The Equitable Life Assurance Society presents this is your FBI. This is your FBI. The official broadcast from the files of the Federal Bureau of Investigation presented as a public service by the Equitable Life Assurance Society of the United States and the Equitable Society's representative in your community. If you were born between the years 1900 and 1910, here is a question which you may have asked yourself more than once. Will I be alive in 1975? Well, since 1910 the proportion of Olsters in our population has gone way up. In fact, it has increased by 68 percent. So the chances are getting better all the time that you will be alive in 75. And in exactly 11 minutes we'll have a suggestion which will show you how life insurance with the Equitable Life Assurance Society can help you make the most of this long life that's ahead of you. Tonight's FBI file, The Vicious Shake Down. There is a widespread theory about criminals that they lack intelligence and courage. That theory is wrong and has been proven wrong so many times that there's no question about it's being incorrect. Many criminals have IQs which show high intelligence and if their brain power had been directed along legitimate lines, there's no telling how far their careers might have gone. But legitimate fields take effort to conquer. And if there is one truism about the average criminal, it is that he'll go to any ends to avoid honest work. The schemes he brings forth from his tortured brain are sometimes simple, sometimes involved. But always there is the same goal, getting something for nothing. Tonight's FBI file opens in a gymnasium and health club located in the business district of a large eastern city. In a small room in this establishment, a muscular rubber is giving a young man a massage. Do you have air, Mr. Hanford? No, it feels good, Tom.  Sure. Ah, I swear. Big night last night, Mr. Hanford? Murderous. Now take it easy around the head. Thanks. Come and complain today. Everybody's got hangovers. We all out together? I'll tell you the truth, Tom. I don't know where I was. Huh? This is the new thing with me now. I have so many drinks and then I draw a blank. Hey, that's bad. I know, but it's all behind me, Tom. I'm on the wagon as of today. Well, do you know, huh? When are you getting married, Mr. Hanford? Two weeks. Hey, that's swell. Yeah, kind of like it myself. Well, not just about, does it? My time's up. Okay. Thanks, Tom. Ah, I'll feel fine. Now you just relax a little while, Mr. Hanford. All right. You should fall asleep. When would you like me to call you? In an hour. Take it easy. Okay, Tom. Who's that? Mr. Hanford. Hmm? Who are you? My name is Belle. Frankie Belle. What do you want? I'd like to talk to you. What about? Personal matter. Mind if I sit down? Oh, look, I'm trying to get a little sleep. That can wait. Huh? Say, what's this all about? I'm a friend of Marie's. Who's Marie? Are you kidding? Look, I'm asking you a question. I suppose you don't remember last night, either. No, I don't. And I've had a... Hold it, Mr. Last night, you and Marie got married. What? You heard me.  Take a look at it. Marriage license. Is that your signature? What? Oh, yeah. You'll also find your name on the register at the central hotel. You and Marie spent your honeymoon there. Oh, no. No, none of this could have happened. Well, I don't know anybody named Marie. You just met her last night. It was a real quick romance. But look, I'm already engaged. I'm getting married in two weeks. Mr., you're already married. I don't believe you. Okay. Suppose you check up on this marriage license. Take it. It's a photostat copy. Marie has the original. You can also check the register at the central hotel. Then you'll hear from me later. Some more coffee, Paul? No, thanks, Mother.  You mean novelty, don't you? Well, yes. Anyway, I'm grateful. You know something. So am I. Oh, Mother. Yes? Did you hear me come home the night before last? The night before last? Yeah. Why, Paul, you didn't come home at all. Oh. I thought you stayed at the club. Oh, of course. That's right. I did. Why do you ask? Nothing important. Oh, goodness. I almost forgot. What? This special delivery letter came for you early this morning. Here you are, dear. Thanks, Mother. I didn't know if it were important enough to... Oh, quiet. Please. Come on. Sorry, Paul. Is something wrong? No. But, darling, there must be... Excuse me, Mother. I'll see you later. Several hours later in the local FBI field office, Paul Hanford's mother is being greeted by Special Agent Jim Taylor. Won't you sit down, Mrs. Hanford? Thank you, Mr. Taylor. Now, what can I do for you? Well, this is a matter concerning my son. Yes? He doesn't know I've come here to see you, but I... I just had to. Well, what is it, Mrs. Hanford? I received a special delivery letter this morning. When he read it, I could see that it upset him very much. Yes. I tried to question him about it. He left the breakfast table and walked out. I see. In his excitement, he left the letter behind. I did something, Mr. Taylor, that I've never done in my life before. I read his letter. Well? It was sent anonymously. It demanded that he pay $50,000 to straighten out some matter. He also said that if he didn't pay, his impending marriage would be ruined and he would suffer bodily harm. Did you bring that letter with you, Mrs. Hanford? Yes, I have it right here. Yes, please. Here you are. Thank you. Has anyone else handled it other than you and your son? No. Fine. I want to have it analyzed for fingerprints. Mr. Taylor, as I told you, my son doesn't know I've come here. You did the right thing in coming. This is an extortion letter. Now, whether the basis for the thread is real or imagined, the center is broken the law. It's our job to find him. I'd like to go over and talk to your son at once. Were you sleeping? Yeah. Yeah, I guess maybe I was. I don't know how you do it. What do you mean? Sleep at a time like this. What are you talking about? Waiting for that guy Hanford to call. I swear to you, all afternoon I've been so nervous I've broken two fingernails. No, Marie, just relax. I can't. You'll all come out okay. What makes you so sure?  Nothing can go wrong any place along the line. And he'll think he really married me? The license is legitimate, ain't it? Yeah, but you married me with that license, not him. I worked 10 hours a day practicing his signature. He'll think he signed the same thing with the hotel register. And you honestly think he drew a blank that night? Maybe that Mickey I fed him took care of that. Well, I still can't believe he'll call. He's got a call. Look at the spot he's in. With his girl, you mean? That's right. She's a big catch for him. What do you think, out there? Frankie. Hmm? Maybe he never got your letter this morning. Oh, look, will you stop putting a whammy on this? That could happen. Marie, the post office people have been around quite a long time. They're real dependable guys to do business with. Did you give my number in the letter?  I called that health club. Left a message for him to call here. Oh. Say, I just thought of something. What now? Well, that's being already married. And then getting married again the other night. Does that make us bigger, Miss? Nope. Just me. Why? Because you've got two heads. That's cute. Oh, gee, do you think they... Let her up. Hello?  Right. Go ahead, please. Hello? Hello, Mr. Hanford. Are you the man that came to the health club? That's right. Well, I received your letter this morning. Well? I'd like to see you. Come around here. What's your address? Garden apartment. 82 Maple. What time? Six o'clock. Very well. See you later, Mr. Hanford. Well, honey, what'd I tell you? Go ahead, Mr. Taylor. After you, please. Very well. Let me take your hat. Surely. Here. Is that you, Mother? Yes, Paul. Your son? Yes. Come this way, please. Thank you. I'm here in the living room, Mother. Paul, I brought home company. Oh, really? Darling, I want you to meet Mr. Taylor. This is my son, Paul. How do you do? Hello. Paul, Mr. Taylor is a special agent of the FBI. Paul? I asked him to come here because... Well, because I read that letter you received this morning. Oh, I had to, Paul. I saw how it upset you. Mother, you don't have to make a Supreme Court case out of it. There's nothing too terrible about reading a letter. Mr. Hanford, have you any idea who sent it to you? Yes, I have. Really, Paul? It was that clown, Chuck Davis. You know that boy I play squash with? But why should he...? Mother, the whole thing was a practical joke. What? How do you know? Well, Chuck's a practical joker. I suspected him immediately. I confronted him with the letter today, and he confessed all. Oh, thank heaven. So, I'm afraid, Mr. Taylor, you're on a wild goose chase. Oh, goodness, that's so. I do apologize, Mr. Taylor. That isn't necessary. I'm delighted that it turned out the way it has. Most extortion cases haven't this happy an ending. You handled many of them, do you? Well, enough to have worked up a very strong loathing for all those who sent threatening letters. How many do you catch? Well, I don't want to sound immodest, but we bat pretty close to a thousand. I see. Well, I guess I'd better be running along. Frankie, that must be him. Could be. Who is it? Paul Hanford. OK. Hi, Mr. Hanford. Hello. Come on in. Very well. Who is she? That's Marie, your wife. Oh, no. Well, that's early, isn't it? Marie, uh, Mr. Hanford came here to talk business. Let's give him a chance. OK. Now first, Mr. Hanford, did you check on the marriage license in the hotel? Yes. And? It could be my signature when I've been drinking. I told you right along. We're wasting time. I can see that I probably got drunk and married this girl. And you've apparently set a price for her calling the marriage off. Let's get right down to that. It's a pleasure to do business with you. How much? You got my letter. 50 Gs. That's out of the question. Well, what's your idea of a payoff? I have it right here with me. $2,000. Are you sure? Quiet. Look, Mr. Hanford, 2,000 don't even get you inside the ground. That's all I can raise. Don't give me that. I'm telling you the truth. Look, your mother's got scratch. Your girlfriend is loaded. There's nothing to do with me. Well, and the best I can do for you is knock 10% off the cash. The best you can do? That's right. Well, how do you figure so strongly in this? I'm an old friend of the family. Oh, well then I'd advise you to take this 2,000. Don't you do it, Frankie. Don't worry, sweetheart. I won't. Very well. You leave only one course of action open. What's that? I'm going to the FBI. What? On what ground? That was an extortion letter I received today. They'd be very happy to prosecute you for sending it. Is that a fact? Yes. Now, will you take the 2,000? No. All right then. I'm going to turn you in. You're not going anywhere. Frankie, I'm glad you hit him. What a piker. We will return in just a moment to tonight's file, which shows how your FBI helps provide security for your country. Now, let's talk about security for those who want to be independent as they grow older. Cross, that's just a beautiful dream. By the way, taxes and living costs have gone up. I don't save a cent. So when you talk about independence when I grow older, I say, what am I going to use for money? Well, the plan I'd like to tell you about was designed to order for men in your financial position. Men who haven't got money to burn, but who do look forward to complete independence in their 60s, it's called the Equitable Life Assurance Society Independent 60s Plan. Sounds interesting. Let's hear more about it. The Independent 60s Plan of the Equitable Life Assurance Society has these three features. First, it costs considerably less than you probably think, especially if you're covered by social security. Second, you can create your retirement estate for the full amount the moment you sign the contract. You don't spend years wondering whether or not you're going to accumulate enough money to be independent in your 60s. You're sure of it because it's guaranteed by the Equitable Life Assurance Society. Third, this Equitable Plan gives you a definite goal and a practical method of reaching that goal. Yes, there's nothing finer than being independent in your 60s, being your own boss, doing the things you want to do. Say, this is right up my alley. I think I'll look into this plan. Then get in touch with an Equitable Life Assurance Society representative. He'll give you the facts on the Independent 60s Plan. Look in your phone book for the Equitable Society. That's E-Q-U-I-T-A-B-L-E. Or send a postcard, care of this station, to the Equitable Life Assurance Society of the United States. And now, back to the FBI file, the vicious shake down. People have gotten to understand almost everything in the world, except other people. It would seem on the face of it that anyone with normal intelligence would realize that you cannot do business with a criminal. Yet year after year, honest citizens continue to become involved with lawbreakers. Now, there's a basic truth which every citizen should memorize. Memorize because it would save him untold agony. And that truth is that if you deal with criminals, you must get hurt. Tonight's file continues in Special Agent Jim Taylor's apartment. This afternoon night, he's just preparing for bed as... Hello? Hello, Mr. Taylor? Yes. This is Mrs. Hanford. Oh, yes, Mrs. Hanford. I'm terribly sorry to disturb you. It's all right. I called her office and they gave me your home number. What's on your mind? I'm calling about Paul. Yes? Terribly worried about him. He left here right after you did this afternoon. He's presumably going to drop off at the health club for a minute. Then he had a dinner date with Christine, his fiancee. Yes, go on. After that, he was taking us both to a concert. He hasn't kept any of these appointments. And you haven't heard from him? Not directly, but I called our lawyer. I learned that Paul had gone to see in this afternoon right after he left the house. He asked for $2,000. Said he needed it desperately. I see. Did he get the money? Yes. Mrs. Hanford, I'll come right over to your house. Come right into the living room, Mr. Taylor. Thank you. I'm very grateful to you for coming over. It's my job, Mrs. Hanford. Not the cater to a nervous woman's fear. Well, I'm sorry to say that it looks like your fears are justified. About the extortion note? That's right. Your son's getting that $2,000 from your lawyer. Certainly makes it appear that he wanted it for a payoff. But he told us this afternoon that the note was a practical joke. Yes, I know. That was just to alleviate our suspicion, I imagine. Where can he be now? That's the important thing. We've no idea where he's gone. I don't know. Or did he mention anything to your lawyer as to where he might be going? No, he just said he was going to his club, the health club. Have you called him? Yes. What did they tell you? That he called in earlier in the afternoon. What for? To see if he'd gotten any messages. And had he? I didn't ask. That could be very important, Mrs. Hanford. Why? He could have been contacting the club because he expected a message there. Oh, I see. Will you let me have the number, please? I'll phone him at once. Frankie, he's coming too. Yeah. Should I get him some ice or something? No. What for? That lump on his head. Leave him alone. He may grow a few more before we're done. Oh, my head. It hurts, huh? Yeah. It feels as if... No. It's you. That's right. I'm still here. Mm-hmm. Yeah, let me...let me get up there. Should you, Frankie? Yeah, he can sit in that chair. But look, Miss, they don't try anything because something new has been added since you left us. This gun. I see it. Well, do you think you're ready to talk business again now? There's nothing to discuss. Oh, yes, there is. We had a board of directors meeting. We decided to cut the price. To...to $2,000? No. $25,000. Not interested. We decided something else in that meeting. Really? Mm-hmm. Strategy. How to make you pay the $25,000. That's not possible. Not even if we call the newspapers? Give them the story and your marriage to Marie?  Now, you'll forget them. I got proof. But that would take too much time. I got even better way. That's to call your girlfriend, Christine. I'm not listening to any of these shakedowns. You know something, Frankie? I bet he don't think you'd have nerve enough to call her. You think I should show him? Yeah. Give me that address book. Sure. Here. Hey, that's my address book. Yeah, I know. I borrowed it when you passed out. Let's see. Here it is. The number is main 72932. 2932. That's right. Get her on the phone. Okay. Wait. Huh? Never mind. Call her, baby. Hello? Oh, there's never anybody on that switchboard. Yes? Hello, this is Mrs. Bell. Marie? Oh, oh. Yes, Mrs. Bell. Mrs. Bell. Do you still think you should make that call?  Frankie, I didn't...  Start packing. Leaving town, folks? Yes, on your two Gs. But before we go, I'm making sure you keep quiet. This is the apartment right here, Mr. Taylor. We got a key. Yes, sir. But like I told you, the Bells left here five minutes ago. They had bags with them like they were going away. I'd still like to see the apartment, please. Good thing. And this should do it. Did the Bells say where they were going? No, sir. Do you know if they took a cab? But they didn't say there aren't many this hour in the morning. There we are. Go ahead, sir. Bye. This furniture belongs to the house. They rented a place this way. I see. Yeah, what's that? I don't know. Sounds like it's coming from behind that door. It's a closet. There's someone in there. He's locked in. Yeah, I got a key that should fit that. Good. This guy in here could be the one you're looking for. There. Hey, bounded gag. Yes. Untie that gag. I'll get these ropes. Sure thing. Is he the missing guy? Yes. There you go, mister. Thank you. I'll have your legs untied in a minute, Hanford. Thanks, Mr. Taylor. Where are the Bells? Gone. Where to? I was hoping you'd have the answer to that one. Yeah, that doesn't... Oh, Hanford. Yeah? Your practical joke didn't turn out so well, did it? I'm sorry, Mr. Taylor. Whatever your problem was, you were a fool to attempt to handle it yourself. I know that now. You pay these people any money? They forcibly took 2,000 from me. Get away, money. I imagine so.  I don't imagine they'll be easy to find. Is something that might help? What is it? Let me get her a phone. Putting the bags in the trunk, compartment. What for?  Yeah, but if the car won't start, you'll only have to take them out again. The car will start as soon as we get that wire connected. When will that be? Marie, you heard the man yourself. He said he was going up to the front of the garage to get a new wire and be right back. But he hasn't come back. Look, Frankie, my complain is we've kept the car in this garage for over 2 years. We certainly deserve better service than this.  I hear someone coming now. Shot here with that... Hello there, Frankie. How'd you get here? Mr. Taylor, I'll let you explain that. I found a bill from this garage in your apartment, Frankie. I called here just before you arrived. The attendant was kind enough to stall you until we could get here. Who are you? Special Agent of the FBI. Frank Bell and his wife Marie were both tried and convicted for extortion. They were sentenced to long terms in a federal penitentiary. And so the careers of two more shakedown artists were ended by your FBI. But ended only after the potential victim had placed himself in great jeopardy by attempting to deal with the criminals himself. You wouldn't ask a plumber to pull a tooth for you, nor would you ask a dentist to fix a leaky pipe. And yet you will. You do ask yourself to perform a job of dealing with criminals when there is at your disposal every type of law enforcement agency you need. Remember this and do your part in curbing the crime wave. When you receive any kind of threat, notify your local police or your state law enforcement officers or your FBI. Crime is their business. In just a moment we will tell you about next week's exciting case from the files of your FBI. Tonight, instead of the customary closing commercial, I should like to read to you a telegram I have just received from Thomas I. Parkinson, president of the Equitable Life Assurance Society of the United States. Mr. Parkinson has wired me and I quote, Today in America, many life insurance men have the right to add to their signature the letters CLU. Those three letters CLU stand for Chartered Life Underwriter. They designate a man who has taken advanced courses in the scientific adaptation of life insurance to the needs of American policy holders. Tomorrow is the 20th anniversary of the founding of the American College of Life Underwriters, which awards those CLU degrees. Therefore, Milton, in my name, will you call the attention of our vast listening audience to the fine service performed by the American College of Life Underwriters during its first two decades and wish this distinguished institution continued success during the years ahead. Signed, Thomas I. Parkinson, president of the Equitable Life Assurance Society of the United States. Next week, we will bring you another colorful story from the files of the Federal Bureau of Investigation. The Hand-Packed Thief. The incidents used in tonight's Equitable Life Assurance Society's broadcast are adapted from the files of the Federal Bureau of Investigation. However, all names used are fictitious, and any similarity thereof to the names of persons living or dead is accidental. Tonight, the music was composed and conducted by Frederick Steiner. Your narrator was Dean Carlton. This is your FBI as a jury divine production. This is Milton Cross speaking for the Equitable Life Assurance Society of the United States and the Equitable Society's representative in your community and inviting you to tune in again next week at this same time when the Equitable Life Assurance Society will bring you another thrilling story from the files of the Federal Bureau of Investigation. The Hand-Packed Thief on This Is Your FBI. This is ABC, the American Broadcasting Company.


So here's just the one thing I want to talk about briefly, mainly for the benefit of those of us using Nebraska Libraries on the Web. We are currently running WordPress 4, and WordPress 4.1 is available, and we will be upgrading to that probably early next week, if nothing else, because I don't want to make changes in the week down for a long weekend. So right now, this is just an example post on a Nebraska Libraries on the Web site. What I want to show you real quickly here is, here is an image, and what people have been familiar with, if I click on this image, is this pencil and the X. The X deletes the image where the pencil takes you into the image detail where you can change things like a line, size, and what you're linking to, and this is what we've been familiar with. The one change I've noticed in WordPress 4.1, which I'm showing you here on a image on a website, my own personal website that's running 4.1, is when you click on the image, they've actually added some new icons to that, so you have the X for remove and the pencil for edit, which does take you into the image details. But the coolest thing I've found is they've added the four buttons to change the alignment right here, so you can change to align left, align center, align right, or no alignment, kind of in a single one click result as opposed to having to go into the edit image, change the alignment, and click update. So they've removed some clicks, very, very handy, I've found, where you've put that image in your text and you've put it in the wrong place, and you just want to change that alignment. So there's the one extra new WordPress thing that I wanted to add to this, and I will probably chop this out and make it its own little instructional video for our project website.


Hello, and welcome into this week's edition of the Ed Hoddle Show. I'm Joe Wamba joined now with Ed Hoddle, head coach of the football team. And coach Saturday, you guys faced DelVal. Just initial thoughts in that game, a veteran upfront presence from Delaware Valley on the defensive line.   And we'd seen it on film. And I thought we had a decent plan going into it. But again, an experienced, physically mature group. It was tough sledding most of the afternoon. Offensively, some maturity shown out of Ryan Sedgwick. And then, of course, Brandon Booth had a strong performance, too. Yeah, I thought Sedgwick took a step forward. Showed that fifth year experience, made some great decisions throughout the day. And it had to be tough. He took some shots out there, which is not unexpected. But again, took a step forward, which I thought was great. And Brandon, I think it was a career day for him. So it was nice to see two seniors in a big game make some big plays. Defensively, some timely stops out of the defense, especially in the first half, holding them the 12 points in the first half. Yeah, I think defensively, it was an opportunity for us to really grow. I think what we saw Saturday was, in some instances, guys trying to do a little bit too much and not really focusing on their job. And that's kind of been an emphasis this week. And as we've talked to the guys yesterday and going into practice today. So we still room to grow. We talked a little bit yesterday about experience in those big situations. And I think there are a handful of guys on the offensive side and a small handful of guys on the defensive side that have experienced those kind of big game environments before. And it was a great opportunity for us to learn and grow and mature a great deal. Definitely a young staff encouraging out of the sophomore group heading into this week. For sure. There's no substitute in football for game experience. And watching these guys grow literally from one week to the next is certainly exciting. What's it going to take to head up to Kings this week for a new kickoff? What's it going to take to come back 1-0? Well, I think it's focused. It's a long trip. We enter a stretch of the season where the back half were on the road three times and it was three long overnights. We've got to be able to handle that. We'll do some things in practice. We'll do some things schedule-wise to adjust to get the guys a little bit more sleep. But it's fundamental football. It's winning the line of scrimmage. It's taking care of the football. And it's playing great defense. Coach, as always, thank you for your time. And good luck up at Kings. Thank you. He's Ed Hoddle. I'm Joe Wamba. And this has been the Ed Hoddle Coaches Show.


Good morning, everyone. My name is Craig Lee. We're still waiting for Dave Chadwick to show up. But until he does, I'm going to go ahead and get started. And I'll do the best that I can talking to his slides as well. In his inimitable way, he took the briefing and he's stuck in a whole bunch of new slides at the last minute and whatnot to try and get across the notion of attribute mapping and those kinds of things that we're going to be talking about with regards managing federated authorization across different clouds. So I come from a place called the Airspace Corporation. That is a nonprofit federally funded research and development corporation. And Dave Chadwick, who is just coming in right now, is a professor at the University of Kent. So while he's getting mic'd up, I'll just go ahead and charge into the talk. So the challenge here in why we were thinking about all this stuff is because we had some use cases. And I had one specific project where I needed to securely manage resource sharing across different sites. This dynamic IT environment where these collaborating organizations could come and go sort of on demand. So I'm going to show some use case drivers that show you why that's important. And specifically, the first disaster response, I just finished up a funded project where we implemented VOs, did a very quick and dirty proof of concept demonstration for being able to use virtual organizations to manage container access and Swift. But that same kind of way of managing data access in other contexts are also applicable to GEOS and also feature front production. I'll talk a little bit more about that. So what this really requires, how to address this is the first step is the federated identity management capability that David has been working on. And if you're following the Keystone project, he's actually had a lot of input about how they're actually going to manage a federated identity management and how to manage the attribute mapping given that you have an identity from some other identity provider and how do you map those identity attributes to what you're going to understand locally given that you could have different users coming from different sources that have different identity providers. And so related to that is that once you establish identity in a local context, a VO is sort of like a security and collaboration context that's not exclusively associated with any one particular organization. And so again, the notion there is that once you become a member of a VO, you have another set of identity attributes or authorization attributes that are given to you that allow you to do certain things, gives you specific capabilities or authorizations within the context of that VO. And so we'll go through how all this is supposed to work. Okay, so we're going to go through just a few examples. This is the disaster response scenario that we went through. So the NGA and the NCOAC, which is a Network-Centric Operations Industry Consortium, so it's another nonprofit organization, wanted to demonstrate this thing that they called a geo-int community cloud prototype for disaster response. And what motivated this is the Haiti earthquake back in 2010, all these government agencies, they couldn't figure out who had what material or where material actually needed to go. They had very limited knowledge of how to get material into Haiti. So the idea is that they wanted to have this capability where they could share data on demand among different government organizations, different non-governmental organizations, also get data from the people that were on the ground, they had mobile devices. So the idea is that you have any number of these stakeholders, which could include people that have satellite imagery, you can compare it before and after to see where civic damage is taking place or where earthquakes or tsunamis, all that kind of stuff to get an idea of where damage has occurred. And also things from terrestrial sources, civic information like engineering blueprints or whatnot, then also people in the field. And you either populate that on a map or you have some sort of way of sharing this information dynamically between these different stakeholders that have different infrastructures and different rules for how to share information and be able to do that on demand. OK, because you don't know when a earthquake is going to strike or who might need to be involved in that kind of disaster response scenario. Another example that I can come up with is this Global Earth Observation System of Systems or GEOS. This is a very large international project. They have this 10-year plan of how to build out this infrastructure for sharing geospatial information, earth observation data across all the different members, Asia, Europe, the North and South America, and so forth. And again, they have this set of nine societal benefits that they actually want to demonstrate. And of course, disaster response is one of them. But there's also climate change, water. You can read them all here. But those are the kinds of motivating factors for being able to manage the sharing of data. Another one that is actually quite interesting is this notion of cloud-based feature film production. And there's actually another small nonprofit called the Entertainment Technology Council that's hosted at the University of Southern California. And what this is, is it's a consortium of the technology providers like Amazon and Google. But it's also the feature film producers like Warner Brothers and Disney and so forth. And they're all trying to figure out how to adopt technology to do feature film production. Of course, it's a business. And they have to think about budget and doing things effectively. But the notion here is that a lot of films that are produced today are completely digital, even if they're not just action sci-fi films, that they will have a lot of effects that are done in post-production, in just digital format. So in a film production, you have a lot of different production houses that would participate in actually taking the raw data assets and producing the feature film. And so using a virtual organization could actually be used to manage which production houses get access to which data assets in which order to produce this final film. And of course, once it's done, you revoke everybody's access for those data assets and away you go. So again, this is another instance of being able to dynamically manage the sharing of data across different organizations. OK. So that's interesting. There we go. OK. Now, so this is probably where I'm going to let David take over, because we're going to talk about the initial technical capabilities that we need for doing this. And that starts with this notion of federated identity management. Yeah, I mean, the common feature in all of these is that all these multitude of partners, they already have their login IDs. They already know how to log into their own system. But login into multiple systems, you don't want to be giving people new sets of credentials every time. So the concept of federated identity management is you use your existing credentials to log into all these new systems that are dynamically created. So that's it. Now, in order to do that, you need to have three things from a service provider's perspective. If I'm now no longer going to be giving out credentials to my users, where am I going to get those credentials from? And the answer is I have to trust other entities to do it. And I have to trust other entities to authenticate the users. And I have to trust other entities to give the identity attributes of users. And then I'm going to do the authorization myself. I'm still not going to trust other people. Although there are models where we can also give out, delegate, trust in the decision making as well. And there are models where you can actually have external PDPs that will make the trust decision for you. And then you don't do anything yourself. You just farm the whole of the security decision making out. Now, the thing is, when you've got these dynamic organizations and you're now going to use your own credentials with your own organization to log into these other service providers, you need different attributes to give you different permissions at these different places. But if you go back to your organization and say, I want you to add me, member of VOX, into your corporate LDAP service, what are they going to say to you? They're going to say, on your bike, right? There's no way that your organization is going to start adding attributes into its back end systems so that you can log on to these remote systems. And that's where the VO concept comes in. We need to have some other mechanism to do that. Now, the trust, as I said, is indispensable. And when we build federated management, one of the important things is to add the trust in. We've done that in our federated Keystone. We have these three levels of trust which we can configure in. And I said, the problem is we can't get the IDPs to assert the attributes that we need. So we need the virtual organization. So this VO, then, is the security context. It's someone who is in charge of the VO who's going to actually give out the attributes to you and all the other members of the VO. So there'll be lots of these VO managers for all the VOs that you're a member of who be giving you attributes. And now we've got the problem, which is sometimes known as attribute aggregation. How do I get the attributes from your IDP that's logged you in and from the virtual organization manager who said what your role is in the virtual organization? Aggregate these attributes together in order to give you authorization on the particular service provider. So that's the particular issue. And there are a couple of ways. Actually, there's another example to say, this is not a new idea, okay? It actually originated from the grid well. So virtual organizations as a concept have been around for, I would guess, eight years. More than 10. Oh, more than 10, okay. And they already have a well-worked out infrastructure which they call VOMS. VOMS is the virtual organization management system and they set it up. It actually has a back-end LDAP and they run it as a separate service and the VO managers will add the attributes for the people in the VOs in it. But then they have this problem of attribute aggregation. So it's not a new concept. So we were looking at how can we put VOs into clouds once we bring clouds in? And what's the different granularity between federations and clouds? Because the grid well didn't have the concept of a federation as such. In the grid world, you had a PKI and everybody had PKI certificates and you use your PKI certificate to log in. But federation is somewhat different to that. Now what's the granularity between these? Well, a federation can have many VOs. So in the UK, we have the UK Academic Federation. It's got 100 universities that are joined in. It's got multiple service providers. There's actually over 800 partners in this federation. You can imagine there can be thousands of VOs within a system like that where a couple of universities and service providers get together. So that's one common scenario. But another scenario is you might actually set up a federation of VO which is actually the same and the same people organize it and the VO is the federation. You can have that. But thinking further, you can actually have a VO that can span multiple federations. So within, again, the academic community which I'm familiar with, we have the federation in the UK. There's the federation in America. There's federation in Norway. There's federation in France. These are now actually being spanned together through the giant project into a federation known as Edugaine where they're linking all these different federations together and then you can imagine that a VO can actually span multiple federations. So we could actually have a VO which comprises people from an American university, people from a Belgium university and people from a UK university as service provider and maybe in Greece or something like that. So they're separate concepts in terms of domains and they're not limited. So you're not necessarily limited in the span of a VO. Now, when we came to do it in OpenStat, we looked at it from a different perspective. Craig looked at it as a perspective from, okay, VOMS exists in the grid world. How can we utilize that? So actually the way, the perspective that I took is what's the simplest, quickest? Yeah, a quick and dirty thing that I can just demonstrate a prototype capability. And so that's why this notion of having an external VOMS where you have all the VO state in one centralized place is obviously the easiest way to implement this. But the notion of having the VO information replicated across the different keystones is obviously another approach because there's a database on the back of the VOMS where you store this information. So you could either have a centralized database or you could have a distributed database where the VO information is replicated. And of course that brings in all the traditional replication and consistency issues. But I mean, depending on your situation, those are two different viable approaches. Yeah, I mean, my viewpoint was, I didn't want to baggage the people who are running OpenStat with the VOMS infrastructure. I wanted to actually say, well, can we get away from running VOMS? And can we actually do VO management actually within Keystone? So that's what we were looking at doing the VO management actually within Keystone because you're already running Keystone and OpenStat. So can we actually do away with not having VOMS? Okay, so I'm gonna describe a little bit about what we actually did for this geo and community cloud prototype. And this is just an example of how it might work to give people the idea. I'm gonna go through some stuff that is a little bit more anatomically correct. But obviously you have some number of OpenStat clouds there with Keystone and Swift. Okay, the first capability that we were getting towards is how to manage access to Swift containers because Swift containers have ACLs on them and so that's gonna work into this. So obviously, what happens is that we modified the Keystone such that when you log into a VO project, the Keystone knows to consult this external VOMS, which has the database in it. And if you do a successful VO login, then that user up there on the upper left, when they actually make a request to Swift, they automatically get authorized to access all those other containers that are being contributed or are part of this distributed virtual organization. Now the user up there, they're just logging in with their regular credentials. They know that they're a member of this VO but in terms of the authorization process that goes on underneath, they don't know anything about that. All they know is that they get back a list of containers from the list operation that they can subsequently do, upload and download operations on. Okay, so in terms of when Keystone knows to do a VO login, what we did is we added this VO offstage to the command pipeline. And again, this is a very simple way of doing it but we extended the Keystone project concept to a VO project by just putting a capital VO dot prefix on it. So if your project name is VO dot, Keystone knows, okay, I have to go consult the VOMS and see if this user is a member and if they are, then they actually get mapped to a role account that's part of that VO. And also there's a number of sites that are recorded that are participating in that particular VO. So David wanted to make some more comments about this notion of attribute mapping. Yeah, so this now is using an approach where you don't use an external VOMS but you actually use your existing Keystone. So this is an example of two users from different domains, different IDPs, could be a user from Kent, could be a user from Aerospace and we've got a common VO where we're using some open stack service. And how can we actually guarantee that we can both access the same resources because we're members of the same virtual organization? So what we've added into Keystone is an attribute mapping functionality which takes the identity attributes which come from the IDP and we map them into the same domain project and roles so that two different people from two different organizations who have got different sets of attributes which are coming from their IDPs, nevertheless, using the mapping functionality they end up getting the same permissions in open stack. So they become essentially members of the same group or members of the same virtual organization. So that's the approach that we took in ours so that you would manage it by not managing an external VOMS and saying this user has this group and then it gets sucked in to the pipeline as in Craig's model but you manage it by saying this user has this project domain, et cetera. So that's the approach that we took and both of them, we've shown both of them can work. Moving on to, oh, sorry. Okay, so the actual attribute mapping that we do is it's rather complex, it's based on sets and it's mapping sets of sets but by mapping sets of attributes to sets of attributes you just get the most generic form of mapping possible because in the simple case, a set consists of one attribute and you map one attribute into one but of course you can do one to many and you can do many to one. So we made it sets to sets just to give us the most generic capability. Now, what if you've got, as in Craig's case, multiple keystones and multiple service providers you either have to repeat the mappings in each keystone and that's what you talk about peer to peer and replication, et cetera or if you devise an attribute mapping API which is externally callable you would only need to set it up in one keystone and then any external keystone will be able to call the attribute mapping functionality and say, I've got this user with this set of identity attributes, okay, coming in give me the attributes that they map into and then that external keystone can also use that mapping. Okay, so in that way, in that way you could actually use the same mapping functionality by multiple classes and in fact, why you could go further you could actually turn attribute mapping into a separate open stack service. So in effectively, you're creating a VOMS as a cloud service. So you now have your VOMS as a cloud service and then anybody can actually make use of it. So that would be taking the mapping functionality extending it further. Now, there are multiple ways you can do user authentication. In Craig's way, they use their existing keystone authentication. The grid way is to use external PKI and they're authenticating users using PKI and then you can use federated authentication. We need, when we do virtual organizations to support all three, we don't want to limit ourselves to just one, we have to have a mechanism that can support all three ways of user authentication. That's an important thing to bear in mind. Okay, I think this is back to your... Yeah, so just to give you another example of how this worked in what we did for the G1 community cloud. I mean, obviously, we have these two different clouds here and we have this external VOMS, which is implemented as a simple MongoDB. So what happens first is that when the user requests a Swift operation, the keystone client will authenticate with keystone. And the keystone, since this is a VO project that the user is logging into when they want to get that scoped token, the keystone will actually go off to the VOMS. The VOMS will authenticate them as a member of that VO. And what happens is that they actually get authenticated as a role, as a role account. So the user gets mapped to this role account and then what the one keystone will do is it takes the list of all the other participating sites and it actually logs into all of the other keystones using that role account. And ultimately, if all that goes successfully, returns all that information back up to the Swift client. So that means that after the successful login, the successful VO login, they have all the service catalogs in an off token for all the sites that they're authorized to talk to as part of this VO. Okay, now when we actually talk about container access, the Swift client will do a list or an upload or download operation. And obviously what happens is that depending on what they do, you just have this typical sequence of operations, but the user at cloud A can access whatever containers on their local cloud that they're on, I'll read or write Ackle for, but they also have all the authorizations to go off to these other clouds based on their authorization. So we just had to add an extra argument to the Swift command line tool to be able to specify which cloud that you wanna go to based on your authorizations within the VO. But the user doesn't know anything about how they were actually authorized. The role accounts and the passwords that are used for them are not known to the users. And this was just simply the simplest way of demonstrating this for our customers in the US government, as opposed to having to do a full of PKI implementation or actually getting to the point where we could integrate the attribute mapping that David had been working on. Okay, and then also the local admins at each site, they have control over the Ackles on the storage container. So each site, each local admin retains control over how they're actually making their data assets, their containers available to the different roles within the VO.  They can grant or revoke access at any time. And the way that this was used in the disaster response scenario is on the left, you have all your different members from all your different sites or whatnot. And what the VOMS does is it maps them into specific roles, like something like medical staff or civic engineers or people that are first responders. And then at each participating site, the local admin will put those roles on the different Ackles for the different containers that they wanna make available within the entire disaster response effort. So that's basically the model that we use just to demonstrate this VO concept within something like federated open stacks. So the biggest lesson that I had from this is that we actually need to support other methods of data access beyond just simply storage containers. I mean, doing it for storage containers is certainly useful. But the Boeing guys came to me and said, well, this is great, but can we use the VOs to manage access to databases? And I said, well, no. The Telos guys came to me and said, this is great, but can we do it to manage RSS feeds? Because all of our disaster management tools that we've built are built on RSS feeds. So it got me thinking in the issue is, well, how can we use VOs to manage access to arbitrary application level services? So one possible way of doing this is that you have some sort of application service owner. And what they do is that they build their application and they have this VO PEP, policy enforcement point that they put in front of their service and they instantiate that as a machine image. Once they do that, they can register that endpoint with the Keystone service catalog. And of course, this is all just quick and dirty. We're piggybacking on the Keystone service catalog in some operational sense. You might not want to ever do that, but it certainly works for demonstration purposes. But so at that point, the Keystone has the endpoint and also whatever required VO roles or attributes that you want to associate with access to that particular application level service. Okay, so later on, when a user wants to use that service, they do the typical thing of authenticating the Keystone. Keystone asks the VOMs, they get mapped into their VO role. And so Keystone will return, what Keystone will do is it'll return the off token and also the service catalog, but it will also have the appropriate application service endpoints that that particular user is authorized to use within the context of that VO. So there could be scads of different application level services in that particular catalog, but the user only gets to know about the ones that they can actually use. Okay, and so then when the user actually uses that endpoint, the VO PEP, authorizes it with Keystone, they get the authorization back and then finally the call completes. But so this would be one way of at least demonstrating how things like database access or RSS feeds could be managed using the VO concept. There's also this capability called geosynchronization. In the geospatial world, there's this notion of, well, you have all these data producers that are producing maps and features on maps and they want to push all this data to people that already have maps. So it's called this geosynchronization and all that is based on RSS feeds. So we're hoping that we can demonstrate this in the context of the standardized geospatial function called geosynchronization, where whoever, only the people within a VO actually get the right data at the right time. Okay, so there's certainly a number of important but ancillary issues around VOs. One is how do you just create and terminate a VO? How do you join or leave a VO? Who gets to be the VO admin? Who gets to be the VOMS administrator? And just the semantic interoperability of VOMS. What are the resources, roles, and attributes mean? How do you do data publishing and discoveries? This inherent semantic interoperability problem. For people that are actually using this, the granularity of resource protection will be an issue. What we demonstrated with Swift containers is just access at the container level. What if you wanted to do it at the object level or at something smaller? At some point, the granularity of access is gonna become an issue. There's gonna be a trade off point where it's just gonna be too much overhead to protect small grain data. There's also this notion of trust federations. In the grid world, there's this thing called the International Grid Trust Federation. And that's this human organization whereby they specify how all these PKI certificate authorities are supposed to be operated. And once you demonstrate that you're doing things correctly, you get the stamp of approval and everybody else trusts your certificates. The same kind of thing could be done in something like a disaster response scenario where there's some international disaster response trust federation. And that's where all these agreements that need to be hammered out ahead of need could be done in terms of what are the roles mean? How do you authenticate certificates? Or how do you manage different credentials that have different activities from different sources? And of course that's where the federated identity issue comes in. So those are sort of ancillary issues. There's also a number of key design issues for views and open stacks. So we did this very basic prototype just to demonstrate the issue. And part of it is, well, okay, just using that as a driver to understand the design space for virtual organizations. If it hasn't become clear yet or not, the notion in OpenStack is that, well, we took the project concept and we added this other property to it such that we actually could be calling this virtual projects or distributed projects. So the question becomes, well, what's the right abstraction to present to the user for managing these collaborations across sites that need to be dynamic in nature? Then they can come and go, you can grant or revoke authorization. Okay, so how to store the VO attributes? Do we wanna have separate user entries with the VO attributes or having these general mapping rules? How to integrate VOs from multiple clouds? Come in on that first point. I think there's an interesting thing in scalability here because with the VOMS concept, you have one entry per user, which is fine for small VOs, but if you've got VOs of hundreds of thousands of users, you have to have a VOMS of hundreds of thousands of entries. If you go for the general mapping rules, you need one rule per class of user. And if you have whole groups of users that are in the same class, for example, everybody from this department in this organization, you only need one rule. You need one entry to cover that entire class. So there is difference in scalability there that if you go for the general mapping, in the worst case, you'd have one mapping rule per user to map the user's attributes into the VO ones. But if you've got a whole bunch of users that have got the same identity attributes, then you wanna need one rule to map a whole bunch of things and you end up with a smaller thing to manage. Yes, and that's actually the scalability bullet down there. Yeah, that's part of the scalability issue. Out of all these things, the scalability and implementations are gonna be important once we actually start running these in a particular size. Okay, again, the notion of an external VOMS database as opposed to this peer-to-peer Keystone database, typical thing that centralizes easier to implement, it's also easier to do a revocation of authorizations if you have everything in one place. If you go to a peer-to-peer approach, you don't have to rely on this third-party VOMS. It's not a single point of failure, but it does introduce the issues of having to do replication of data in consistency. Whether the check whether a user is a member of a VO or not, that has a particular overhead to it. Do you wanna have to check that every time or is there some way of only checking that when you need to? Again, if you're using the peer-to-peer internal approach, the overhead of doing a quick look up on a mapping table is not so big, but if you're making a call-out to an external VO service that's running in some external system, you don't wanna be making call-outs to that for people who are not actually part of the VO because that would actually put a lot of overhead into the actual login process of the user. Right, right. And then, as we mentioned already, that there's this notion of using VOs for arbitrary application-level services. So I mentioned databases and RSS feeds. There's other standard geospatial tools like web map server, web feature server, these kinds of things that we might be able to look at. There's another project that I'm starting on that might be able to use these things. Also, this notion of what should be at the application level as opposed to what should be at the infrastructure level. What should be in Keystone and what should stay, perhaps, up at the clients or actually in the application? That's another issue. We're running out a little bit out of time here, so I don't wanna go into excruciating depth. Who manages the VO? Again, are the administrators distributed or is there someone centralized? Again, I keep on hammering in this thing of infrastructure-level federation versus application-level federation. We can talk about federating containers or even federating NOVA's that if you're in one virtual organization, can you get authorized to spin up images at different sites? Or if you just request an image to be spun up locally, but somehow NOVA knows how to schedule it over there if it determines that's the better thing to do. And of course, scalability is important for all these issues. I think this is the last slide that I think that we have. So David's described the attribute mapping in Keystone and if you're following the Keystone project, I mean, that is a significant contribution, I think, to the direction of Keystone being able to support federation. We've got this. Aerospace has its external bombs. It's a very simple implementation, but the value of it is that, certainly has driven our understanding of the entire VO design space. And the question is, as a community, how would we want to pick where we put our resources further? What are the drivers that people are actually going to need for these things? Also, the European Grid Infrastructure, EGI, they've also have a group that has an initial OpenStack VO implementation.   If you're a member of a VO, you get access to everything within that VO. But I'm sure they're gonna be building out these capabilities in the not too distant future. I talked to them last in September, so they're probably working away on that. And then this Open Geospatial Consortium, Open Mobility Testbed Project, is just got kicked off recently and that's where I'm hoping to be able to use the VOMS notion to manage access to geospatial data in a standardized way by managing access to what are essentially these application level services. So with that, is there any other comments you'd like to make? No, I think it's any questions really if we've got time for none. One, two, yes? I'm sorry, could you speak? Well, we're not talking about any federation, we're talking about federation as a generic concept.  So there are multiple federations existing in the world today. You can make your Keystone service part of that federation by contacting the federation provider and saying this is a new service to add to your federation. Sorry? Yeah. Yeah, yeah, our code, it's actually part, it's actually, you can actually download our code, but it's not part of the core Keystone. It will be in the next release of Keystone, there's going to be, federation is going to be part of the core release of Keystone for Icehouse. So what we've been doing this week at the Design Summit is just scoping how much of the stuff that we've done which is all additional and you have to add in yourself will be core. But certainly, you can see over the next two releases or so, full federation will be becoming part of the core release of Keystone. At the moment, you have to take the Havana release and you have to take our stuff and plug it in. It's actually in GitHub under the name of my developer. So I can give you the URL if you contact me. It's Christie, it's GitHub something slash Christie. She just created it with her own name when she created the store. Oh, yes? I used to work with VOMS people when I worked in the grid world about five years ago, people from GAR actually, but not in the last few years. In fact, I thought that VOMS had more or less stopped its development, but maybe I'm wrong there. Right. Yeah, well I was in touch, yeah. Yeah, I was in touch with those people. We both used to go to the OGF and we were in contact with them then. Yeah, and I was at the EGI technical forum in September and talked to the folks that were doing the VO work right now. And actually, one last comment before this, but when I started this project, I was gonna do all this stuff. I was gonna take David's stuff and put that in the front and I was going to use this VOMS at the Texas Tech University that's part of the Open Science grid and do all this stuff, but as we got into the project, it's like it got descoped smaller and smaller and smaller till all that we, you know, the really core thing was just putting the extra stage in the Keystone pipeline and then being able to manage access to the storage containers, you know, in a very specific way just based on the notion of mapping a user's identity to the roll account. And, you know, just being able to demonstrate that actually, you know, sort of got the idea across to a lot of folks, you know, the demonstration went quite well. Then there was the US government shutdown and blah, blah, blah, blah, but... But I mean, you find that actually, when you talk to most people in OpenStat, they've not heard of VOMS anyway. Yeah, they don't. Yeah, but most of them don't know about VOMS, so that's why I came from the approach of, okay, ignore VOMS, let's see if we can build it into OpenStat without actually needing to invoke all of VOMS infrastructure. Yeah. I can speak off-linked with that. Have you looked at stuff you're not going to get? We're going to have to go and talk outside.