the procedure to remove the Supreme Court judges laid down and judges enquired again. What is that? Sir, what is the procedure? Sir, the initiation of resolution has to happen at either of the processes. Then it has to be passed by at least two-thirds of members present in voting and 50% of the membership of the votes. Without any enquiry? First enquiry has to be committed as well. And the speaker will admit it. The speaker or chairperson will admit it. And then it will be sent. Thank you. Okay. If I say I am preamble to the Constitution. Yes, sir. How do you justify the whole Constitution? Yes, sir. How do you justify this? I believe the statement is correct because it contains the ideals and aspirations of a country that we want to be. It provides for creating a country that is sovereign, secular and democratic, and a republic form of country. And it seeks to provide for its citizens justice, that is social, economic, political equality of status and opportunity. And liberty, thought, expression, belief, faith and worship. And to create an integrated society which has solidarity amongst its members. You are correct. Okay. Now, you tell us where in the Constitution we see in print of this, when you talk of justice, you said social, economic, political. Yes, sir. Because this is the reason. Where do you see social, economic and political justice in the country? Sir, it is primarily in case of fundamental rights and DPSP. That is the principle of state policy. Fundamental rights, they talk about political justice and DPSP, about social, economic justice. What is 73rd and 74th amendment? 73rd and 74th amendment deal with the rural, local bodies and our local bodies. Anything very salient, some salient features of this? Sir, they provide for subjects that relate to grassroots levels which directly concern the citizens to be administered and governed by the rural local bodies. They empower the panchayats and urban local bodies so that citizens can interact with them and resolve their grievances. And we have 11-12 schedule as well, which lays down certain subjects of importance. Right to education act. Sir, can you tell us some of the salient features of this law? Sir, right to education act, it provides for free and compulsory primary education for children in the age group 6 to 14 years in the age appropriate classroom. Then, earlier it used to contain unwrote attention provision. But now, it has been amended and now states have been given the responsibility the authority to decide whether they want to have unwrote attention provision in the state law. And it seeks to provide quality education as well by the provision of comprehensive and continuous evaluation. How does it ensure that all students, even the population we have there are sufficient schools to accommodate or everybody, even the poor? It provides for minimum infrastructure and norms that has to be there in schools and then schools has to be in a certain distance and then there is reservation of 25-40% of the private schools. Now, last, tell us about in the recent past, Uttarakhand High Court passed a number of judgments touching upon forest and wildlife. Can you tell us about some of it? Sir, in 2017, Uttarakhand High Court passed a judgment declaring river Ganga and its two-three sites for living and drinking. And last year, Uttarakhand High Court passed a number of judgments where animals, they were listed as some jurisdiction. Okay, thank you. Uttarakhand sees a lot of lands and landslides in the upper regions. So, what has been planned to look into this process? Regarding floods, we are after 2013 Kerala tragedy, we have initiated certain projects like Uttarakhand Disaster Recovery Project which is World End Supported Project. Then there is... What has been planned in it? We are creating the infrastructure so that we can deal with floods and flash flood type situations. And then we are also creating awareness, then we are promoting organic farming renewable sources of energy and we are also... Union government also has passed an order declaring certain areas as economically sensitive areas where certain development activities will be distributed. So, in these areas like you just mentioned where the temples and all are situated, is there any distinction on the movement of the steps? So, you talked of disasters. Do we have any agency which looks after this problem? Any disaster relief? We have... For relief situations we have NDRF and etc. Disaster disaster response, state disaster. So, are they the first people who come for relief or is it the locals who come for relief? The locals. So, what is their goal? They have to... First of all they are like in case of forest floods. They have to be given certain amount of relief so that they can deal with it first. No, I was talking about the disaster relief process. What is their goal? If the locals are already doing what is required, then why do we need these agencies or relief forces? In certain disasters they may not be handled by locals. And in that cases NDRF and SDRF role becomes important. So, how was their role in looking into the plants or the landslides in the last event that happened? They played a very important role. What did they do? They evacuated people, then they carried out certain rescue operations. They transferred people to vertical facilities and they provided first aid and all those things. Then they brought food packets as well. So, in future if there is a flood or landslide of the scale at which we had earlier, do you think the people themselves will be able to manage it? When people's capability have to be built, but we have to bang upon NDRF and SDRF as well. Alright, fine. Now you have philosophy as accepted. If I asked you to compare the philosophies of Buddhism and Jains, would you be able to do that? Let's hear. Jainism, they have some kind of bias against epsilonism. For them, everything is relative. They believe in philosophy of Siadva, theory of relativity of both. Whereas Buddhism they say that this perceptual world is conditional and finite. But there is absolute clarity which is Bodhi or Prangaya. So, they have no bias against epsilonism. Then Buddhism, they don't believe in any entity like Siddhasila. Whereas Jainism, they say that once you have attained moksha, you will go to Siddhasila and you will have fourfold knowledge, power, bliss and faith. So, Buddhism has no such concept. For them, once you have been liberated from the cycle of birth and death, it will be like a candle has been finished and the flame will not go anywhere. You cannot do that. Now, you are also interested in meditation. Yes. So, what sort of meditation do you do in the past? I have practiced mindful breathing. What is mindful breathing? Everyone talks these days of mindfulness. What is it? Mindful breathing, we observe our meditation and exhalation processes. We focus on that. So, why don't you just call it breathing exercise and concentration on that? Yes, it can be called like this. That's good. You also learn biotechnology. Yes. So, what do you study in biotechnology? Do you use stem cells? Yes. So, tell me the latest one, stem cells we have searched. Stem cells, they are progenitor cells which can develop into any kind of cell. Yes. And there are multiple kinds of stem cells, protein-potent stem cell, multi-potent stem cell and pluripotent stem cell. And stem cells. So, can you grow organs from a stem cell? Yes, it is possible. Protein-potent stem cell can be used to develop any kind of organ. And pluripotent, limited number of organs can be grown. So, is it being used anywhere? Stem cell therapy has been used in tissue regeneration in certain cases. At the end of a year, we grow. Correct? Yeah, after a year. Then we are low into a stem cell. Yes, it is possible. It is possible. All right. Now, also then, under biotechnology, do you also use those machines or not? In biotechnology? Like the CT machines, the MRI machines. What else do you study here? The primary area is, the area which I am comfortable with is that downstream processing. This nanofiltration and reverse hostances. So, as far as nano is concerned, can we use that technology to give drugs in certain areas? Specific areas delivery of drugs? In nanotechnology, it can be used. It can be used. Is it being used? No. I think now they are for cancer treatment. Deepak, some people have described Gandhi as a Marxist without a gun. Would you agree? I believe Gandhi ji stood for certain principles that were common with Marxism. Like welfare of all the people and Sarvodai and Andhya Vair. But he differed with Marxism in certain ways. Like Marxism, he was not very well, he was not, I would say, compatible with the idea of a blood revolution. He believed in Sakya Vair. That is not a blood revolution. Using the sports of soul to change the people. Now, which emergency provision of the constitution is yet to be invoked? Any day. Which emergency provision of the constitution is yet to be invoked? Financial emergency under Article 360. And which is the one which has been invoked on most and abused on most also according to some precedence under Article 356. Now, in the same context, the governor of a state has certain discretionary power when there is a hung assembly. It's in terms of inviting who he thinks would command a majority. Now, which is the case where, which was the last case where this exercise of this power was challenged and Supreme Court delivered some, Supreme Court issued some orders. It happened last year in Connecticut assembly elections. So, what was the nature of Supreme Court's direction? It's a honorable Supreme Court leader directed the governor to hold a certain confidence motion within 48 hours instead of 15 days. So, time was reduced. Now, some question you have been following the Indian economy. Can we name two positive and two negative trends of the Indian economy? Over the last few years? Yeah, currently, currently. So, positive trend, I would say first positive trend I have seen recently is increased collections of tax and direct taxes. Go ahead and see in tax comparison. Tax base has increased from 3.8 per ounce to 6.8 per ounce, okay. And tax revenues have also increased tax to GDP, direct tax to GDP ratio it has increased to 5.90 percent. And other positive trend that I find is GST, which has led to it's again tax. So, mention something which is fundamental to macroeconomically fundamental. Over the last few years, average inflation rate, it has been less than 4.5 percent. So, that is, and economic growth rate is of average 7.4 percent. So, I guess these are the positive trends. What about the negative trends? So, one of the negative trends is inequality. According to Oxfam reporter, that's a social phenomenon. I'm asking about economic trends, fiscal trends, macroeconomic trends. I would say it is low investment to GDP ratio. It should be higher, it should be higher. To support 10 percent less economic growth rate. It should be entering the 5.36 percent. But it is currently working at around 32 percent. So, it should be okay. Otherwise, your tax to GDP ratio is still, I would say, not to the level of China or obesity countries. It can be higher. Okay. What about trade deficit? That is also one of the concerns. Especially with the current trade deficit and trade deficit is one of the matters of concern. Okay. What is the Karthapur corridor? Karthapur corridor is a joint initiative between India and Pakistan, where in the six buildings, they will be able to visit Karthapur-Sahab-Purugara in Pakistan. And it will connect which place in India. Urdaspur to Urdaspur. Given the situation, that we are passing through as far as Indo-Pac relations is concerned, do you think this corridor should be kept on hold? Is it liable to be misused by some people, especially people? It's a possibility of misuse there, but it is not a viable reason to keep it on hold, because the faith of the children is of utmost importance. Okay. Now, you take interest in cricket. You watched yesterday's match. What was the difference between a victory for India and a defeat for India? I would say it is the individual reliance of the Olympics. Okay. Thank you. All right. You are interested in foreign services as your second choice. Prime Minister Modi, after the Obama incident, made a statement that the military has been given a free hand. Do you think as a diplomat, as an officer of foreign service, should military be given a free hand? It will be allowed to do what it likes. The military can be given free hand within the constitutional framework. And the military should not degenerate. So in no part relations, should military be given a free hand? Sir, I believe what Prime Minister was referring to was retaliatory to what Pakistan has done. But we are not a country like Pakistan where military can govern the entire country. So the kind of free hand that military has in Pakistan that we cannot do. You are not translating my question. Should military have a free hand as far as India-Pakistan relations is concerned? You already do what you like. I am sitting with my eyes closed. Sir, we cannot. Obviously. Last year, there was some action of the governor of Uttarakhand which was rejected by the Supreme. Do you have any idea? I cannot. Uttarakhand? I cannot recall that. You don't recall that incident? I don't recall the incident. Dr. K.K. Paul is still that one. He was the governor. And he had tried to intervene in matter which was purely within the realm of the speaker. You have no idea. Sir, if right now Governor is this may be the new governor. It's okay but I am talking about last year. Is Uttarakhand a special category state? Yes. What does that mean, special category? Sir, special category state is given to a state. Special category status is given to a state based upon certain parameters like border in the state, then geographical terrain difficulty, then economic backwardness. And Uttarakhand meets all these criteria. So what benefit does it derive from the center? Which other states don't derive? Sir, they receive more funding as compared to our own states. 30% of central funds they are given to 11 special category states. And when it comes to irrigation projects as well, so they receive funds. In centrally sponsored scheme, they get 90% as against 60% in other states. That is the real requirement.  Name two main objectives of India's foreign policy. That is what it is trying to achieve through foreign policy. So first is promotion of national security. National security as well. And second is India's development, trying to furthering it, improving its relations with other countries. You are quite good at that. You know what is BRI, Burnt and Gold initiated of China? So under this it has launched some connectivity schemes. India is also responding. And has started certain connectivity schemes. Can you identify those schemes and hear the schemes? One is India and Japan. They have talked about Asia, Africa, North Korea. No, you talk of something which is actually on the ground. One is Chabad Port Project. Then Kaladan Multimodal Project. And India Myanmar Thailand Triliter Highway. Good. And BCI, Bangladesh, China, India, Myanmar, Kuala Lumpur. And DVM. DVM, which is of course history mark taken off. But on these side, others side. Triliter, Kaladan and Chabad. What is Kaladan? Where does it begin? Where does it end? Kaladan will start from Kolkata Port. Then it will connect Sikla Port. Then it will pass through Myanmar and connect Vizoran. Vizoran. In biotechnology, what do you study? Sir, biotechnology, if I can define it, it is application of technological process on biological systems and organisms. From many plate organisms. Biological means living organisms. Living organisms. Whether it is plant or it is... Microcosm. So do you deal with GM crops? What is the state of GM crops in India? Sir, as of now, BT Gotal is allowed to be cultivated. And when it comes to GM mustard, no decision has been taken off now. GEAC has given it clean light to allow it commercial cultivation but environment industry has not taken a decision as of now. Why is it environment industry taken a decision? Sir, because they believe that the impact of GM mustard on biodiversity and plant and animal health is still not... They are very keen to legitimize it. Supreme Court is putting its foot down. Mr. Modi is very keen to release GM mustard. Dr. Mantel's... What is the difference between genetics and biotechnology? Sir, genetics... Biotechnology... Genetics is one of the branches under biotechnology. I see. So we study genetics... So, cloning, etc. will be part of biotechnology? Yes, we study it under biotechnology. I see. And when you change the genes, that also is part of... Yes, genetic engineering is also part of it. I see. Now, Uttarakhand, after the incident in... What was that place? Giranath. Giranath. Then construction of dams has been halted in Uttarakhand. The large number of dams. Who has halted it and why? Sir, the activism that has happened after 2013 was... It has contributed to halting of certain... I don't like to put it. All right, activism, there are the aliens at all. But who... Which is the authority which has said no? We will not allow it until certain conditions are met. Supreme Court. Government of India and Uttarakhand... Government are very keen to launch. But Supreme Court says no. We must have a proper study of the ecological impact. You must know this, sir. Now, Uttarakhand is a border state. So, Bharatmala program must be functional there. Bharatmala. What is this program? And what work has been done as far as Uttarakhand is concerned? Sir, I'm not... Go on. What is Bharatmala? Projects under Bharatmala. But you know what is Bharatmala? It is meant to develop border roads. Right from Gujarat to Manipur. All the border is crates. All right, we close the interview. I'll give you a feedback. You have done well. You have been able to handle most questions nicely. We feel that questioning will be based on... On the right. In case you wish to write. Otherwise, you can write. So, most questioning will be based on your bio data. So, you're from Uttarakhand. Cross-phase your subject. Border service is your second choice. Biotechnology, etc. Are your studies, your main subjects. Then, meditation, reading books, watching... If it is these areas on which you should focus, We are trying to ask you questions.  This is the entire sequence of events of this interview. In addition, we feel that Constitutional principles should also be studied, Like 73, 74 of them. The social reform and political justice. What are the laws and institutions for it? In the country. Since Gedanath event happened, Disaster management has become a result issue. So, it can be asked What are the mechanisms for disaster management? Philosophy is your subject. Therefore, we have asked you a few questions. Dadi, Marxism, Judaism, Buddhism, etc. So, these are some of the areas And, finally, current affairs. So, it's a little easier. I think you will be very well informed. You're from Uttarakhand. Please take a look at the program. What is the budget and location for it?  That's all okay. Good luck.


So, take it. I don't look new. Can't speak. My daughter has cut her hair. I can't think of anything. I've been waiting for this for a long time. What do you want? Sir, sir. Sir, here's your money. I've been waiting for this for a long time. I've been waiting for this for a long time. Who's that? Black Mirror. Cuckooly Magnetic. Good. Different. And you're pretty. Smart. You're from Khan. Yeah. And it's the director of The Elevator, which we haven't seen, but we've heard it's hilarious. Heard it's hilarious. Didn't we react to the trailer for that thing? Yes, yes. Oh, no, we did. Oh, that's great. Yeah, that looks really, really good. And cool premise. Obviously, it looks like it's going to be one story of Blackmail. That becomes two stories of Blackmail. And then it's at least three. And they just keep killing each other. Yeah. Great trailer, too. Yes, that was actually well done. Well done. It has great music and a great pacing, and it kept surprising you. Everything about that trailer was great. It didn't seem like it gave away too much.  Yeah. There's a bunch of different people that are going to be Blackmailing people. Yeah, that would be like, you want to know how to make a trailer for your film? This is one of the ways to make a great trailer for this kind of film. Yeah. That's just a great trailer. As usual, please let us know how it is. It probably won't be like... We've got to figure out. Absolutely have seen that girl. It's driving me nuts right now. I'll tell you right now. You've seen her in pink. That's it. You are right. You're right. Sorry, I did it again. I did it again. Yes, but more so it's because of... She's one of the three girls in pink. Yeah. Yeah, Kurtie Calhari. Kurtie Calhari. Yes, it's from pink. That's where I remembered her from. She's also the nurse thing in Yuri, right? That's who she plays. I don't remember who she plays in Yuri. I just remember Pink. And it's been months since we saw Pink, so that's why my brain was like... Yeah. You know what she reminds me of a little bit is... Sandra Bullock. She has a Sandra Bullock vibe going on the face there. A little bit. I like the poster. Love her, she's great. Look at the poster. Wow. It has a chicken in it. It does. That's interesting. When Dev finds out his wife is cheating on him, he secretly blackmails his wife. Andrew Lover is a form of revenge. But then he ends up paying it. There's more, yeah. They could have added a little bit more in there to make it a bit more intriguing in the synopsis. That's funny. He ends up paying it and then somebody blackmails Andrew Lover. Oh man, that looks like it's so much fun. Wow. Looks like it's a twisty, scary, funny, off-beat. Yeah, so please let us know how it is. And I believe his first film we're going to watch is probably going to be The Lunchbox. Because that has the two actors that we really want. It's true. It's N'Wazadin and... Yes. What's his face? Airfun. Yeah. But let us know how this one is. Because we want to delve into airfun a lot. Yeah. And we want to shock another movie to add to the list to watch. Yeah. It's a pretty short list, everyone.