Welcome to Texas Heart Institute Educational Programs featuring cardiology in the time of COVID-19 pandemic. The title of today's presentation is Digital Medicine. My name is Van Rikrazier. I'm an international cardiologist at Texas Heart Institute and CHI Health Baylor St. Luke's Medical Center. Joining me as a moderator is my associate Eduardo Hernandez. He is an international cardiologist at Texas Heart Institute and CHI Health Baylor St. Luke's Medical Center and also Medical Director Diagnostic Heart Center of St. Luke's Hospital. Our special guests today are Dr. Tony Doss and Dr. William Kahn. Dr. Doss is well known to us. He trained at Texas Heart many years ago and gained expertise in the field of endovascular interventions, particularly related to peripheral vascular interventions. He combined two great experiences, one from being trained at Harvard Medical School in medicine and also in one of the leading institutions as far as cardiology is concerned, Texas Heart Institute and used his educational experience to his best ability and became internationally known in the field of endovascular interventions and particularly in peripheral vascular disease and education in cardiology. Welcome, Tony. Zvonko, thank you very much for that kind introduction. Our other guest is Dr. William Kahn. He's a good friend of ours and cardiovascular surgeon, cardiothoracic surgeon at Texas Heart Institute for many years. He's an inventor. He's a scientist. He's an experienced cardiovascular surgeon and heart transplant surgeon as well as an innovator in cardiac devices are concerned. He's currently a vice president of Johnson & Johnson Medical Device Companies and executive director for Center for Devices Innovation at the Texas Medical Center. He's also professor of surgery at Baylor College of Medicine. Billy, welcome to our program. Thanks, Zvonko. Glad to be here and looking forward to the session. So we are experiencing great pandemic with COVID-19 and significant destruction as far as health care services are concerned. This new pandemic is causing a major impact on all the segments of our society and also in medicine, particularly related to the hospitals, different specialties, the use of our intensive care units and also our staff and equipment. It is now the time where we must change our mindset how to offer safe and better patient care considering this COVID-19 pandemic. Virtual patient visits via telemedicine exist for decades and has become a necessity during COVID-19 pandemic. Technology is rapidly evolving with new wearables and new implantable devices to offer our patient good quality of care. We have true experts in the field of telemedicine such as Donnie Doss who has pioneered many aspects of this particular way of approaching our patient care and we would like to ask Dr. Doss to give us an insight on this particular issue. One of the important things that we have to consider and this information is very important and very pertinent. A national survey in proximity was carried on on a physician's view on the coronavirus pandemic and the review of this experience from us interventional cardiologists is very meaningful and very important. Here is the information on this particular review as far as coronavirus is concerned and how we have altered our patient care and how we have implemented telemedicine technologies in our clinical practice. This pie-shaped chart shows clearly that a great majority of us have embraced this technology and are using it on a regular basis to improve our patient care. However, there is a significant segment of our cardiology community that is still not embracing and including this technology in patient care as we can see roughly 19% have not initiated yet and 28% are moving in that direction. So, Donnie, if you don't mind, can you explain to us a little bit more in detail what is digital health? That's a great question. People often take the terminology of digital health and telemedicine, artificial intelligence they sort of jumble them all into one. The bottom line is that telehealth is the overall encompassing strategy for using digital technologies to deliver health care. So digital health specifically is taking physiologic parameters that you can get when the patient is not in front of you, whether they're untethered from the office or from the hospital and those physiologic parameters may be blood pressure, weight other physiologic parameters like oxygen saturation or EKG or rhythm disturbances and putting those into the connection of their care. So digital health is really taking those pieces of information and then using them for patients. So Dr. Doss, thank you for joining us. Please tell us what's the history of digital health and what were the obstacles to its development? First, I think it's important to recognize why I think that telehealth in general has really gained such popularity because if you look over the last several years, really from about 2013 on, there's been a decrease in the overall patient loyalty. The idea that a computer or an app would take over the idea of seeing a patient instead of coming in to see you, the patients would be more likely to prefer even being seen by someone over an application. And that started being a real thing and when you ask physicians, hey, do you think that a patient is going to come in and see you or rather use an app, people would say, no, for sure I have a great relationship with my patients. But we started seeing back in 2013, 2014, that there was a migration and companies like Teladoc and others really started making a big impact. In addition to the decrease in patient loyalty, two other things were happening along the way, which is one, there was a lot of investment going into the digital space. There were multiple companies that were creating first consumer-based products and now more kind of medical-grade products which were untethering that care and getting physiologic parameters for people. Then the third thing that happened, which was part of the perfect storm, was that CMS created codes called remote physiologic monitoring codes and Medicare and the services to pay for these devices became implemented in 2019 and then improved in 2020. But in addition, the FDA also created a pathway for approval for these devices. So the decrease in patient loyalty and increase in investment of technology and then the regulators basically being involved led to all of these things being more likely to be used. The big limitation prior to COVID-19 was the site of origination of telemedicine specifically had to be another physician's office or a nursing home or a regional hospital. A rural area had to be designated to qualify for telemedicine. Those rules are all gone right now and although there is a requirement for audio and or visual communication, the originating site, at least during this pandemic, has shifted from the requirement of being in a location other than the patient's home to allowing it to be in the patient's home. And I think that's kind of changed the game completely. Now the question is how do you implement these devices and some of the technologies that companies like those that Billy works with and that we work with to really make a difference? You can see on the slides here that the wearable technology investments have gone up dramatically. In the next slide, you'll see that CMS and Medicare have also created digital health action plans over the last few years, particularly adding these codes for remote physiologic monitoring. So the combination of these changes really all occurred prior to COVID and now the site of service has immediately changed. And so now people are able to implement all of this activity that's been happening literally since 2012. So Tony, if you don't mind, can you mention to us available telemedicine programs that are HIPAA compliant? Of course, we can communicate with our patients in many different ways, but some of those programs such as FaceTime and many other ones might not be HIPAA compliant. So how do we overcome this obstacle and what is the appropriate way how to communicate in a safe, reliable and protective way with our patients? Right, so that's a super important question. First of all, many electronic health records have an embedded telemedicine program that may or may not be turned on. So we use e-clinical works, Athena, others, that private practices and others use. They already have these embedded programs and in those, they're already HIPAA compliant. There are also the ability to use things like Zoom or Skype and those are HIPAA compliant if you have a business arrangement with those companies that you agree that you're going to use them as they're intended to be used. FaceTime, as you mentioned, is not HIPAA compliant. In fact, interestingly, you may not know this if you call a patient on FaceTime, even if you block your number, they're going to see your number if it's coming from your cell phone and they also get some information about your Apple ID. Hangouts is not a HIPAA compliant. We use a variety of things. We really try to use our internal electronic health record, number one, which is ECW. If the patients can't figure out how to use that because you know the different ages of patients and different abilities, then many people have gone to a free service called DoxyMe, which is HIPAA compliant because it's only able to be accessed by physicians using their NPI numbers and their license numbers. There are a bunch. There are over 120 telemedicine products that are out there right now, and they include things like UpDocs and TeleMed and Intouch and 75 Health. The number goes on and on, but the key here is that there are many avenues for using it, and the requirement is audio and visual up until some states have gone to telephone only, and that's now become almost every state. Greg Abbott here in Texas made the declaration that telephone alone would be used at this time, and in fact, one of the most compliant organizations anywhere, which is the Veterans Administration, has also adopted the telephone-only compliance for the use of telemedicine. So I think that people are just right now scrambling to be able to communicate with the patients and to be able to make sure that they have access to their physicians and try to keep them out of hospitals. There's probably no better time than to have a reliable form, but to your question, Eduardo and Zvanko, there are over 100 plus platforms. Many of them are embedded in your EHR, and some of them are just typical things they're using like Google Duo, Zoom, and Skype, and those are HIPAA compliant if you have a business associates agreement with those companies. Can I ask you a question? What are you, what are we using, and how do you see this being implemented? Are there any obstacles or difficulties that we have encountered? So we had conversations with a few companies. Some of them were pretty expensive for small private practice groups, or I'd say private practice groups of less than 15 doctors, and are more applicable for larger enterprises like hospital systems. Doxy.me seemed to be a very simple to use platform for us. For one, it doesn't involve having an application for the patient or a download. So it simply involves the ability for the patient to download email and click on a link which automatically allows the patient just to put their name in and it shows up on your dashboard as a patient waiting on Q to be seen. So it's very easy to use as an initial startup. I did notice the issues with FaceTime because I had some patients call me back when I couldn't communicate with Doxy.me, and that's one of the issues I think a lot of these companies may be struggling with, which is how much bandwidth they have or ability to absorb all the people that are currently using them. So you do have issues at times with loss of video or loss of audio that you have to work through. And my discussion with other physicians in our vicinity is that they are also starting to use these platforms with some degree of success. And then I have other physicians that I've talked to around the country that are using just telephone as it's been approved for them just because it's easy, seamless and secure. Thank you very much for this information. So Tony, let's talk a little bit about technology that is needed or essential to initiate good quality digital communication with our patients. What is available and what are you using? So that's a really good question. I think the thing is to try to tailor the technology that exists that's out there for each individual patient. So this is the biggest limitation that we have right now is to have reliable physiologic monitors for things like heart rate, blood pressure, listening to heart sounds, et cetera. And this has evolved in relative. We have instituted a variety of different techniques including wearable technology which is essentially a watch. I'm wearing one right now and this watch can monitor and evaluate for atrial fibrillation and goes through a patient portal and a physician portal that we can tell whether the patient has atrial fibrillation or not. It's also coupled with things like a Bluetooth blood pressure cuff and a weight scale for heart failure patients. And we were really poised to be able to do this as we started this practice called Connected Cardiovascular Care back in November of 19 before any of this happened. And the goal was to enroll patients specifically that had either atrial fibrillation or heart failure or even certain forms of vascular disease where some technologies could be used to assess wounds, et cetera, into a remote monitoring program. But really that's the limitation right now is to have accurate, secure, and reliable medical grade devices that will actually give us that information. So we're working with a couple of companies right now on developing accessories to this type of system. So we have the heart rhythm issues. We have the blood pressure issues. We have the weight, but we're also working to try to create more robust digital stethoscopes that are much less expensive than what's out there right now and also potentially, there's sensors out there like rings that can monitor oxygen saturation, et cetera. And ultimately there will be some form of a suite of devices that patients will get in an office visit and they'll ultimately go home with those devices and then we'll be able to touch base with them and be able to communicate with them in an untethered way. And that's kind of where this field is going and there's a tremendous amount of technology being initiated right now. So just wait and see. I think it's going to be a lot. Dr. Cohn, you were going to mention something. Yeah, I was just going to put in a plug for our ecosystem here in Houston, Texas at the Texas Medical Center, which for those of you watching is the largest medical center in the world. But there's a big innovation facility, TMCX, which is like an incubator where companies come to have access to the Texas Medical Center and the Texas Medical Center leaders. And every six months, a new cohort comes in and the old cohort goes back to wherever they live. And so we're on the 10th group and every other group is digital health. And to echo what Tony said, the number of companies that are working on HIPAA-compliant communication tools is mind-boggling. Half of every cohort have unique solutions for that. But also the number of companies that are coming up with unique sensor modalities, ways of gathering data to give you a more complete picture than maybe you could do historically by visiting with the patient. For example, as you alluded to, having what their blood pressure and weight and cardiac rhythm. But activity over the previous week, how much did they stay in bed? How many times did they go to the refrigerator? How many times did they urinate? We have digitally intelligent toilets that monitor how often you go to the bathroom and what the volume is. So the amount of data you have to analyze the patient may become much richer with this huge wave of new sensors that are being developed that are very unobtrusive, that make the smart home that you're living in that when you log on to that patient, you now have so much more to go on than you did when they sat in the waiting room for two hours and came in and spent 15 minutes with you. And so this COVID-19 pandemic has been a horrible crisis, but it may be the enabling thing that allows us to realize that this digitally rich interactions aren't just adequate to replace the traditional approach, but may be richer and may be the new normal. So, Billy, you are on the forefront of innovation. This is your primary job at the present time, I believe, or one of the jobs, among many jobs that you have. So are there things that you might be considering, or Johnson and Johnson, many other companies considering that, for instance, leaders like Tony are desperately needing to move forward with this technology? Well, so let me be clear. I'm here as a physician and as an innovator and I'm not representing Johnson and Johnson on this conference. I can tell you, because it's public knowledge that Johnson and Johnson feels the next big age is the digital age of digitally enhanced procedures, digitally enhanced surgery, digitally enhanced patient care, and that's something that we're looking at very seriously. As you know, we just acquired the ARIS RoboBroncoscope, the robotic platform, working with Google. We have the VRB robot, so we think digital care is the next big wave. Intelligent devices, intelligent implants, and closer patient monitoring. I personally totally agree. I think Johnson and Johnson, as is usually the case, totally has it right. If you look at any specialty, there are ways to leverage new advanced sensors to enrich the information that the physician has to make a decision, and sensors have the ability to look over periods of time with multiple measurements, which is much richer than any data you would get at one instant point of care in a clinical visit. So I think the way we analyze patients and the way we leverage sensor data is going to change and usher in the new norm for taking care of our patients. Thank you. So, Dr. Doss, this is probably one of the hurdles that has limited the adoption of telemedicine and it's been reimbursement. These hurdles have suddenly been removed with the current crisis, and we expect that the hurdles will be reinstated, but hopefully not as strictly as they have been in the past. And one confusing thing for physicians has been what exactly they can do, how they implement it. You've mentioned already the combined use of video and audio as a prerequisite that maybe is being lifted right now to allow better adoption. Can you tell us about coding and billing for telemedicine? Sure. So when it comes to coding and billing, there really is essentially what you're doing now is establish patients and new patients even can be billed through telemedicine. The codes are identical, so the 99211 through 215 for level of visit for established and the 99201 to 205 for the new patient. What's different here is depending on the type of interaction that you have with them, whether it's synchronous and real-time using audio-visual from the patient's portal, in other words, your own EHR, that just adds a modifier, 95. So it's exactly the same code, but with the 95 modifier. If you're doing something that's interactive, that's not through their actual patient portal where you have an embedded electronic health record-based televisit plan, then that's a GT modifier. So that is relatively straightforward. There's also an additional set of codes which are for online digital visits. The difference between these and the other visits are that the patient has to initiate an online digital visit potentially through a question that they ask through the portal. So if a patient says, hey, I need to ask you about my blood pressure medications or I want to review something with you, it's not necessarily a full visit. And these can only be billed by the MD calling back or the NP or the physician extender calling back. The codes are slightly different. They're listed there at 99421 to 423, depending on time, 5 to 10 minutes, out to 21 to 30 minutes, depending on how long you're on the phone and whether the patient was called by the MD or by the physician extender. So those codes exist for patient-initiated questions, which you can turn into an online digital visit. The other codes are the same established or new patient codes with the additional modifiers depending on how you did your real-time audio-visual interaction. So it's relatively straightforward with these two listed out this way. I think you can probably navigate the waters right now. I think your other question was the more important one, which is we don't know the answer to is when will these change and how will they change? So once audio-visual changes or the site of service potentially goes back to someplace other than the home, which I can't imagine that's going to happen now, then I'm sure there'll be a whole new set of codes that will be implemented that will really help, hopefully, to maintain access, reduce the risk, and to continue the telemedicine as we see it. I think the cat's kind of out of the bag right now, Eduardo, for going back to where we were before. Let me just echo that. Now that I'm with Johnson & Johnson, we have a lot of meetings and to get on an airplane and fly to someplace and stay at a cheap hotel for a day for a one-hour meeting, now all these things are online like we're doing now and we're realizing, man, you give up absolutely nothing. I think it's the new normal and I think some of the changes we're seeing now will be the new normal in medicine and I think it'll supercharge the efforts of all these digital companies by lowering hurdles for them, either reimbursement or regulatory, and I think this will be a tipping point for digital health. I agree with you. Tony, let me ask you about your personal experience in implementing digital cardiology. You obviously started before the COVID-19 pandemic, so tell me, when did you start and why did you start in digital cardiology in your practice? Yeah, so as you previously mentioned, my interest was in cardiac and vascular care and I've been doing that through VIVA and educational programs like that for many years. About 2013, I started realizing that there were so many reasons why untethering of care was about to happen and it was becoming more and more obvious that patients were less willing to come in to office visits. They wanted to do things like tele-doc and other things like that. I started working with a company that had a wearable technology, the watch I just showed you, that was going to be FDA approved for a very highly sensitive and specific assessment for atrial fibrillation and since 2013, I've been working with this group to try to improve the algorithms and the process by which this could be used. So I was interested in it for a long time and ultimately after working with them for several years realized that this is where things were going and in November of 2019, I actually made the leap to just go back into a private practice out of an employed situation and launch what I would think is almost the first really dedicated private practice to cardiovascular care using digital health as one of the main cornerstones. Continuing the coronary, the vascular, all the other things that we were doing, but integrate digital into a really strong portion of the practice and that was the birth of connected cardiovascular care and so now we're working with companies that have these devices and being able to tailor them and as Billy was saying, you want to have devices that have good, solid, accurate quantifiable medical grade conditions that you can actually use, not so much data that most clinicians are basically turned off. So we have a vendor that we like for atrial fibrillation and these issues we have good ones for blood pressure and weight scales. What you see in the middle on that slide is there are now sensor technologies that will assess the heat and sensors that will tell us whether patients are developing tropic ulcers. So we have a large vascular practice and if you have a clinical condition that's cardiac there's a set of sensors that might make sense but if your vascular practice requires evaluation either through sensors like this or others, I think that's where the tailoring really becomes important. So that's what we're doing now is trying to identify reasonable accurate HIPAA compliant addressable technologies that we can use for different conditions including someone with vascular disease or someone with cardiac condition that require specific technologies and that's kind of what we started doing when we launched the practice in November. Tony, what is missing on this particular slide is a stethoscope. So are there any things on the horizon where we might be able to also have a digital stethoscope that's relative and expensive and the patient can put on the areas of interest whether it's hard or whether it's carotids or whatever else is needed. Absolutely. I think that this technology is evolving it's pretty expensive right now. You can see a couple of examples of digital stethoscopes out there that are really pretty well made. There's some less expensive ones where you can work with physicians that are maybe at the bedside or maybe a home health agency that's monitoring the patient and that's uploaded through Bluetooth or Wi-Fi. But I think ultimately what's going to need to happen is that patients will get an inexpensive relatively reliable audio based stethoscope that either the insurance companies or honestly the practices will just give to the patients for their in-between care and the price will come down on these technologies because honestly if we had the ability to listen to the heart, listen to the lungs, listen to a carotid and understand what the vascular system looked like and the patient could use sensor technology to figure that out and that could upload into their EHR we would get most of what we get in the office for sure. I think the only thing that's going to be lacking is on the vascular side at some point we're going to probably need a little bit more robust assessment of vascular chur, like for instance Pocas or point of care ultrasound things like that where we might want to get more than just a simple diagnostic. But honestly when I tell the companies that are developing these and said we don't need Ferraris right now we literally need some very simplistic devices that will be able to tell us whether the patient has valvular heart disease, whether they have problems with irregular heart rhythms, whether their breathing is right or whether they have fluid that we can listen to or they have other conditions that we would otherwise pick up in the clinic. I think that's where we've got to start not with a really high fidelity issue right now. That's one thing that could be incorporated into home health. You maybe are looking at a new technologist that is able to visit the patient at the home we have vascular devices now like a butterfly for example. It is basically a cell phone and a probe and you can do imaging and that's possibly something you could send out to the patient to visit if you want to look at pulmonary pressure or you want to assess ankle brachial index or do a limited vascular study. It's a great great point. Dr. Cohn do you have insights on that question? Yeah I just wanted to say you talk about Ferraris. One Ferrari that I just recently saw and this is another plug for our ecosystem Johnson & Johnson again I'm not here representing Johnson & Johnson but Johnson & Johnson has a series of facilities called JLabs which are very fertile incubators for startup technology to come and develop their play and have access to major medical centers and a guy here in Houston at the Houston JLabs Jason Bang has a company that is a small implantable microphone using advances in digital wizardry and digital sensors that listens to every heartbeat and determines how many of them have an S3 how many of them have an S4 it aggregates all that data puts it to the cloud and plots your course and heart failure and whether you're ready to detune and anticipate long before a weight gain or a change in lung compliance or any of those things when you look at technology like that that's where the world is headed not just wearables but implantables or even non-touch a chair furniture that has sensors in it toilets that have sensors in it as we more people are aging in place and trying not to go into the hospital that's what the future is going to be and in select patients it'll be something like the pulmonary artery sensor that's been so successful that Abbott has or implantable microphones that anticipate decompensation and heart failure and are monitoring your rhythm and sending it up to the cloud and doing big data analytics to help us take care of our patients better and these things are happening right now and as we've all been saying perhaps this COVID-19 pandemic crisis is going to accelerate those efforts because now we see how palatable and how usable health can be applied and this would be the natural extension of that and I think we will look back on this period right now as a tipping point in all that technology well this is very interesting and exciting on a little bit lighter note Billy can you move your head a little bit closer I wanted to make sure that your hair is blue and I have to congratulate you because it matches well our Texas Heart Institute background on the PowerPoint presentations so well this color is called Cooley Blue and no I have four sons as you may know and we decided solidarity to show our commitment to staying at home and not going out in public and so when the five of us stand together we look like a pack of M&M's well thank you very much I really admire all of you guys Tony I really appreciate your leadership your expertise and your willingness to work with us on our educational programs Eduardo thank you very much as well thank all of you for your very valuable contribution to the THI program on digital medicine in the time of COVID-19 and beyond now for those of you that have tuned in to this program please join us for the next program on cardiology in the COVID-19 that will be coming soon so for all of you guys that participated in this program stay healthy thank you very much can I say one more thing I also have a daughter but she didn't dye her hair because it would take too long for it to change I didn't leave you out thank you bye


And finally, the big one, this law removes the requirement of parental consent to medically transition a child. If a court determines it's in a child's best interest, they can sterilize that child and cut their dick off without the parent's consent, even if both parents don't want it. That's why she wants to get my son to California. Now consider this. This is a Texas judge that just voluntarily ceded jurisdiction of this case to California. Does that make any sense? I mean, if you were operating the way you might think the judiciary operates, would that make any sense? No Texas judge would ever see jurisdiction deprive a child of the protection of Texas laws, right? They wouldn't do that. What's happening here? There is a large movement among the judiciary at the federal and state level to cooperate to transition children. And this is going to be the future of what you're going to see that's up against you as a father. Right now you're up against state courts. What's going to happen in the future is you're going to be up against multiple state courts as the judges collude to take away your parental rights. It's going to get much worse before it gets better. So I don't know why this keeps happening to me. I was just talking to Michael Foster about this yesterday, like the transgender thing. I turned out to be like the tip of the spear on that one. I'm the first one to have to fight it. I had to lawyer up, money up, had to go to jail for a couple of times, I got to fight this thing. Well now, and I don't want this to keep happening to me, it looks like I'm going to be the first test case for this law because my kid's going to be the first kid that's going to do this. So I've had lots of public interest law firms contacting me now about how to take this into federal court and take it up to the Supreme Court because it's a blatant violation of the full faith and credit clause. But I'm just going to have to be the first one to do it again because nobody else is doing it. All these other fathers that are going through this are submitting to it.  Okay, they're not wanting to go to jail. Hey man, a lot of things worse than jail, you know, what's jail? Three hots in a cot, infinite leisure time to finish my book. I mean, jail ain't that bad, lots of things worse than jail, right?  So but a lot of these men are very intimidated so it looks like it's going to be me again on this one and I intend to go up to federal court and if I'm going to do, when I do something like this, California will regret it. It will have political ramifications in the federal judiciary and it probably will result in actual federal judicial taking of some of their courts. You'd think Texas would be fighting this. You think, you haven't heard about this, right? The governor, I sent this to the Texas Attorney General, I sent this to the Texas governor. Have you heard anything about it? Not a word.  Texas ain't the state of the Alamo anymore, right? Texas wants me gone because, you know, I cost the governor Texas 100,000, 200,000 votes. You know, going up against Beto now, he's very nervous, right? And I'm telling people what he did, nothing. He did nothing for my son. He has the power to direct the agencies. He did nothing for my son. They want me gone and if this case gets transferred to California, they have a powerful rhetorical weapon now. They can say, you know what? It's not my problem. It's a California case. Why are we talking about that in a Texas election? And that's the game they're going to play. They're already starting to play it. I got news for you. I predicted this and they ain't going to be able to do that. This is a principle that I've learned from my dad. I think my dad learned it from reading Machiavelli. And it's a simple concept. People fake friendship all the time. But people don't fake their enemies, right?  People rarely fake that. So you judge men by who their enemies are, not by who their friends are, right? And if a man's hated by the right people, he's a good man. Trust worthy man, right? So this is a basic principle that I believe our sons have not been taught. Our sons, I think, have been taught to be systematically naive in their dealings with other people. And so I'm going to apply this principle to myself and how I approach things with my sons.


Elder god would say chicho.  Doesn't mean that you should also do end of story This is not endorsement of any kind and it never will be Salute


All right welcome on back here separate traders here this Thursday afternoon September 7th shortly after 2 30 p.m Eastern time great to still see Chuck with us here just before I saw Alan and Leda and all of our students and members joining us inside Our live trading room Kathleen Mike Jeff all included joining me right now So great to know that at least they could hear me loud and clear great to have all his back on our social feeds here Facebook live linked in Twitter YouTube etc Sticks was looking good just a moment ago and still in until it Started not looking too good just ended up making lower highs and snapping under support seemingly there off of 195 dropping off a bit so hey heading into the afternoon We're not as likely to follow this type of trade right now But you know what we'll do is actually really be quick here folks just go right from top to bottom at this point I don't have my spy graph here. Just give me a brief second with that and add the spy chart Just to show you how the markets are holding up So I mean they're holding up, but for as long as they've been flat and they haven't really made a big pop-up higher It leads me. I think we might see a little shake back down So be careful for that going into the funnel, you know 90 minutes this day But you know again, let's just go right from top to bottom see what we can get here So the sticks we're gonna pass on now given how much this just pulled back and dropped off So let's see what else we can get The A E B trade nasty drop just a moment ago right and popped up earlier today for us So a nice stock from the morning session, but again same deal here as we said on the other one We're not going to be as likely to follow this type of trade now at this point that's better order book at least but Yeah, we want something more near the highs if it's you know looking for a push-up higher or a stock coming off bad news Perhaps near the lows so I doubt these stocks. He could short pass on those BDRX pop and drop already. So again that one will just pass on THTX I guess it's kind of a hold in here, but skimpy order book for the price Not really too too much a fan of that Hey, we had a really good morning here today folks took a little bit to get a couple of bounces around 10 o'clock 1015 But they paid off Fubo Little slow, you know my stance on Fubo just from the last couple of days. We've been talking about it You know hey, it's a nice level one to level two stock And that means that it is really tradable for literally every single one of us here So what could be wrong about that right? Well, don't get too antsy looking for that 50 cent move dollar move You know hey this popped up like 40 50 cents today thus far But it took a while to get there looking at the order book. It's you know pretty liquid I'll tell you I'd say the same thing if you've been watching callouts today for myself on TL our Y to Ray I'm obviously very hopeful on this over the next week two weeks perhaps even next month, but It's very slow trade. So as hopeful as I am. I'm not really expecting that 50 cent push dollar push right look at this thing. It's very slow. Look at the order book Extremely liquid now brings me back to the so fi days so if I Very slow moving stock back after the pandemic when it was like a five dollar stock four dollar stock then It was even slower. So Yeah, you don't really want to get stuck watching the grass grow on Fubo getting back to that At least it's near the highs and you know for right now. We'll put it on our main list Path so rich and Chuck calling out path earlier talking about it at least and you know, rightfully so is great trade pushing up How can we not call it out or looking for the move up higher, right? So, you know rich was chatting me earlier saying like this thing is just the most annoying trade ever Just having a really tough time breaking 18. Well, he ain't kidding. Look at that thing. So I Just checked.  Let me just loosely check You know, we'll just see if there's any historical level to work with here and again Like I'll even go back on a weekly or even a monthly chart at times So I just eyeballed it, you know, I really just did a quick zoom in on like the last time It was around these prices here and I saw that there is some good continuity here 1801 weekly low 1806 weekly low, okay 1805 weekly low. Okay. Well, it ain't exactly 18 1805 or so Even at that it still had a tough time breaking that level, but I'm just saying like even recently here It tried to crack that historical as I'll label it had a tough time pulled back So even with this pullback now, it just doesn't look as attractive here heading into the afternoon. So You know, I'm gonna put it on our side list I won't lose sight of it at least here heading into the afternoon But right now just keep it keep it there not really on the main watch list just yet Alright, so the market potentially pulling back we had this on our pre-market watch list at least socks with AMD and the video potentially dropping off this could go inversely to those the markets now dragging back down a little bit more here last few minutes, so Yeah, I mean, this is trying to go back up again. I don't mind slipping this on there It's not exactly near the highs but in the event where the markets continue to stumble off This would be a pretty good trade. All right, so let me get my spot here. There we go So see if there's anything looking pretty strong going up. I saw a few sideless stocks like AFRM moving up nicely earlier I got stopped out just now on the MMS OS like literally just now on the VWAP line there So I was looking for a bounce on pot stock ETF MS OS here it pushed up really nicely from the morning. You see all my pretty lines there but just before it was slipping and Actually once again rich chat of me saying like damn MS OS and I knew right away something happened So it slipped down. So this could be a nice little healthy pullback. We'll see and under and over Super clean entry nice bounce, but just now Stop me out. So is it possible it can bounce back up later on? I mean, absolutely I mean if it just tanks right from this very point breaks a lower low then I'd say not I'm gonna put this on our side list. I'll come back to it if I need to with the path trade Yeah, two on the main list two on the B list there the side list What else we got if there's any other stocks looking good folks type them in let me know a bunch of low volume crap here Really, I mean just a bunch of these I'm clicking on right now ASAN flip this back to a daily chart looks like just across this week making a nice recovery Yeah, a bit of a gap it had back from Was that Tuesday into Wednesday? So, you know at that at least just ended up Kind of recovering today. I It's not really trading enough volume on the order booked for it to really tempt me YAS once again EOSC this stock actually has been on our radar quite a bit I forgot how much of a hit it took this thing just dropped off quite a bit the last few days So, you know, it's possible you might see a little recovery here and there up over 5% right now Again, I'll come back to it. We're gonna cherry pick the ones on the side list. Just kind of see what looks best Definitely, that's the most tradable. I'd say So let's hop over to the loser side here seeing if there's anything looking just as good if not better with the market stumbling so YXT not much happening there me I shortable Not much happening there blackberry right not bed-bath beyond blackberry Dropped off nicely from the morning session here, but this is really flat. It's possible. It could break lower It's right off the low of the day right now at 463, but even with that. I just want something that Clearly is trending down. This is down percentage wise. It is flat the last hour hour and a half years. So Yeah, I mean I'm not as jumpy to follow this just yet See if there's anything looking better my AI trade beautiful I don't know if anyone had taken this with me earlier today. I was screaming it from the mountain tops looking for a bounce from 2588 Under and over like we always go over in class and in traders talk and in coaching We always talk about this outside of the trading room where we have a lot more time But under and over I'm very thankful that it pushed up pretty nicely afterwards I mean hey if it stopped me out it would stop me out and you know focus on that same level over time If not be today, then going into the end of this week, but either way it worked out pretty well You know I'm gonna hang on to that trade my trade on it is an option call for October What's the date October 20th calls and? I'm in 209 per contract just enough so yeah for right now. It's like kind of flat here I'm gonna just skip over going into the afternoon is like a day trade just keep your eyes out on it over time It's as volatile as as it has been with the earnings that came out overnight So I was kind of taking a stab at it looking for just a bounce and seeing where it can go from there And we'll kind of just work it out going forward, but you know over time I think this could become a good swing trade again soon All right, so really outside of that at least we got two stocks on the main list We got more on the side list so far Yeah, let's see if there's anything looking good just anything else Not necessarily All right, so we'll check back in on a few sideless stocks here AFRM at the high of the day up like 1% but Not only is that at the high of the day But look how good of a recovery this thing made to where it's now back up pretty much up towards the highs from this week Yeah, I'm gonna put this on our main list actually AFRM really nice trade so far All right, cool. So that's a good one now folks again if your Grant Kathleen Charles Jeff Barbara Let me know if there's anything else that you'd want me to look at here before we wrap up Check out my Benzinga pro here just to show That sticks making a little push right now. It's up 54% right now. So I'll check in on that trade again Yeah, it's looking like it's trying to go up a little bit. Let's see what the chart looks like That was the one from before right the one that stumbled off from like 195 tank I'm not as jumpy to this trade right now. I'm gonna pass on it The MSOS I am gonna put on our list Just because it hasn't completely tanked from that VWAP price. It stopped me out of my trade just now, but If that was so bearish then we would have seen a lower low at this point, I feel And if we haven't seen a lower low yet, then you're telling me there's a chance So, you know as soon as we finish up this meeting I'll reassess myself and see if there's you know an ample moment to jump back in right away Or if I want to wait a little bit longer But right now what we'll keep it on our list and you know what this EOS is still moving up. I like it Yeah, so EOS MSOS both gonna put on our main list now This path trade it's been annoying. It's been really tough around this 1805 now as we'll label it historical level So to say there Trend doesn't look bad and it's a very liquid order book. So I'll tell you what that's actually gonna kind of lean me towards Putting this on our list too. So I'm gonna giving mood All right, so hey, let me know if there's anything else for all of a sudden social media Facebook live LinkedIn Twitter I don't know if you call it Twitter X nowadays. What are we doing now Twitter X Twitter X YouTube Facebook, I'm gonna call it Twitter Etc. Let me know if there's anything else left that you don't want me to look at but I Think that's gonna wrap it up here. I'm gonna type my email address in just a little early for all of a sudden social right now Josh at c2 trading comm is always the email. Let me know if there's any questions or trades you'd want to go over Last one here HK IT. This was like the crazy. I Don't even know how else to describe it.  Oh You want to know something interesting? How about this before we part ways? I got a little show and tell right now a little food for thought. I don't know I have no idea where I'm going with this. Honestly. I just want to show you this So you can kind of formulate an opinion yourself. I don't know so MSOS pot ETF. It's a US Pot ETF. Well, what that means is MJ was an ETF that we've been following for years and this has been the main pot ETF that we've known and trades the most Volume and all that good stuff. Well, this was pumping up a little bit But not nearly to the extent of MSOS and I start thinking I'm like, all right. Well, you know, what? What makes up these ETFs? What makes up MJ? What makes up MSOS and all these different tickers and all that? So I looked into MSOS. There's a bunch of different, you know tickers that are OTC that make it up over the counter stocks Okay, well, I take a look at this one MJ and MJ this Stock rather an ETF makes up 52% of it. Okay, what the hell's this? I click on this ETF I guess never heard of this one MJ us. All right. Sounds like a US pot ETF similar to You know, at least the the other one MSOS. All right. Well, you take a look here GRWG and then I'll also just type in that MSOS and I'll show you what I was gonna Try and show you here. There we go Blackrock liquidity funds treasury trust institutional the hell I never heard this ticker before All I know is it's black rock, right? All right. Well, the ticker is TTTXX. That's the one I wanted to show you TTTXX So over the last few months this stock has pushed or this ETF has pushed up from 502 to 520 that doesn't look like a whole lot Take a look at what this thing has done over the last year. This thing went from your pennies 13 cents 8 cents all the way up to 520 What? There's a lot more to it, I'm sure don't get me wrong, but why how?  Well, typically, you know, these these firms like black rock Vanguard, you know They typically know a lot more than we do and a lot sooner than we do so It leads you to wonder why well when you take a look at all the other pot ETFs MSOS All that they clearly haven't been moving up like that has Well, perhaps this could be the calm before the storm in terms of like, you know federal legalization all that stuff Well over time be on the lookout for this be on the lookout for all the different, you know pot stocks and whatnot You know, I was talking about it from the beginning of August But that was just something I looked up earlier today. I never saw that ticker before I'm like That's pretty crazy go from 13 cents or 8 cents all the way up to $5 20 cents That's TTT XX it's a black rock Cannabis marijuana pot, whatever you want to call it now it is ticker. That's the ticker right there Right the more you know, that's all a little show until they're to wrap up this meeting So for all of us inside our live trading room, hey Rich will be on the mic in about 15 minutes I'll be in the chat up until 3 30 as always if you see something say something for all of us in social media Facebook live LinkedIn Twitter YouTube etc be a friend tell a friend make sure to subscribe right to our YouTube channel that being at youtube.com Forward slash cyber trading you otherwise if you wanted to join over students myself rich and of course the man himself I was so inside our live trading room just scan that QR code on the top left of the screen get you access to our live Trading room and we look forward to seeing you there. Alright folks talk to you all soon


AutoLite and its 96,000 dealers present Suspense. Tonight, AutoLite brings you love, honor, or murder. A suspense play produced and edited by William Spear, and starring Kathy and Elliot Lewis. Hello, Alice. Yeah, this is Helen. Look, kid, I'm not going to be able to go to the dance after all. Well, Harry works the late shift of that taxi of his, so I've got to stay home and look at the four walls again. And so fed up sometimes I feel like leaving this house and Harry and the whole works. Believe me, the only reason I have it is because I need the money to do it. Seven years of wedded bliss. All I need to show for it is this stinking place. If I ever get my hands on a thousand bucks, I'd get out of here so fast that it'd make it. I said if I had a thousand bucks, I'd get off Harry so fast it'd make it. Hold it a minute, Alice. Somebody came in. Is that you, Harry? Yeah, me. Came home early. Well, if you expect to find dinner at this hour, you're going to be disappointed. It's Harry, Alice. Honey? What was I saying? Oh, yeah. Honey, cut the conversation. Something's happened. What? I said cut the conversation. Here, give me that phone. Alice, Helen will call you later. Goodbye. Big man. Baby, you know what I got here? $12,000. Yes. In a moment, Kathy and Elliot Lewis and a tale well calculated to keep you in suspend. Wilcox, where do you spend your summer vacation? On the open road, half my hapless pedestrian enjoying the remarkable performance of my auto-light-stay-full battery, the battery that needs water only three times a year in normal car use. Ah, what sweet-stay-fulman. In the direction, Wilcox, you mean sweet-full-fillman. Ah, you walked into a trap, Hap, Milad. The auto-light-stay-full battery brings sweet-stay-fullman because it has three times as much liquid reserve as batteries without stay-full features. That's why it needs water only three times a year in normal car use.  Ah, but Hap, the auto-light-stay-full battery lives an incredibly long life. According to tests based on SAE life cycle standards, for example, this famous battery is 70% longer average life than batteries without stay-full features. I shouldn't have started all this. Oh, and speaking of starting, my friend, the auto-light-stay-full battery has plenty of starting stamina and dependability. So, friends, see your friendly auto-light-battery dealer tomorrow and ask for an auto-light-stay-full battery for your car. And remember, you're always right with auto-light. And now with love, honor, or murder, and the performances of Kathy and Elliot Lewis, auto-light hopes once again to keep you in suspense. That's what I said, baby. $12,000.  Helen, I found this wallet in my cab just a few minutes ago. Wallet? Here, look inside. Open it up. Harry. $100 bills. They're 50s and 20s and 10s. More than $12,000. $12,000. Now is it all right to come home early? Why, gee, I... I don't know what to say. Take it easy, baby. Don't get too excited. I gotta give it back. Give it back? Look at the name inside the wallet. Thanks to a regular customer, Sidney Walker, the news commentator. I take him around town every afternoon. He calls up for me personally. $12,000. But as far as we're concerned, it's not worth $12,000. If I don't turn it into the company before they can throw me in the pen for five years. Then why did you bring it home? I don't know. I guess I shouldn't have at that. It's just that I never saw so much money before. I wasn't so far away. And I just had to bring it home and show it to them. You had to bring it home and wave it under my nose. That's like you.  No, give me the money, Helen. Walker's gonna remember leaving the money in my cab. They'll call up the cop. How long ago did you find the money? 20 minutes ago. I came straight home. So what's the hurry? What? As long as you're home, why don't you wash up? I'll fix you some supper. I'll make you good supper. Well, I don't know. I ought to get back. Come on, honey. Go on. Wash up. Go ahead. Give us a chance for a little while to kind of pretend the money belongs to us. Yeah. This coffee really hits the spot. Why didn't you eat, honey? About the $12,000? Well, someday we'll have it too, baby. We've got it right now, Harry. Well, yeah, for about five more minutes. Well, I guess I better report in now. It's been almost an hour. Walker will be calling the company pretty soon. I want the money to be in the safe when he does. Uh, are you giving me a wallet, Helen? How do you know Walker will call the company? We've been through all of that. He'll call because he'll remember the ride with me. We went over a bumpy stretch. Easy for his wallet to pop out then and probably remember that. He could have lost it in so many other places. He may not even think of the cab ride. And if he doesn't, won't you feel like a fool? Well, it's better than cooling my heels in some jail. I know what I'd do if I were you. What? I'd take the chance that Walker wouldn't remember that he wouldn't call. I'd keep the money. Well, Helen, stop that. You. You've always been afraid to take a chance. You'll always be content to be nothing. I'm sorry I ever came here with the money. Now, give it back to me. I'm turning it into the company. You love me, Harry. Well, that's got nothing to do with it. No, it has everything to do with it. If you leave this house with the money, when you come back, I'll be gone. Now you're talking like a sack. I mean it. Come on, give me a little wallet. Here it is, Harry. I'll bet you will. Well, I gotta be going. I'll see you later, honey. I'll be home later. Doesn't matter when you come home. You won't find me here. Fine. You stop talking like that. So long, Helen. It's really goodbye, Harry. I mean it. You. The first day we were married, you've been twisting me around your little finger. Only because you know how much I love you. How much I need you. I guess you'll never stop doing that, will you, Helen? Well? What do you want me to do? Nothing. Leave everything to me. This is Mr. Sidney Walker's personal secretary calling. Don't tell me that cab Mr. Walker already hasn't got there yet. I sent it out hours ago. Oh, no, it got here all right. It's not that. We're trying to locate Mr. Walker. I just wanted to find a chance you might have heard from him. What? Oh, no, if he got his cab all right, why should he have called us? Oh, of course you're right. Well, thank you very much. Well? He hasn't reported anything yet. I bet that'll make sense. $12,000 is a lot of money, even for Walker. Give me the phone book. Who are you going to call now? Mr. Walker, of course. We've got to find out why he hasn't reported losing his wallet. Oh, look. He'll give me a good reward. You're not going to do anything. Oh, what I'm doing? I'd like to speak to Mr. Walker, please. Well, he's not in right now. This is Mr. Walker's housekeeper. Could I take a message? No, no, this is a personal matter. Where could I be certain of reaching him? Nowhere until 10 o'clock. 10 o'clock? Yes, that's when he does his nightly broadcast, you know. Oh, yes, of course. And what time does he reach the station? Five minutes of tail. Uh-huh. You're quite sure he'll be there then. Oh, my heavens. You could stake your life on it. That's been a schedule for a good many years. Who's this talking? Are you a friend of Mr. Walker? Oh, yes, yes. My husband and I have known Sidney for a long time. Well, as long as you're a friend, I can tell you Mr. Walker has a busy evening ahead of him. Oh? He lost his wallet an hour or so ago. It contains a lot of money. Enough for a payment on a house he's wanted. I'm glad. I do hope he finds it. Oh, he'll find the wallet all right. He's out looking for it right now. Do you have any idea where he might have lost it? Oh, yes, he certainly has. And he's might be disappointed it hasn't been returned. He knows who found the wallet? Well, he told it to me. He knows who should have found it. But that is, he didn't tell me the rascal's name. I see. He's too kind and he's ego-ing. That's what he is. He's always been that way. I'd have called the police right away. I don't want to cause any embarrassment or hard feelings, you know. So first he's going to look everywhere else he's been this evening. And if it still doesn't turn up? Well, he says that this fellow he suspects hasn't come by the apartment to return the money. By the time he gets home, then he'll report it all right. Oh, but my gracious, here I am grabbing away a mile a minute. I'm sure all this doesn't interest you. Oh, it does. Of course it does. Now, if we want to reach Sydney before he gets home, you say he will arrive at the radio station just before 10. At five minutes to 10 on the dock. Well, then we'll contact him there. Thank you. Harry. That was his housekeeper. About what she said he knows he left the wallet in your cab. See? I told you. Yeah, but he hasn't reported it yet. Mr. Walker is a very fair man. Well, I'll have time to bring it down to the company. Harry, how many times do I have to tell you we're not going to bring it down to the company? Come on, we've got to decide what we can do between now and midnight to keep Walker from reporting his loss. He just said he knows he left the money in my cab. That's right. Well, then what is there to decide? Smiling about. Was I smiling? Thinking of something. Of what? You know, there is really only one way in all the world to keep Walker from telling about that wallet. What are you talking about? The only way to keep Walker from telling would be to kill him. Now look, we've got to decide what we're going to do, so let's stop the jokes. Do I look like I'm joking? No. No, you don't. There's that gun in the dresser drawer. Never been used. They could never trace anything to you. Helen, what are you talking about? You've got to kill him. It's simple arithmetic. But how can I? He's never done me any harm.   No, but Helen, look... Listen to me, look how simple it is. At five minutes to ten, you can be absolutely certain that he'll be entering the broadcasting studio. If you were waiting outside for him, there are so many quiet places you could take him with a gun. Yeah, but Helen, listen to me, even... even if I wanted to kill him, I couldn't. I am a nerve.  It doesn't bother their appetite. They still get a good night's sleep. No, I know, no, not you. Not you, Harry.   Oh, Helen, please, I can't. You can. Harry, you can do it for me.  Harry, what time is it? What? What time is it? Well, it's ten after nine. You couldn't bring the money back now even if I let you. Fuck, why? What time should you have reported in with your cab? Well, here, past eight, what difference? So that's it. See what I mean? If Walker reports his loss now, you're in trouble no matter what you do. They'll know you were thinking of keeping the money in their eyes that's almost as bad as really keeping it. Yeah, but I... You know the rules of that company. You're supposed to inspect your cab after every fare.  They'll blast for you. You'll never get another job. That's why you kept me here. Ain't supper for me. Stalled around. You figured that one out too, didn't you, Helen? Yes, I figured that one out too. Walker will get to the station at five to ten. You've got 45 minutes.  That'll be your alibi later. Stop at all the usual places and talk to the boys and act as if it were just another night. What about my schedule? I'm supposed to be in it at eight thirty. You can always tell them that business was so good you couldn't come in. Shall I get the gun, Harry? Auto light is bringing you Kathy and Elliot Lewis in love, honor, or murder. Tonight's production in radio's outstanding theater of thrills suspense. If you drive across the Arizona desert, take special note of the barrel cactus. I have it. I have it. It's a desert phenomenon. Holds water like a well. Well, well, that reminds me of the auto light staple battery, the battery that needs water only three times a year in normal car use. I was afraid it would. No need for fear, lad, because the auto light staple battery has plenty of starting stamina and dependability. You see, this super battery has a fiberglass retaining mat protecting every positive plate. That keeps the power producing material in place and means extra long life.  Oh, pardon me, Hap, but SAE life cycle standard tests show that the auto light staple battery gives seventy percent longer average life than batteries without staple features. Well, there's no use talking. You're so right, Hap. The thing to do is see your friendly auto light battery dealer tomorrow. Ask for an auto light staple battery, the battery that needs water only three times a year in normal car use. And remember, you're always right with auto light. And now auto light brings back to our Hollywood soundstage our stars, Kathy and Elliot Lewis in love, honor, or murder. A tale well calculated to keep you in... suspense! Is it you? Big pardon? Oh, I'm sorry. I thought it was my husband. What do you want? Well, you must be Mrs. Blake, Harry's wife. Yeah, what do you want? Say, have I talked to you on the phone before? Why? Your voice sounds kind of familiar. You may have. Who is this? This is Dave Harris over at Peerless Cab Company. Peerless Cab Company? Yeah. Say, have you seen Harry in the last couple hours? I know. He's out working. We should have been through with his shift at eight thirty. Twenty-five to ten already. That's not like Harry. Twenty-five to ten. Is something wrong? Well, I don't know. One of Harry's regular customers, Sidney Walker, called up a few minutes ago from a restaurant on the way to that broadcast, is... Yeah? He thinks he left a wallet in Harry's cab. I said he thinks he left... I heard you. Well, there was $12,000 in a wallet, Mrs. Blake. Walker says he looked everywhere else that he might have lost it and it hadn't turned up. He just wanted me to contact Harry as soon as possible in time to look in the back of his cab. Hell, if Harry should call, I'll tell him to get in touch with you right away. What did you say before? Huh? Walker called and told all this... before he started for the station? Uh... What... What are you talking about, Mrs. Blake? Nothing. Nothing. Walker called before he reached the station. Harry'll be waiting at the station to kill him. But now Walker's already told him that maybe Harry took the wallet. Everything will point to Harry. They'll arrest him ten minutes after he's killed, Walker. Harry'll tell him everything. He's weak. He'll try to blame me. He'll tell him I made him do it. I gotta call him back. I gotta stop him before he kills Walker. Twenty-five to ten. Twenty minutes to reach him. I got to reach him. Twenty minutes to reach, Harry. Twenty minutes to call him back. I told Harry to make all the regular stops. Everybody remember him. Oh, let me think. He'll stop for gas at the taxi garage. Yeah. Yeah, I reached him there before. I remember he was written down someplace. There's that little book. I'm shaking so I can't... Here. Here it is. Two, six, five. Five, two. This... This is Mrs. Blake calling. Harry Blake's wife? Yeah, Mrs. Blake. Has Harry been there yet to get his gas, I mean? No, he hasn't been here all night. Say, what you been up to? What do you mean? I just got a call from the main office to hold him here when he does show up. Mac, Harry always told me you were his friend. Well, sure. Well, he's in trouble, terrible trouble. I haven't got the time to explain. But if I don't reach him right away, I don't know what'll happen. Well, I don't know what I can do, Mrs. Blake. Well, you can tell me the names and the telephone numbers some of the places that cabbies like Harry stop off at. Well, he... While they're on their runs? Well, sometimes a boy stop at Cuss's Coffee Shop on 6th Avenue for coffee. What's their number? Uh, wait a minute. It's a state 8-5-7-0. Yeah, state 8-5-7-0. All right, all right, where else? Oh, maybe if he had a few minutes to spare he'd go on a Frank's Diamond on Washington Boulevard. I don't know the phone number there. I'll look it up, I'll look it up. Where else? Of course, he might go up to Union Headquarters to chew the rank with the boys. Union Headquarters? Yeah, where else? Look, there's lots of places he might stop off at. You gotta reach him by 10 o'clock, huh? Well, that doesn't leave you much time. No, it doesn't leave me much time. I'm trying to locate Harry Blake. Has he been there tonight? He hasn't. Well, if he does show up, would you tell him to call his wife? Tell him it's very important. Sure, Harry, isn't it? Could you just kind of look around again? All right, if you're sure. But listen, if he does drop in, tell him to call home right away. Yeah, the cab driver. He was in your place? Just a few minutes ago? Can you call him back? Please, it's terribly important. I know you're awful busy and everything. Hello? Hello, hello? 15 minutes to 10. Only 10 minutes, I gotta think, I gotta think. The radio station's on 6th and Main, that's two miles away. Maybe I could get to Harry before Walker reaches there. I've got to try, I've got to try, I've got to stop him. Driver, when I got in your cab, you told me you could get me to the radio station in 10 minutes. Oh, I didn't give you no guarantees, lady. I'm doing the best I can. But I've got to get there before 5 or 10. You told me you could make? It don't do no good to holler in my ear, lady. There must be some way to make better time. Can't you take side streets or something? It's the traffic, lady. But you told me. I know what I told you, but I didn't figure on so much traffic. Please, hurry. Yeah, yeah. I'll pay you anything if you get me there. Oh, dang. Oh, hurry. Oh, what's wrong?  What time is it now? Oh, about 10 minutes 10. Don't tell me about. I want the exact time. Exact time? Seven minutes to 10. Seven minutes to 10? Seven minutes to 10? How much farther is it to the station? Well, I can tell you this. We're not gonna make it in two minutes. And there's no need to make it at all. Take me home. Just a minute or two before 10. He'll be coming home soon. Wanting to hide under the bed. Quimpering like a dog. I'll trace the killing to him fast enough. They'll come here. They'll both away. And the money too. Wait a minute. Why should they come here? Why should they get the money? I have to take the blame for what he did. I didn't commit the murder. Yeah, I could get away. They would look for me too hard. Why should I take the blame for what Harry did? Want to report a murder. What's that? You're too late to stop the murder. You can still catch the killer. Now, just who is this killer? His name is Harry Blake. Drives a taxi cab. Taxi number is 365. You should find him somewhere around the radio station. Just who did they kill? He... He killed Harry?  Why did you get back here so soon? A good cabbie can make time when you ask him. You killed him? It's just after 10 o'clock. Turn on the radio and find out. Oh, you're talking on the phone. I'll turn the radio on for you. Harry, the police will come here and look for you. They'll catch you, Harry. Can anybody see you do it? Did they try to...? It's brilliant analysis, Nate Walker. Tonight I'm going to bring you a report on a recent interview I had with one of the most prominent industrialists of the world. Oh, I saw one of yours. No. I shouldn't know. I actually thought you went through with it. Have the nerve. I didn't kill him. But I did have the nerve. You gave me the nerve. That pep talk before I left, it was very true. What are you talking about?  Those we have very worries. Then why didn't you kill Walker? Because I got the thinking about what you said and how right you were. And the more I thought about it, the more I realized. Realized what? That I was headed in the wrong direction. What do you mean by that? Put that gun away, Harry. In order to rid myself of the one thing in the world that can destroy me, I had to come back here to you. Helen. Hello. This says the police department, isn't it? I heard her speaking to you as I was opening the door. Yeah, yeah, sure. It's the police department. What's going on there? What were those shots? Wasn't my wife reporting a murder? Yeah, she was. She gave us all the information except she didn't tell us who was going to be killed. We just see officer until this very moment. She really didn't know. Suspense. Presented by Autolite. Tonight stars Kathy and Elliot Lewis. Well, Harlow, I hope you and your Autolite Stay Full Battery have a wonderful vacation together. Thanks, Hap, and the same to you. See you August 31st when Suspense will return to the CBS Airways, same time, same stations. Until then, we'll say so long for Autolite makers of more than 400 products for cars, trucks, planes, and boats in more than 28 plants coast to coast. Now, if you're planning a vacation motor trip, be sure to have your car carefully checked at your neighborhood service station, car dealer, garage, or repair shop. And if your Autolite-equipped car needs replacement parts, ask for and insist on Autolite original factory parts because they're engineered to fit together perfectly, work together perfectly, because they're a perfect team. Best wishes for a happy, carefree summer. And remember, friends, you're always right with Autolite. Remember, Thursday, August 31st, Suspense returns to the air with the first of a series of stories that is, as we say... A tale well calculated to keep you in... Suspense! Tonight's Suspense play was produced and edited by William Spear, directed by Norman MacDonald. Music for Suspense was composed by Lucian Morrowek and conducted by Lynn Murray tonight. Love, Honor, or Murders, an original play written for radio by Larry Marcus. Kathy and Elliot Lewis can be heard in their new Columbia record albums, Happy Anniversary, and Happy Holiday. Don't forget, Suspense returns to the air Thursday, August 31st. You can buy Autolite Stayful Batteries, Autolite Standard or Resista Spark Plugs, Autolite Electrical Parts, at your neighborhood Autolite dealer. Fitch to Autolite! Good night! This is CBS, the Columbia Broadcasting System.


Hello everyone thanks a lot for coming today. I hope you are having a great time at the conference. I couldn't make it to the end of the day so what you're going to see next is a version of this talk that I recorded a couple of weeks ago just for you. That said, I am hanging in the chat right now so I'm looking forward to the questions and the discussions that we're going to have together. Let's get started. Today we're going to talk about Stratus Retim which is an open source tool that we released here at DataDog a couple of months ago. We're going to see why we built it, how you can use it, and some background on more advanced usage as well. My name is Christophe Taffani de Roper. I work as a cloud security researcher and advocate at DataDog. Feel free to send me any message, email if you want to discuss this, if you want to challenge some of the things that I say today. And yes, today we'll start by introducing a few things around detection engineering, purple teaming, then we'll move to some of the pain points of purple teaming in the cloud which led us to build Stratus Retim. So we'll see how we built it, what it looks like. We'll continue with a small demo and finally we'll discuss a few more advanced use cases. I want to stop for a bit on how as an industry we work on detecting malicious activity. A few years ago, we used to use mostly indicators of compromise, things like hashes, IP addresses, binary names, things like that. Because the idea is that it's pretty easy to share those across organizations and that if you share that with partners organization, it's easy for them to prevent some attacks because an attacker that is going to reuse the same infrastructure, the same binaries, is going to get caught more easily. And as time goes by, we noticed that hashes, IP addresses, domain names are pretty easy for attackers to change. If you think about binary hashes, it's very simple to change. A single byte changes and the whole hash is not the same. For IP addresses, it's the same, domain names, etc. And this figure here you see is called the pyramid of pain. And basically, as you move up this pyramid, things become much harder to change for an attacker. And if you think about the tools or the way that they work, maybe how they persist, how they exploit data, this is something that they're typically not going to change easily. And for defenders, it's a bit around the opposite. If you think about a hash or an IP address, it's pretty simple to detect. If you think about tools and behaviors, it gets harder. But generally, as an industry, we've been moving towards detecting not only hashes, IP addresses, domain names, and this kind of indicators of compromise, but also more behavioral things. And so there are a few models that exist to model how attackers work, what behaviors they have. The most famous is, of course, Mitre attack, which has also a version for cloud and for containers. There's also the Kubernetes threat metrics from Microsoft that basically is focused on Kubernetes and containerized environments. Now, on purple teaming, for sure, it's a buzzword. So I just want to stop to demystify it a little bit. A lot of organizations used to have a blue team and a red team that wouldn't really work together. And the way it would work is that the red team would simulate some attacker behavior and the blue team is left to detect it and to prevent it. And purple teaming is really about making these two teams collaborate, exchange information, empower each other. And that's what I want to use as a definition. And I want to also underline that purple teaming is supposed to be a mentality, a way of working and not a team by itself. So for this presentation, I want to define it as empowering defenders to understand, reproduce, and detect common attacker tactics. And you will see that also sometimes abbreviated as TTP. Now, the way that this usually works, let's say I want to detect a specific kind of attack. I'm going to first try to reproduce it to see how it works. I'm going to see what kind of logs do I have, what kind of alerts can I leverage anything that I have to detect that. So I'm going to craft this detection. And I'm going to iterate on this feedback loop to make my detection better. And the main issue that we see is that reproducing the attacks is pretty hard in the context of cloud environments. If we take an example, let's say that we want to detect when VPC flow logs are removed. VPC flow logs is a construct in AWS where you can have some net flow data on your network traffic. So it's pretty interesting for an attacker to try to remove that so that they can cover the tracks. So if we want to reproduce that, first thing we do, we create a VPC in AWS. Then we go ahead, we enable VPC flow logs. And this gives us a state where we are ready to reproduce the attack. First step, we will reproduce it.  That's the theory, right? But if we go to the AWS console and we do it, it looks like this. We create a VPC, we give it a name, an IP range. Then we go to flow logs, we create a flow log configuration. Then we are asked for a few things. Where do we want to send the logs? The destination log group name, but we don't have any. The IAM role to use, we don't have any. So we go to the documentation. We see that we need to use an IAM role that has a specific policy so that the VPC flow log service can write to our logging things. Okay, then we see that we need to attach a trust policy to the role that allows the VPC flow logs configuration to assume it. And at this point, we are not really doing what we wanted anymore. And in the end, what we notice is that we spend a lot of times setting up the right cloud infrastructure, configuring things, and actually very little time testing our threat detection. So that's an issue because it means it's hard to iterate on this cycle. It's hard to reproduce the attack techniques. It's hard to make sure that you can clean up everything you need. So that's really around these two challenges that we build strategy threat team. The first one being how do we handle complex testing prerequisites in AWS and Kubernetes? And second one is, as an industry, we have to be very honest that the cloud and containers are still a pretty new topic. So we don't have a lot of good data on incidents in the wild. So for defenders, it's hard to say what to prioritize. And this brings us to strategy threat team. And I like to say that strategy threat team is something that allows you to help with purple teaming in the cloud. Strategy threat team, first, it has a very nice logo. It's an open source project that I like to pitch as atomic threat team for the cloud. Atomic threat team is a project by Red Canary, which is focused on endpoints. And it allows you to reproduce some common attack techniques very easily. And we try to be the same for the cloud. It's written in Go, so it's a single binary that you can download through homebrew or directly from GitHub and run without installing anything else. It's packaged with a few cloud attack that comes with the binary. And currently it supports AWS and Kubernetes. The first question that we had when building it was, what kind of attack techniques do we want to package? And the philosophy what we ended up is two things. First, we want all the attack techniques to be as code. And as you'll see in a bit, they are defined as Go code and Terraform code. Then we want to be very opinionated and intentional about the attack techniques that we have. What we want is we want them to be actionable for defenders. So as a defender, you should be able to go to the strategy threat team documentation and to understand things to better understand what it does and how the attack techniques in the cloud work. And second thing, we want them to be threat informed. Essentially, we don't want attack techniques that are super new, that no one uses, and that no one should care about. So we try to prioritize a lot attack that have been seen in the wild, that are used by pentesters, by retimmers, by offensive tools. So again, strategy threat team is really around these two things. First, a catalog of cloud attack techniques. And in some sense, it's similar to Mitre attack, except that we are not scared about going very deep and being very specific to a single cloud provider like AWS, whereas Mitre attack is more trying to get the common ground and not trying to be too specific to a single service. And second thing is to have an easy way to reproduce the attack techniques in a live environment. So typically it's going to work like this. You're going to take strategy threat team, point it at your AWS account or to an existing community cluster, and you're going to use it to reproduce some attack techniques. Currently, strategy threat team has 23 AWS attacks and six Kubernetes one. You can see the full list on the website, strategy threat team dot cloud. It has the user guide, the reference of all the attack techniques. On the left, you will see they are sorted by platform. So you have some for AWS. And if you scroll down, you will see them for Kubernetes. Now, let's stop for a minute and have a look at a specific attack technique, see what it looks like, and how it's implemented. This one is going to be about stopping a cloud trail trail. Cloud trail is a way in AWS that you can log all the API calls that are made to AWS. And it's super important for defenders. So it's interesting for an attacker to stop it so that your defenders are basically blind. First thing you will see if you go to the documentation of an attack technique is the name, the platform. When you will see the mapping to my attack, you will see a description about what it does, how it works. And finally, you will see some detection leads. And the idea here is not to give a precise rule. It's more to say which log sources you have at your disposal to try to detect that. First thing you will see then is the Terraform code. And this Terraform code is completely hidden. So as an end user, you will never see it. But it's how it's implemented. So this Terraform code is going to handle the prerequisite infrastructure that you need to be able to reproduce the attack. Typically here, the attack is around stopping a trail. So first, you need a trail. And you need an S3 bucket to which the logs are going to be sent. You need to have the right role, the right permissions, so that this works smoothly. And the goal of that is to encapsulate all this complexity so that you can just say, go ahead, prepare this infrastructure for me. And I want to be ready to reproduce the attack. Again, this is totally transparent. So Stratus Stratim doesn't mess with your Terraform version. It doesn't require you to install Terraform beforehand. And it uses a Terraform wrapper that is written by HashiCorp, which basically downloads its own Terraform binary and takes care of everything you need. Then we have the attack as code that is written in Go, so in an imperative way using the AWS or Kubernetes SDK. And this is really what the attack is about. So now that I have my trail ready, I know that to reproduce the attack, I need to stop it. And in terms of lifecycle, an attack technique is going to live through three life cycles. First is going to be called. This is the initial state where you didn't start to work with it. Then it's going to be warm. And warm is the state where your prerequisite infrastructure is ready.  Then once we are ready, we can go ahead and detonate it. And detonate is about reproducing, executing, simulating this attack. And this is just stopping the cloud trail trail. There are a few tools that can be quite similar to Stratus Stratim. So I just want to comment on it. And there is a page that explained this into more detail. So Atomic Red Team is more focused on endpoints. Leonidas by F-Secure is a great tool. It's a bit more complex to set up and also has more features. Pakoo is more of a penetration test framework. Gardity Tester is a big bash script basically that you can use to test Gardity, but it's specific to Gardity. And Cloud Goat is more of a set of vulnerable scenarios that you can deploy yourself. Now it's time for the demo. Let's start with the GitHub repository. On the repository, you will have the source code, the instructions to install it. So typically you can install it through Homebrew. You can download one of the pre-built binaries that are available for Linux, Mac and Windows. Or you can also use the Docker image that is listed here. There's also a website, Stratus Stratim.cloud. And if you go there, you will see that you have a user guide. You have frequently asked questions around the permissions that you need, how it works with its state, how can you package your own attack technique, and some questions around the design choices. Then there is the comparison with other tools that is a bit more detailed than what we did in the slides, a guide on how to contribute. And in the user guide, you will find some installation instructions, some examples, some workflow on how to use it with AWS, which is just quite simple as we'll see in a bit, and some references around the commands as well as a troubleshooting guide and some more information on how to use it programmatically. And we'll see that in a bit. Now the interesting part is around the attack techniques reference. So if you go there, you will see first the listing of all the attack techniques that we have for AWS for communities. You have some more background on the philosophy of what we expect from all these attack techniques. So we want them to be granular, we want them to emulate actual attacker activity, and we want them to be self-sufficient, meaning that we should be able to reuse any of these attack techniques without making any assumptions around the state of your AWS account or Kubernetes cluster. If you click on one of the supported platforms, AWS or Kubernetes, you will have the listing that is organized around my through attack tactics. So we have credential access, defensive vision, discovery, execution, exfiltration, persistence, privilege, escalation, and if we select one of the attack techniques, let's say we want to have the one that exfiltrates an Amazon machine image. We'll have the platform, the Mitre attack mapping, the description, the command line that we can just copy paste in our terminal, and some leads on how to detect it. Now, if we go to our terminal, we'll see that I have stratus version 170 installed. First thing I can do is to do a stratus list to see the attack techniques that I have packaged in my binary. If I want, I can be a bit more specific. I can do stratus list for a specific platform. This will give me only the attack techniques for AWS and also for a specific Mitre attack technique. Let's say I want to see the attack techniques I have for AWS for persistence. Now, if we do stratus status, we will see the status of each of your attack techniques. So here I can see they are all called because I didn't start to work with any of these. What I'm going to do now is I'm going to select two attack techniques. So this one, exfiltration of an AMI, and I'm going to warm it up. Now, what's going to happen is that stratus team is going to instrument Terraform under the hood. It's going to do a Terraform apply of my prerequisites. And here the prerequisites are going to be just an Amazon machine image that I need to be able to reproduce the attack. All right. Now it's telling me my AMI is ready. I'm going to warm up another attack technique, this one, which is going to be around backdooring an S3 bucket policy. Okay. So during the warm-up, it's going to create an S3 bucket. And during the detonation, it's going to backdoor the bucket policy. I see that it has created my S3 bucket. And if I do a stratus, stratus, I will see that these two attack techniques are now warm. So it considers that they are ready to be used. They are ready to be designated. If I go to my AWS console and I look at my list of Amazon machine images, I will see that now I have an AMI created by stratus red team. Similarly for my S3 bucket, if I go there and I search for them, I will see I have one bucket created by stratus red team. Now we'll go ahead and we do, instead of a warm-up, we're going to do the detonation. We'll do stratus detonate.  Similarly for the other one, we're going to detonate this one. And it's going to exfiltrate my AMI by sharing it with an external account. So again, if now I do a stratus stratus, I will see that my two attack techniques are detonated. And if I go back to my AWS console, if I go to my Amazon machine image and I look at the permissions, so I need to refresh it first, I will see that it has been shared with an external AWS account ID, which is the simulation of my attack technique.  I see that it has been backdoored to allow the access from an external AWS account as well. I know to clean up all this infrastructure, I just need to do stratus detonate of these two things. Sorry, stratus clean of this guy and this guy. And now I see that the attack techniques are called. So I am confident that I don't have any infrastructure left in my AWS account. And that's it. So what we have done is we have reproduced two attack techniques very easily. We use the warm-up, then the detonate command. But if we just do stratus detonate, it's going to warm it up and then detonate it. And in the end, we just do a clean up and it will be the same. It's going to remove all the infrastructure and make sure everything is clean up. Now that we have a good idea of how to use stratus strat team, I want to touch a bit on some more advanced use cases that you can do with stratus strat team. First one is going to be around continuous detection testing. So if we look at the typical logs pipeline for IWS, it's going to look like that. You have a cloud trail trail that is running, logging to an S3 bucket. You have something that is going to forward your logs to a logs management solution to a CM. The logs are going to be parsed. Your detection roles are going to run on these parsed logs and you're going to get some alerts. The issue with that is that it's pretty sure that at some point something is going to break. Maybe your trail is not going to log in anymore. Maybe the permissions on the S3 bucket are going to be messed up, et cetera, et cetera. So how can we test that? And the idea is to consider all of this as a black box to poke from one end using stratus strat team. And from the other side, try to use the API of your CM, of your logs management solution to confirm that an alert is created. And we can do that using the programmatic interface of stratus strat team. Basically, you can use stratus strat team as a go library. So if you do go get github.com data doc stratus strat team, you can use it from your code. And there is some automatically generated good documentation as well. So it looks like that. Basically, you are going to say get the instance of stratus, get the attack technique that is called AWS something. Then you can say, at the end of my code, I want to make sure it's going to be cleaned up automatically. You warm it up. Finally, you can detonate it. It's basically the same as we did in the demo, except that we can do it programmatically as well. And once we have that, we can basically poke from one end. So detonate the attack technique programmatically. Stratus strat team is going to inject a unique identifier in the user agent. And then we can go ahead and look in our CM if we have an alert for what we expect that corresponds to the logs with the same unique identifier. So typically in cloud rail, you're going to be able to see the user agent. And this allows it to correlate the specific run of stratus strat team with the alert that we get. And once we confirm the alert is there, we are happy because we know that we triggered an attack, a real one, and that we have alert that we expect. It's going to look like that typically. So you detonate the attack technique. You query the security alerts of your CM, of your logs management solution. And once you have it, so typically it's going to take a few seconds for Kubernetes. It's going to take more around five to 10 minutes for cloud trail. You're going to see the alerts. You can mark it as read. You can archive it. You can close it. And at this point, you're happy because you confirm that this is working end to end. What's nice with it is that you can run inside a continuous integration. You can run that on a nightly basis. And you can have some kind of dashboard where you say, today I tested these attack techniques. They worked. They didn't work. You can have some alerts based on that. So I think it's a nice way to make sure that your most important attack techniques are being detected as you expect and to be alerted when it's not the case. To conclude, around what's next. So first thing is that we want to add some additional attack techniques for AWS, for Kubernetes. We want to add support for Azure and possibly for GCP. And finally, we are super eager to hear about the community in terms of what attack techniques we should add. So typically things that you can see in the wild or things that you see used by red teams, by pentesters, by tooling. So the best way to contribute is to open an issue on the repository and to propose the attack technique. And then we will work on implementing that. So thanks a lot. I'm super happy that you showed up today. I'm hanging out in the chat to answer any questions, to discuss anything. So feel free to ask questions and go ahead and visit the website, the repository and feel free to send me a message if you want to discuss anything. Thanks a lot and have a great day.