And it's so an artist might sign to a label and be getting 15 to 18 percent of the income, but the money that's paying back what's spent, let's just say it's a million dollars, so I can make my point right out of their 15 percent of that income, they're paying back the million dollar budget. It's not coming off the top, which is really technically what it should be. The money should come off the top and then they should split whatever the agreement was. I do believe that you get what you negotiate. So if you negotiate and accept 15 to 18 percent, that's what you're going to get.


Hi folks, Jesse here at Mountain View Dodge. Beside me I have a 2019 Ram 1500 Classic Edition with our sport hood, the express package, all the monotone, 20 inch blacked out rims, heated mirrors. Inside, with our bench seat, tow package, 8.4 screen. On the back end you can see it with the bench seat, folds up, we still have our storage in the floor for anything you need to have it. Again, the black offset accents everything with their black badging carries it all the way through. We have our backup camera, class four hitch receiver with our four and seven pin dual exhaust, matching bumper, mud flaps, and again inside, there is lots of room in this classic truck. Again folks, you need to have this ram into your stable of vehicles at your house. Come on down to Mountain View Dodge and see me. My name's Jesse.


As a tier one research institution, we're among the best. It's an extremely exciting time to be a student here. It's an exciting time to be a faculty member here. Only about 2% of all universities in the nation achieve this. As a tier one research institution, you'll get your hands dirty in real-world engineering experience and make incredible positive impacts on industry and on society.


Good morning everyone. Let me begin by saying that I'm going to draw on work done with several co-authors and the usual caveat applies. Any distortions of their work are entirely my responsibility. Just to put the context of this, the other presenters are talking about very specific things in South Africa and I think my presentation is really providing a background context within which their more detailed analysis and particularly James's takes place. I'm going to be concentrating, although we're talking about emissions, I'm going to be concentrating on CO2 emissions throughout this talk. I won't say much more about that. I was wondering how I'm going to get through all of this and one way is to get the chairman to preempt what you're going to say. So let me start with what Constantine's already said about what I call South Africa's climate change dilemma. It's the same dilemma that all developing countries face, but in many ways it's a much sharper dilemma because the problems are much bigger on both sides, on both the development and the climate change side. So South Africa faces enormous development challenges, some figures there for you. Obviously the consequences of these immediate things, unemployment, poverty, inequality, the social, the moral, the political consequences are enormous and on the other hand South Africa's a a dirty energy user. As Constantine said, it's a big emitter. It's actually the 13th largest emitter of CO2 in the world in absolute terms. It's got accounts for 1.4 percent of global emissions, although it's 0.7 percent of the world's population. So it's a country with very large development problems and very large emission problems. Governments in Copenhagen committed itself to 42 percent reduction against baseline in 2025, but this is very difficult to manage both technically. How do you do it? And one of the things we'll be looking at, that he has with carbon taxes, I think with Allison, the issues of electricity generation, which main source of these emissions, it's technically difficult to do. And how do you manage this without damaging development efforts and so on? That's the problem we all face, all developing countries face, is there a trade-off between these things and governments as in South Africa talk about green growth and green jobs and trying to put a positive side to it. But it's a level less is a problem. And there's a political challenge. Obviously, we get from a lot of the work, there's the usual business challenges, concerns about competitiveness, if you internalize the externalities of carbon emissions, firms say they're going to be disadvantaged. Unions and labor are concerned about reduced employment and we're concerned also about impact on the poor of any measures. One way of looking at this is very aggregate level. Just a little decomposition that we've done. Looking at the emissions per head, you can break that down in a fairly straightforward way into what the World Bank calls the carbon CO2 intensity, how much CO2 is related to the energy use, how much energy is related to the GDP you produce and what is your GDP per capita. And we can break down into these components. And you can see South Africa, it emits nine tons of CO2 per person per year. That's high relative, if you look at the bottom of this table, developing sub-Saharan Africa is less than a ton. So it's an outlier in Africa. And you can see that this is broken down. Mainly, if you compare South Africa with the rest of the world, the world average income, it's pretty much the same income per capita. It's much dirtier. The energy they use issues more CO2 and they use more energy per unit of GDP that they produce. One can play around with these figures and do things quite simple to say, if South Africa had Japan's technology, what would its emissions be? And you'll find it goes down roughly by 75%. So if it had Japan's GDP, it would be producing three and a half times as much emissions per head. And you can get some idea of this aggregate. What's driving this? Now, this decomposition helps us to think about low-carbon development. Just a very quick general impression we get on the right-hand side there. As income per head rises on the right-hand graph, you can see energy use goes up. To produce more, you need more stuff, more inputs and particularly more energy inputs. And we see a long-term, sorry, we see a cross-sectional set of data. You'll see how that's a fairly straightforward relationship. On the left-hand side, as income per capita rises, we tend to see energy use getting dirtier. The energy used is dirtier and after a while it starts coming down again. Whether that's because of efforts, technological change in developed countries or because of efforts to clean up the environment or whatever we need and get into. But there's that sort of relationship. If we go back to the decomposition again, we can see the development targets, basically we are talking that entail, and no matter what we think about it, they entail rising GDP per head. And therefore, to reduce emissions, we either have to reduce the energy intensity of production, produce things more efficiently in terms of energy, or we have to have cleaner energy or both. We have to do, we've got no choice about that. It's an accounting relationship. This requires, we make technological changes. We find more efficient energy technologies or cleaner energy technologies, which can take time. It's something which, for many developing countries and for South Africa, the technologies are not necessarily developed locally, and it's a question of technology adaptation. So the other thing is to change the composition of production. Can we switch to producing goods that require less energy or producing things that have cleaner energy? To examine the potential for this latter option, we did some work looking at disaggregating this decomposition a bit more and going into the actual products. What is the carbon content of products produced in South Africa? What are the possibilities of shifting around? This is actually something that's important for thinking about what the impact of carbon tax is going to be, which sectors will they hit will depend upon which ones are almost carbon intensive. Now there's a fairly standard way of doing this. We did some work, you can see the reference there. Fairly standard way using input output analysis. We want to look at the carbon content of products, which is what most input output analysis focuses on. We use a technique which also distinguishes between products and sectors. Sectors are fairly aggregated things and they may produce a wide range of products, each product having a different kind of carbon content. Then we look at the relationship between carbon and exports, the sort of thing that the business sector is concerned with, carbon and employment, the sort of thing that unions and carbon and households, the sort of thing that we're concerned with with poverty, does impact on the poor. The methods needn't go through this too much. We're basically using a supply use table method, sort of extension, actually a precursor in many ways of input output where we pump into the system, we pump actual carbon, primary things, crude oil, coal, natural gas into the system, and we trace it through the whole production system so we can get the direct and the indirect carbon content of products. It's not your carbon content, it's not simply how much you use directly, but it's also the carbon embodied in the other things that other stuff use. Some quick point slides, and here I'm going to take a leaf out of Lunt Pritchard and just flip through some slides quickly giving you an impression. The carbon within products, we find obviously the primary fuel producing things are the most carbon intensive, transformed energy, electricity is the highly carbon intensive, and then we've got a whole lot of products down there. One of the most interesting things that came out of this is the margins, in other words the costs of getting the grid from factory to the market are actually one of the main sources of carbon inputs, and you can see that come for 7% of carbon within products. If we look at carbon and exports, we actually find business in a way is right to be concerned. Carbon intensive products are also export intensive, the large, you can see other mining there which includes gold mining, it's a large share of total exports the size of the bubble, and it's got a high carbon intensity and it's export intensive, most of its output is being export. So raising the price of carbon does affect exports. If we look at employment and how we're doing a full employment multipliers, looking at an input output rate, it's actually less important. The big employers are not the same as the big carbon intensive producers. When we look at households, we see that household emissions are less than the national average compared to production sectors, but looking at the goods they consume, looking at the goods they consume, we find it's very uneven. The poorest 20%, the carbon consumption, if you like, is 0.3 of a ton of CO2 which is equivalent to some very underdeveloped country like Benin. If we look at the richest 4% on the right-hand side, close to 40% of CO2 per capita. So there's a very uneven distribution of carbon. So the question then comes when we look at the distribution of the carbon intensity, it depends, what we find is the lower income are mainly getting it because of the foods and fuels they use, upper incomes are many because of the services and they consume a lot more electricity directly and that's where it's coming from. So our conclusion, from this whole thing, we find a big range of carbon intensities across sectors and across products. The major exports do have a high carbon content that raises issues of if you're introducing a carbon tax, should you have a border tax adjustment to try and equalize things so that selling stuff locally and actually taking the tax off when you export rather like we do with VAT. Those kinds of issues come up to try and maintain competitiveness. I think there's something James is going to go into. The key employment sectors tend to be less carbon intensive and the middle income households tend to be more carbon intensive, although the high income households consume far more carbon than others. So the concerns about a carbon tax hitting poor households are maybe not quite as sharp as we might think they would be. That's pretty much what I want to say.


Fy hoi, ac fyddwch i gwybod ar gyfer am ymweld y cyfraddwyddau, ychydigodd ar gyfer amddangos, ychydigoddau am y cyfraddwyddau, a oedd yn cyfraddwyddau rych fy modell ar y cyfraddwyddau. Felly, ymwyng James Callahan. Fy hoeddwch ar y cyfraddwyddau ar gyfer cyfraddwyddadau. A fyddwch eich ymddangos yn ei cyfraddwyddau yn ymddangos. Yr hyn yn ei ddweud. Fy hoeddwch Fyhaith Feidderstyn. Fyddwch i'n gallu meddwl am y twind. I'm the head of engineering at control playing, we're a cloud native security consultancy, we're hiring at the moment so if you want to work on cool problems with cool people, come and have a chat with us, if you've got cool problems that you need solving, come and have a chat with us, and I'll head back to James, but thank you for joining us this morning. Cheers, Rick, and like I said, we are a booth SU 57 and we'll be here around for the rest of the day, so yes please do come talk to us, we're all friendly and would love to chat. So what are we going to talk about today? This is a kind of a narrative talk, we're going to take you on a journey, first of all we're going to start off by trying to understand together what zero trust means, it can be a bit of a buzzword, so we're going to understand starting from a threat modelling perspective. Once we have developed our zero trust philosophy, we're going to use this to build a high level architecture. Once we have a high level architecture, we're going to create a detailed threat model, dive into the details and iterate on our controls. We are going to prototype this, so there is a public repo which you can clone and spin up yourselves. The message is, we'll give you the link at the end, but the message is really prototype early to understand how the components of your system fit together so you can think like an attacker. This talk will focus on zero trust for workload-workload communications, worth mentioning that we're not going to touch on zero trust in the supply chain because that's probably a whole suite of talks just on its own, so yes. What is threat modelling then? We all threat model all the time intuitively, so when I went to a piano bar last night and the pianist started playing Rick Astley, I had to make the decision do I join in or not. I thought the risk of me not having a voice today was too great, so I did a little threat model.  But if we do this in our personal lives, why would we not do this with our IT systems? Threat modelling systems is all about identifying and enumerating threats and vulnerabilities, formalising this in terms of a risk management framework and escalating risks as part of that framework once they've been quantified. Threat modelling gives us loads of benefits, so we identify security flaws early. We save time and money by doing this. We understand complex risks which we couldn't understand otherwise, and the key message that we want to get across is that everyone should threat model is not just something for security teams. Really the people who should be threat modelling are the people who have developed features, engineers, developers who understand code the best because they can put themselves in the position of an attacker the easiest. So threat modelling is an iterative process following this four question timeline. First of all we ask what are we building. We draw architecture diagrams, data flow diagrams. We understand at a high level and at a detailed level what our system looks like. Once we have this we ask what can go wrong. This is where we put ourselves in the position of an attacker. Think up nefarious scenarios and try and brainstorm these using techniques such as stride and attack trees which we'll do for our example system in a few slides time. Once we've done this we need to devise mitigating controls. That's the next step. We need to minimise our residual risks. Finally threat modelling is iterative. We need to be constantly asking are we doing a good job? Are our controls effective? Do we have effective automated tests which tell us whether our controls are working? Let's start to make sense of Zero Trust via a very, very, very high threat model. This is a very simple diagram. We've got a user interacting with a workload, two workloads communicating, one workload persisting data storage and interacting with persisted data and another workload calling cloud provider APIs. There's two keys to deriving Zero Trust principles from this diagram. The first is that we're not specifying anything about these workloads. They could be running anywhere. Workload one could be running on a Kubernetes EKS cluster for example. Workload two could be running on a VM on-prem. So we're not specifying anything. The next key is to define our trust boundaries. I'm sure lots of you have heard people say things like workload one and workload two are within our protected network. Therefore of course they can communicate by default. We say no. That is not the way to think about things. Shrink your trust boundaries down as small as possible and never trust, always verify. We're going to threat model using stride. Can I spoof any communications? Can I pretend to be someone or something which I am not? Can I tamper with information flows and compromise the system that way? Repudiation. Can I do something and then say I didn't do it about Simpson style? Information disclosure. Can I exfiltrate data to parties who should not be privy to that data? Denilo service. Can I take the system down? It's going to be very important when we're talking about workload identity that we have a highly available mechanism for distributing those identities. Finally, can I escalate my privilege and do something I should not be able to do? Let's derive our high level architectural principles from this very simple threat model. A really easy way to do this is draw a table. Threats down the left, high level architectural controls on the right. We'll go through this line by line. Spoofing, first of all, user impersonation. Like I said, we're focusing on workloads in this talk, so we won't go into too much of the cool stuff you can do in the zero trust space around users. We're focusing on workloads. However, we need to be cognizant of the controls there, so user authentication and authorisation best practices and establishing provenance of our users. Workload spoofing, however, is where we come to our first kind of topic for the talk. This means if we want to do this well, we need the concept of a cryptographically verifiable workload identity. We're going to use a technology called SPIFI, a framework called SPIFI, and the production ready implementation of the SPIFI workload identity framework called SPIRE. We'll show this in the prototype later on when Rick will give a demo. Workload spoofing, as well. We want strong integrity protection on the client side and the server side of any communication, so we're going to use MTLS. We're going to make things easy for ourselves by using Istio service mesh for our two workloads in our example prototype. MTLS obviously helps us with tampering risk as well, altering information in transit, maybe not so much the mutual part but the encryption part. I guess the integrity checks as well. We could tamper with stored data, so this is where we need strong authorisation policies everywhere, and you can see another high level control later on is policy as version code. Policies always link back to organisational business requirements, therefore we need to be able to keep track of who owns a policy, how do I make a change to a policy, and the way to do this well is policy as version code. You can hear some good talks by Chris Nesbitt-Smith on this exact topic. Repudiation risks, this is where we want to tie cryptographically strong identities back to things which workloads are doing, so we maintain audit logs. When it comes to policy, our demo is going to use a general purpose policy engine, an open policy agent, so this control will be all about maintaining decision logs and making sure that those decision logs can't be tampered with. Exfiltrating data would be an example of information disclosure, so again it comes back to policy, in this case egress control and network policies. Preventing workloads from communicating, this could be a denial of service risk. If we're using Spire and I as an attacker can take the Spire server down, how are workloads going to get their identities? We need to build something highly available. Our demo later will be not a production ready demo, so this would be further work that we would have to do, and we would get that work done by doing more detailed threat models of those sorts of denial of service attacks that could take place. Finally, a compromise workload could pivot, so workload 1 may not be able to hit a specific endpoint and lease privilege authorization policies, again are the way to enact this. Now we've got our high level principles, it's over to Rick to build an architecture. I'm going to try and satiate your desire to see diagrams and code and demos without drawing too far away from the fact that this is a talk primarily about threat modelling. In our fictitious example here, we've got workloads, what kind of requirements have we got? We've got an external facing service, we want to make sure that we're using TLS to expose that service. We've got services communicating, we want to use mutual TLS, so we need to be distributing keys, certificates and trust bundles so we can verify those. Both of the workloads on here are going to be accessing various AWS services and so they need to get temporary AWS credentials and they're going to be able to do that using Web Identity Federation. We're taking a JWT, a JOT and using SDS to exchange that for temporary AWS credentials mapped to IAM roles that grant them access to the things that they need to do. So on the left there, we've got a very simple service. It's going to be making direct API calls, so at the bottom there is SPIRE, I'm not going to keep it kind of high level, but if you think of SPIRE as your identity vending machine so you can get your X509 identity documents or your JOT identity documents from SPIRE. The good thing about it is that the workloads don't need to know anything about their identity, they can be a bit amnesiac. I'm going, hey, who am I on SPIRE? You are service aches. So on the left there, it's going to get an X509 certificate that it can use to expose the API over TLS and it's going to get a JOT and exchange that for AWS credentials and get access to the S3 bucket to download, to retrieve a file and then present that to the user. And in that example, because we're using the client APIs, we're writing all of that. So if we move over to the other side, we're moving to the service mesh type approach. So we can remove some of that coding complexity from the developers there. We've got Istio service mesh there. Istio can retrieve its X509 material from SPIRE using the secret discovery service. So we've got that plugged in to the right of Istio. We've just got a side car there. Now that's periodically getting the JOT from SPIRE, writing that to a shared volume so that the open side car can get temporary risk credentials to download the bundles from the S3 bucket and make the policy decision. So if you can think of OPA in this case as basically a yes no engine, can I do this? Yes, no. We could do some of the authorization decisions just with Istio itself. OPA gives us a bit more kind of flexibility. It allows us to make external calls to bring in additional data and things like that. Keep that in the back of your mind because we'll come back to that in a sec because that's a bit important. So we've got Istio, we've got OPA, we've got SPIRE, we've got Kubernetes, and just to make sure that we get our talks approved, accepted, we're going to get as many CNCF tools as we can. So we're going to use Coverno over there to inject the sidecars into our workloads. So that's our example architecture. And as James mentioned, what we want to do is we want to be prototyping early. Why do we want to do that? So it helps us understand how the technologies that we're using work, how they integrate with each other, think about what can go wrong. As James mentioned, we're going to open source the repo and make it available for you to kick the tires and play around with this. And so in order to do that, we want it to be simple and reasonably cheap and fast to spin up. So instead of using a managed cloud provider Kubernetes cluster, we're just going to use a local kind cluster and just some S3 buckets. The offside of that is that for the OIDC discovery stuff, in order for AWS to verify the Jots, it needs to be able to access the discovery document and the key set to verify the Jots. And normally, if you're running in a public Kubernetes cluster, you would expose an OIDC discovery service publicly like that. In order to make the demo work, we're just going to use an S3 bucket and we're going to ship the discovery document and the keys up there to get that working. So let's have a quick check just on the example on the left-hand side and make sure it works. That is not a given. It's been working fine all week, came in this morning, went to deploy stuff. And at some point yesterday, AWS made a change to the default policies on S3 buckets. You cannot make them public by default and they've removed the access control lists. So as I sat there, I'll just check this works before we go for the demo and error, error, error, all panic stations. So can you all cross your fingers for me? No, seriously. Okay, so let's deploy example one. So remember, this is just a simple web service exposing an API or ACPS. It's going to get a file from an S3 bucket and serve that back to the users. There's the warning that they sent out in December that's at some point in April, probably the day before you do your presentation at KubeCon at you. We will break things for you. So looking good so far. So now it's not just, why is this not working? No, there we go. Now that's a relief. Can I get a woo? Thank you very much. Okay, so that's working. I'll get a woo and a few. Let's quickly have a quick look at the, because I know you want to see some code. Let's shrink that up. So the spy client libraries have got some kind of useful stuff in there. We create an X509 source here and then use the TLS server configs. We just drop that into the server there and then we'll run up the server and it'll get its X509 certificates directly from spy there. Create a Jot source and then pass that into our Flare handler. And this will create an AWS configuration. And then we've got a custom credentials provider here. We're passing in the Jot source and exchanging that for temporary credentials to create an S3 client, which allows us to download the object from the bucket and serve it up to our calling. And we can see that it's been issued from our spy server. Resolution is awful. And there we go. In the URI SAN, we can see it's using Spiffy protocol. You can see it's using the control plane trust domain. And we've issued this work that identity to our S3 consumer. Quite normally. So now we have our detailed architecture and a prototype. We can draw data flow diagrams. So data flow diagrams are essential to help us threat model. What we will do is kind of like apply stride like we did to the high level one to each individual communication. But now we can look at these network communications in a great deal more detail. So much detail in fact that the diagram doesn't fit nicely on a slide. So don't pay much attention to the nonsense. The gif is just there to show kind of our generic workflow. So we've got a user at the top coming through Ingress. If we follow the purple line down, we'll see the user is... We've got the spire stuff in the middle. The user is hitting a workload via the workload's envoy proxy. A decision is being made by OPA and this also applies to the workload workload communications. We see the workloads are pulling open policy from the policy management plane. In our case it's just the policy is hosted in necessary bucket. And then the workload is calling out to a cloud provider API. Both ricks have just shown us. So now we have our data flow diagram. Let's start threat modelling the detail. A really good way to do this is by drawing attack trees. Kelly Shortridge has shown us how to do this. There's a really cool app called Deciduous where you can make these yourself. We are just going to use graph is kind of under the hood and draw some pretty basic trees. We're going to use this key where green nodes are ours. Blue is and. The gray ones are kind of just single nodes which kind of end. There's no logic underpinning it there. And reds are out of scope. So things like we said, zero trust supply chain things out of scope for us today. So let's build an example tree. We're going to walk through a path of the tree and just focus on one risk and show how we would build a control and iterate the control. So let's start with a bad outcome. An attack tree always starts with something bad that the attacker wants to do. This will always come down to an attacker wanting to compromise one of the three unholy trinity properties of cybersecurity, confidentiality, integrity or availability. So let's take a confidentiality example where what our attacker wants to do is leak sensitive data. We're not specifying what this data is. They just want to exfiltrate sensitive data. So you can leak data either by sniffing traffic in transit, exfiltrating data, green nodes. So it's an all. We can think of a number of ways to do this. We're just going to focus on exfiltrating data. So like Rick said, you might want to use OPA. You might want to use this sidecar model with OPA. If, why wouldn't we just use Istio standard authorization policies, for example? Well, maybe we have really complex decisions to make where we want to pull in external data and make authorization decisions based on that external data. So in that case, OPA will have access to a data bundle. So why don't we just try spitting out data from the open container itself? Why don't we try and exfiltrate data via HTTP calls from the open container to an attacker control service and exfiltrate data from our database? What would an attacker need to be able to carry this out? They would need an outbound path available to them. So this is a blue node, so it's an and. And they also would need to be able to deliberately misconfigure the policy to spit out data in this way. What would they need to be able to deliberately misconfigure the policy? They would either need to be able to change the code. So they would need to steal or get unauthorized access to the policy repo, somehow merge their code. We can imagine quite a few controls in that space. So let's think about another way they could do it. They might just have misconfigured write access to the bundle storage location. In this case, it's just an S3 bucket. Why would they have write access to this? They of course shouldn't. We have a control in place here, which is I am, and the principle of least privilege. Only the policy pipeline should be able to write to that storage location. However, we never want to be one misconfiguration away from catastrophe. Maybe something is wrong with the pipeline. Maybe something is going drastically wrong with our system. We need to make an emergency change and someone gets emergency access, write access to just write an updated policy. We never want to be one misconfiguration away from disaster. That's the message. What we do with our tree is we do this lots more times and draw a kind of a decision tree. And it would look something like this. So we've walked one path of that. The details here aren't important. You can again look at this in our repo. We're not going to go through other branches of this tree today just to show you that the real tree here will be way bigger than this. So what will we do about it? Now it's time to design our controls. We'll take a simple table-based approach like we did before. We're going to write our more detailed confidentiality threats on the left now and write our more detailed controls on the right. Again, let's not go through this line by line because you can see this in our repo and in our PDF. We're going to just focus on that one. Walk through the tech tree that we did before. So if we look at the bottom threat on this table, Overwrite Policy Bundle, like we said, we've got two key controls here. Cloud Provider RBAC, Lease Privilege, and you can audit as well. So automated audits and things. Maybe that's a separate control, but here we just have it as one. And then you see C14, Policy Bundle Signing and Verification. Instead of just relying on our IAM configurations being correct, let's add an additional control and say that our policy pipeline should have access to a signing key, and OPAS should only be able to load signed bundles which have been signed by this key. So here we have Defence in Depth. We're saying that when building custom controls, some controls will need further architectural work. So if we did look into the details on that bigger attack tree before, we would have seen a threat which is Compromise Spire Datastore. If I could do this, maybe I could add in fake registration entries and convince one workload that I am a legitimate workload that should be able to talk to it, but in reality I'm a malicious workload. However, to threat model this in detail, we need to make design decisions about how Spire is going to access this stored data. So what we would do at this point is draw a lower level attack tree and do a detailed threat model. So going back to our example attack path, malicious internal actor exploiting misconfigured IAM to overwrite the policy bundle. We have a control, but we have not yet talked about the implementation. How are we going to do this? Are we going to use default tools available to us? Or is our risk profile a little bit more cautious and we want to be additionally secure and design a custom control, and this is where I hand it back to Rick. Okay, so this is the final architecture, and as we kind of mentioned, we want to threat model prototype and threat model again and keep iterating around this. So as James mentioned, we don't want people to be messing with the bundles. So where we start is we go right, well Oprah allows us to sign these bundles. So the bundle publishing pipeline can have access to a private key. It can sign the bundle, and then the open side cars can have access to a public key and they can verify the signatures, and we know that those bundles are good and nobody's messed with the integrity of those. So I did that and said, right, I'm done now. James said, yeah, I'm not sure about that. Now you've got a key distribution problem. You've got to be passing this private key around safely. You've got to make sure you're passing the public key around. How often are you going to update those? So he points out that you can create your own custom signing procedure. And he goes, can you do that? I'm like, yeah, yeah, I can do that. The narrator, he can't do that. But where do you even start? So the great thing is in the Oprah Contrary repo there, there is an example here. So it's basically the framework is all there for everything you need to do to create your own custom build of Oprah with your own signer and verifier in there, but they didn't do it for you. So what's the signature even look like? So we have a look on the open site there. So signatures, what is the signature? That's a job. That's handy. I know about those from the identity side of things. So it's just a job in an array of signatures. So you've got the standard key ID, the algorithm that's used for the encryption there. And then the payload itself is just a list of files in the bundle. And then a digest and the algorithm that was used to do the digest. I reckon it might be all right now. I can probably pull this one off. And we're just implementing interfaces. So signing it, it's going to create a new bundle signature with the algorithm, the key ID that comes in in this configuration here. And then with the list of files that's provided for the bundle. Create a message to sign. So that's the header, base 64 URL encoded, payload base 64 URL encoded, drawing with the dot. Then we'll sign that, base 64 URL encoded signature, stick another dot in, bundle that all well up together, chuck it out, jobs again for the verify itself. Similar kind of thing. We've got the signature coming in. We'll parse it, figure out what key was used to sign it, and then verify it, pass back the list of files. So then we've verified the signature, the list of files that are in that signature there, pass that back, and open knows everything's good. So that wasn't as hard as I thought. So let's simulate the bundle publishing pipeline. You can see just using the alias for a KMS key there, signing that and pushing the bundle to S3 back to here. So basically we've just introduced AWS KMS keys for the signing there. So the open side card already had a token could get AWS credentials, exchanged that to get access to the bucket. So now the bundle publishing pipeline needs access to the key for the sign operation, and open itself needs access to the verify operation. So let's drop back into the risky land of demos. So just deployed a couple of workloads talking to each other. Let's check that. Awesome. So Istio is getting the X59 certificates from spy there. So we're looking at reasonably good. So we've got a couple of workloads. We've got some open policies allowing access on some endpoints and not on others. We'll just send some requests through, and we can see that open is allowing and denying requests based on the policies there. So that leaves us in a reasonable space. So yeah, the demo is going to be made available. Bear in mind that there's still a little bit of work to do this morning based on AWS's fantastic changes at some point yesterday. Thank you for that. Yep, we do have a summary, but we can go straight to questions. Just to really quickly summarise, is that a lot of the systems can use threat modelling, threat landscapes change, technologies change, keep threat modelling and do it iteratively. Obviously in today's world, Zero Trust is more crucial day by day.  So the last step in the threat modelling process, like I said, is did we do a good job? We've done it today, but you can give us feedback by scanning the QR. So yeah, thank you, and any questions? Okay, well, we, like we said, booth SU57, if you want to talk in all detail, we'll hang around for a bit now. Let's know if you want to chat. Thanks for coming and thanks for your support.


Exercise Conquest 2011 kicked off at the Five Hills training area in Mongolia, with a colorful ceremony and prominent guest speakers, including Mongolian President Saqyagan Elbegdorj and 3rd Marine Expeditionary Force Commanding General Lieutenant General Kenneth J. Gluck Jr. For six years, numerous partners have been gathering in this beautiful country to share tactics and techniques to train together, and most importantly, to build personal bonds that are not only personally rewarding but increase our military effectiveness. As a result, we all improve, we gain shared understanding, and we become better trained and equipped to contribute to global security, stability, and prosperity. Conquest 2011 is a premier joint training exercise designed to strengthen the capabilities of U.S., Mongolian, and other participating nations' forces in international peace support operations worldwide. For the Five Hills Training Area in Mongolia, I'm Staff Sergeant Mike Freeman.


All right, we just got here we don't have much time it closes at 12 and it's like 45 minutes till then so we're trying to get warm Hype, let's go. Even though I dunked one.  All right I'm feeling mad loose and jumping well, but I don't want to push it to like throw everything off I'm trying to get gradual, but I'm about to go hard if my Achilles start bothering wasn't too bad good to be back Yeah, he ain't dunked once today I'm going straight to LA Fitness. I got too much energy hits lower. So I'm gonna have some fun Just rip out some more dunks East Bay was terrible. I'm so mad. I think I was rushing, but like my technique is just awful Everything was like not the right placement. I just couldn't get it clicking, but I was jumping super high super high All right, so I calmed down a bit But I still want to dunk a little bit But I'm probably gonna lift so only dunk a little bit and then lift I need to get my form better. It's terrible Day of jumping jumped really high but bad day overall not bad but decent day overall of course But uh jumping really high, but I got cut short at that gym and I was rushing like crazy But definitely felt like my highest ever even on my terrible East Bay attempts. I had some high ones I just got to get my form right.  I really want to hit it at the gym. That's the gym I started at but I'm just more mad that I couldn't even get a good attempt Because my form just got really bad really got way worse than it was but uh decent day felt like I was jumping flying It felt really great decent workout in but I think from now on not from now on but the next couple coming days I'll probably take it easy because I went hard today And then maybe a light lift because those have been feeling really good and my body's been feeling better than ever So light lift and then just diagnosed from the days on how I'm feeling dunk here and there keep it up man. Don't glide


My name is Tom Pito. I'm an epidemiologist working for the Mahdol Oxford Tropical Research Unit and I've been based mostly in Cambodia working on studies of malaria elimination. Malaria in Southeast Asia has declined massively this century and there are targets which all the governments are committed to, to eliminate malaria over the next 10 to 15 years. However just continuing the activities of malaria control which is treating clinical cases of malaria may not be sufficient to eliminate malaria on target. The problem is that these infections are in people who appear healthy and so they go untreated. So we're now exploring in clinical trials new ways of treating these infections to interrupt transmission, one of which is known as mass drug administration or MDA and this is the presumptive treatment of an entire population in a geographic area to interrupt malaria transmission. Mass drug administration is easy in theory, you just get everybody to take the medicine then there's nobody with parasites to transmit. In practice it's quite complicated, it's difficult to get entire communities to understand about the importance of asymptomatic infections and want to participate because you need to get entire families including children, old people, migrant workers, forest workers, everybody in the community has to take the medicine around the same time. It's challenging but we know now that it's been successfully done by our group on a small scale and clinical trials in several countries and by other groups as well in different circumstances. So though I say it's challenging it has worked when it's been done properly. In the last five or so years there have been new lines of research which have come up in the conduct of mass drug administration. There's now a licensed vaccine for malaria which has been used originally to save African children from dying from severe malaria but we're interested in our unit to repurpose this as a vaccine which could be given at the same time as mass drug administration in Southeast Asia to prevent transmission because the vaccine would prevent new infections whereas the MDA only cures prevalent infections at the time it's given. Another would be to combine mass drug administration with other medicines for example ivermectin which has the useful quality of killing mosquitoes who feed on people who have taken it. So by taking that as well you'd actually affect the force of transmission in the village at the same time and then there are new rapid diagnostic tests which are very sensitive, much more so than the existing ones and these could be used in some places where it's not possible to do MDA to screen and treat the asymptomatic reservoir of malaria or given in addition after MDA to prevent malaria from being reintroduced into villages. I think it's important to fund this sort of research because the emergence of Artemisian resistance and now resistance of the partner drugs used in Artemisian and combination therapies should be considered a public health emergency. In Southeast Asia at the moment we have historically low levels of malaria transmission and we have very motivated governments and organisations working to control and now eliminate malaria and this may not be the case 5 or 10 years from now. In order to eliminate malaria we're going to need to do a lot of research at the same time to understand the effectiveness the safety, the feasibility of new strategies for interrupting malaria transmission and new effective first line treatments for malaria so I think this research is important if we're going to reach our elimination goals in the middle of next decade. I think this kind of applied field research has a large practical value so this is research which if we demonstrate new effective ways of attacking the asymptomatic reservoir of malaria which sustains transmission so particularly these mass drug administration studies these are strategies which could be incorporated into malaria control and elimination programmes and indeed since we began working on studies of mass drug administration in Southeast Asia I think we've had an influence on policy in countries and in terms of international guidelines Moru and partners have fed into these providing evidence of what works and what may be effective and where it may be effective so I think there's a fairly immediate practical value to this research.


Hi, I'm going to let Colin dial in from my desk. Okay. Okay, thank you. Hey, Roberta. I don't know if you are able to hear me. Okay. I just wanted to verify that my volume is all right. Yes. Here you just find, thank you. Okay. Terrific. I'm not going to use the headset then I'm in Peter's office. I couldn't get room two to work. Okay. So Peter had luck with it earlier today. So he's going to log in there, but I'll be able to do the presentation from here. Okay. Thank you. And we're live streaming. So, you know, Okay, great. Thank you so much. Yes, we can hear you. Thank you. John, we're not hearing you. Can you hear me now? This is this. I think there's something going on with my earbuds. You know, it doesn't always allow me to be heard. Oh, Hey, Jen. Good to see you calling me, Lisa. Hi, Karen. Council member Sawyer. We have. Two of the council members present and we have the board members who are able to attend this meeting. We have staff present. We are still waiting for council member tidbits. Okay. So it's up to you when you would like to start. Okay. So. Let's, uh, since we have two council members, um, we've got Eddie on myself, let's go ahead and get started.  Uh, actually council member Sawyer, um, we sent you a script. If you have that, I appreciate it. Okay. Hold on a second. I think I may have, oh, here we go. There was a second. I do have a question. Go ahead, Eddie. Uh, yes. I received an email saying that the second part of the presentation would be on my iPad. I also see that I have a final, uh, agenda. In my emails. Uh, if I am missing something on my iPad, could I have that information sent. To the email as I don't have my iPad currently. Well, it looks like it looks like the agenda has a full, uh, presentation for today. Roberta, can you send that directly to Eddie? Yes, I will. Okay. Thank you. I appreciate that very much. So, um, the end Roberta, could you take the, uh, role call for us, please? Yes. Do like five things at once. Council member Sawyer. Okay. Sorry. Yes. Here. Uh, council member Tidditt's. Council member Alvarez. Present. Chair Galvin. Here. Vice chair. Warden for bad and for. Here. Let's see. So we all know to keep, keep, keep yourselves on mute when you, when not necessary to speak. And. This is usually highlighted. Uh, so I'll just, uh, this is usually highlighted. So I'll open the public comment. We are now taking public comment on item two. Do we, why are we? Well, that was, the other was item one. Sorry. Um, if you wish to make a comment via zoom, please raise your hand. You, if you are dialing in via telephone, please dial star nine to raise your hand council member. Sorry. I'll go and ask Roberta. If there are any raised hands, please be aware of that. So, if there are no comments, emails or voice mail, public comment received, um, at this time. We have no public comments. Okay. Thank you. So, um, If you could introduce item 3.1 for us, please, Jennifer. Thank you, council member, Sawyer and members of the sub committee. Our first item is the water demand offset policy and the the presentation he will be sharing his screen. Just a little bit of background as the council and board may recall the city's required to have a water shortage contingency plan. And as part of that, we look at all of the options we need to ensure that we can reduce water use to meet various water shortage emergencies. Demand offset has been included in our water shortage plan for many iterations. And we have been hoping to finalize a policy for many years now with the critical nature of the drop that we have in place right now. We have finally been able to put the staff resources towards developing this policy as outlined in the shortage plan. So with that, Colin's going to walk you through where we are with that. That's the initial introduction of the policy and fee to this body. And then we will taking it to a lot more public meetings and bodies as Colin will walk you through. So Colin. Excellent. Thank you so much, Director Burke. So we will go ahead and walk through this for you. And as Director Burke has mentioned, this is in fact an implementation of our water shortage plan. So I'll provide you a little bit of background and reminder about that document. As you recall, we do comply fully with the California Urban Water Management Planning Act. And in fact, this year we adopted, City Council adopted the 2020 Urban Water Management Plan and the 2020 Water Shortage Contingency Plan. These were the most recent updates for those documents. And this year, the Water Shortage Plan was adopted as a separate document per California law. So it is a standalone plan. And some of the key features are defining what a water shortage is by levels or stages by percent of water shortage and making sure that we have sufficient response actions that we can take so that when we are in water shortage emergencies, the demand for water doesn't exceed the supply we have to get us through that emergency. So there's a lot of detail in that plan and that water shortage plan about how to respond. It is updated every five years and it can be updated more frequently. And I'll talk a little bit about that in just a moment. The water shortage plan and the Urban Water Management Plan are CEQA exempt and also the offset policy as an implementation tool in the water shortage plan is also CEQA exempt. So it is not a CEQA project per se. As a reminder, here are the eight water shortage stages that were adopted in June with the water shortage plan. The orange bars to indicate a couple of things. One, historically, we've not had a drought worse than 25 percent since we adopted our first water shortage plan in 1992. And we know that anything over that is a severe shortage. And so for many, many years as Director Burk indicated, we have called for a particular response action in severe shortages that includes water allocations. That's water rationing. So when we get to a stage where we're over a 25 percent shortage, we have enough water to divide up amongst our existing customers with very restrictive limits on how much water they can use. So in addition, we do, as you know, considerable outreach and education. We offer an abundance of customer service and assistance. Our water use efficiency team is very busy during water shortages. We make operational changes. We put in place prohibitions and restrictions. And again, for severe droughts, we have this additional tool, which is water allocations or water rationing. And that's directly tied to this offset policy. So we wanted to cover that ground to make sure that that was a clear bit of information we provided to you. During water rationing or water allocations, our top priority is public health and safety. That's really what is critical. So when we develop those water allocations for residential customers, that's one of the key things that we have in mind, as well as for businesses and public safety and other kinds of accounts. We really want to make sure that public health and safety is our top priority. Every service receives a specific allotment to that individual service, and it's very restrictive, becomes more restrictive the more severe a drought or water shortage is. And violations are enforceable including excess use penalties. And there is no water available for new demand when we're in such a severe shortage and we're rationing existing water among our existing customers. And we're going to detail through all of the iterations of this allocation plan, but it does give you a sense of just how restrictive these rations are in order to achieve making sure demand does not exceed the supply we have during severe shortages. Of course, we also have a housing shortage crisis as well. And so California law does mandate that we build a certain amount of housing and have a certain amount of housing available. And so the city has a planning and economic development department at building division. They work very hard on policies, procedures, practices to ensure that we're removing barriers and we're complying with state mandates around the housing crisis. So here we have what would appear to be competing interests when we're in a severe drought. So how do we deal with a water shortage and a housing shortage crisis at the same time? And that's what the water shortage plan tackles. So the 2020 water shortage plan and the water shortage plans that preceded it included a requirement that when we're in a stage that's so severe that we're assigning water allocations to each individual account, that new construction would have to offset the new demand that would be put on the system when that new project is connected and occupied. The existing plan adopted in June called for increasing levels of offsets. However, as a team, we had an interdepartmental team with legal staff, planning, economic development, building division and a number of divisions from the water department working together, about 14 or 15 of us developing a water offset policy. When we looked at this in more fine detail, we determined that 100% offset was sufficient. We just need to make sure that new development fully offsets its demand and that would be sufficient to meet the needs of our water shortage plan. So we will be bringing under a separate item to the City Council and to the Board of Public Utilities separately, a recommendation to make a modification to the water shortage plan that flattens this structure to simply a 100% offset. And this also avoids some increasing costs in stages six, seven and eight. It would just be a flat offset. So the policy is built around this idea that we would have a flat offset required during any stage where we're having to ration water. So this proposed water demand offset policy that has been developed by this interdepartmental team is a mechanism for implementing the water shortage plan offset requirement when we're having to use water allocations. This is a way of balancing these needs that we have across the City for making sure we have adequate water supply for public health and safety even during severe shortages and that we also comply with state law and requirements around housing mandates. So rather than proposing a building moratorium, the offset is a mechanism or a tool that allows development to continue without having a negative impact on the City's water supply during severe drought shortages. Colin, my apologies for the interruption. Is there a way you can adjust your display settings? You're showing the presenter view. And so we're seeing two slides. Let me see what I can do here. I wonder if... It might be your display settings. Yeah, thank you. Again, apologies for the interruption. Yeah, completely understandable. Let me just see if I... Oh, here it is. There we go. Director Burke, is that better? Yes, thank you. Oh, terrific. And thanks for that feedback. I really appreciate it. So this policy would apply to projects that meet two conditions. The first condition would be they have not yet submitted a building permit application at the time the policy is adopted by City Council. We can't go back and add fees onto projects that have already submitted a building permit application. So this follows the same pattern we do whenever we change our fee structures for any reason throughout the City for development. The same rules would apply here. We would not retroactively apply this to projects that have already applied for a building permit. The other is they have to be creating new demand that's subject to new or increased connection fees. So for example, a project that this would not apply to if a warehouse was remodeling, but did not require additional water, there's no need for this policy to be implemented in that particular situation. Or if a restaurant was remodeling its kitchen, but in fact was not going to have an increase in water demand, there's no need for this policy to apply. So we wanted to make that a very clear distinction that this is directly tied to the impact on water demand. And that's where this fee is focused solely. In terms of the fees themselves, I'll get into the structure for the fees in a moment. But I wanted to mention that the fees would be due if and only if at the time where they're going for building permit final or for any kind of occupancy, temporary occupancy, permanent occupancy. If and only if we have a declared water shortage emergency that's in place. And that emergency declared by City Council includes water allocations or water rationing as one of the response actions that needs to be taken. Otherwise there's no need to collect fees. So this would only be during those periods of time when we have a severe water shortage and need to make sure during that severe water shortage, when we're rationing water that new demand doesn't take water away from the public health and safety concerns of our existing customers. The fees will be collected and tracked separately. We want to comply fully with the Mitigation Fee Act. The fees will be used by the City to implement projects and programs to achieve those offsets as quickly as possible. And implementation efforts would be tracked and reported separately from other programs and efforts so that there's a very clear distinction about how these funds are being used and what impact they're able to achieve. Colin, while you're on the slide, can I ask a quick question? Yes, please. You mentioned the warehouse situation and a restaurant that's either redoing their restaurant and they're not going to be using any additional water based on their gallons used in the past. How is that tracked? What is the red flag that goes? Let's say they thought they were going to be potentially using even less water in that kitchen, that brand new kitchen. And hopefully that would be the case with new technology, etc. But let's say it didn't work and they're actually using more. How do we know? Well, the way that our demand fee structure is set up for connection fees, there's a whole process that every new application for building permits goes through. So it's not something I work on day to day, but we are including in our team that engineering services team of experts and they've assured me that it's a really clear distinction for them. It's very easy for them to identify projects that would in fact increase the demand and would require that additional fees be paid for the demand part of that connection fee. So I don't have the expertise at my fingertips to address it further than that, but I'm certain we can get back to you with more information if needed. Well, not necessary. That actually answers my question. I'm not surprised that we don't, I'm not surprised at all that we have a way to track that because it's, because that's how Santa Rosa water does business. You guys, everybody does a good job of being able to work together to get the job done. So I appreciate it. I'm sure that all the, all everything necessary is in place. Terrific. Yeah. And again, if more questions come up about that, we'd be happy to have that subject matter expert help us out. So again, fees will be collected separately and track separately, making sure we comply with the mitigation fee act. So just to give you a sense of the overall process, if I were a developer coming in requesting a building permit, I would need to fill out a water demand offset application. I would estimate what I think my demand is going to be and use a lookup table to see what my fee would be. Staff will review that. If we agree, certainly we move right to getting a water demand offset agreement in place. If we feel there needs to be some corrections, we would make those. If the applicant agrees with the fees and the structure that's put in place in that agreement, they sign it, send it back to us. We process it on our side. They get their building permit and on they go to building that project. If there were a hitch, they disagreed, we do have an appellate process built in. So applicants can appeal the staff decision to the BPU. And if they're still not satisfied, they can appeal a decision to council as this is a city council policy. So we made sure to put in place an appellate process as needed. So then once the agreement's in place, they move forward. And when it comes time when they'd like to occupy that building either on a temporary or permanent basis, then those fees would be due if and only if we're in a severe water shortage that requires water rationing, water allocations, which triggers the need for water offsets. We did have a water demand offset fee study conducted and we will be coming back to the Board of Public Utilities and the city council to do study sessions on this topic. And that subject matter expert will be with us. The consultant will be with us at that time. But I can tell you from the staff perspective, what was done was that we looked at three programs that we had confidence that we could implement quickly and attract quite a bit of participation in. So enhancing a couple of existing rebates, which is a very cost effective way of generating offsets, and then offering a direct install toilet program, which also is very cost effective compared to the other programs. So we looked at three programs we felt we could quickly and cost effectively put in place to create offsets and what the costs would be. We did a deep analysis of the water use of our existing customers. We've done these studies for decades. And what we've seen is that single family residents have a particular water use sort of footprint, if you will, smaller parcels use less, larger parcels use more because of the size of the landscapes. And we've also seen in the multifamily sector that there are particular breaks in water use history. And so we've divided those up into categories as well, so that we can fine tune this to more most accurately represent what the impact would be that needs to be offset. The table I'm going to show you is a little bit outdated. We've updated it to add another category and expand a couple of categories so that it more effectively reflects a parallel process that we use for our connection fees. But generally speaking, this is the fee structure. These fees haven't changed. However, we've added another category, as I said, for duplexes and triplexes because they have a distinct water use history that differs from other kinds of multifamily units. And then to the ADUs and senior housing units, we have added a small high intensity apartment complex category and the single room occupancy category. So the study session agenda packets include an updated table here. And then what we did was we looked at the weighted average cost and that is what we would propose to use for the schedule for fees. We have reached out to the development community. We reached out directly to the North Coast Builders Exchange and a North Coast Engineering Contractors Association. We sent almost 60 letters to development, the development community, developers, contractors, interested parties, letting them know this was moving forward, provided the draft table that I just showed you and a meeting schedule when all study sessions are occurring and when action items would occur on this. We've offered to make presentation at association meetings. We've also done a short presentation to the Santa Rosa Metro Chamber. And so we're doing everything we can to make sure that the word is getting out to the development community to make sure that they're aware that this change is coming and when they have opportunities to have their voice heard if they have concerns or questions about this. Our next steps are to go to the Board of Public Utilities this week on Thursday for a study session. We'll go the following week to the Planning Commission and do a report item that is essentially a study session asking for their review and comments. October 26th we'll come to the City Council for a study session. And then on November 4th we'll ask the Board of Public Utilities to take an action. We'll ask them to consider making a recommendation to Council to adopt the policy and fee structure. I want to mention we're also going to be taking a separate item on that same date asking them to make a recommendation for minor changes to the water shortage plan including the change I mentioned where we would ask for one offset 100% offset in all severe shortage stages 5, 6, 7, and 8. So changing that structure is one of those changes we would ask for a recommendation on. On November 30th City Council will have a public hearing and we will ask them to consider adopting the water demand offset policy and the fee structure. And again we will also have a public hearing just prior to that asking them to adopt minor changes to the water shortage plan including the offset requirement percentage. And at this point I'm happy to take any questions and I think what I'll do is stop sharing the moment just so that it's a little easier for everyone to see each other. Committee members any questions for Colin on the presentation? Yes Council Member. Sure. Eddie go ahead and then Dan. In regards to page number nine and with the policy change it states that we want to move to the 100%. Could you explain the difference between 100% and what a 500 or 400% reduction looks like? Yeah it's a terrific question. So in the currently adopted plan if somebody I'm just going to use very very simple numbers to make it easy. If a project needed say one million gallons of water per year then we would look at what it would take for to offset that one million gallons in a stage five. The current plan says in stage six they would need to offset two million gallons even though their demand was one million and in a stage seven it would be three million gallons in a stage eight it would be four million gallons. And again when staff looked at this more closely we determined that really what we need to achieve is simply a 100% offset. If their impact on our water demand is a net zero impact that's sufficient and that avoids having an accelerated fee structure that would go up considerably in stages six seven and eight and it still achieves what we need to achieve which is a net zero impact. In regards to the tools that developers are using what are some of the policies with strategies that are being introduced to reduce the water in these developments? New development is required to be considerably more efficient than development prior to a number of laws that were adopted in California. So for example there are very restrictive requirements on landscapes in California. Very restrictive requirements on faucet flow rates, on toilet flush rates, on also appliances such as your dishwasher or your clothes washer. So all projects now have to comply with CalGreen plumbing code and building code requirements. So the city has really been an early adopter of those. We adopted even early versions of CalGreen plumbing codes before they even became mandatory. So we've been a leader in this area for probably I think close to two or three decades now. So new development is considerably more efficient than development was say in the 90s. So we're really promoting and really incentivizing our developers to take advantage of the new technology that's out there is what it's really sounding like. Would that be a correct statement? Yeah definitely so. Thank you sir. Thanks Abby. Dan? I wanted to follow up Colin on council member Sawyer's question earlier when you were using the example of a warehouse. So if we determine at the time that they're going to do their improvements that they don't qualify and they don't have to pay any kind of a fee. I know we can monitor them after they've completed it to determine whether or not they are staying within those guidelines. But what happens if in your hypothetical after they've done their build out all of a sudden that warehouse is using twice as much water as what was anticipated. How do we deal with that? Well we don't have a way to go back and I guess in terms of the demand for the connection fees they don't I don't think they monitor those in the way you're thinking. However what we do is we do monitor sites based on their water use and when when a site's use goes up noticeably the billing department has an automated report that flags those accounts and sends a letter to them saying hey you might not realize it but you're using a lot more water than you normally do. Please take a look at how you're using water see if there's something if you need some customer service and assistance please contact the water conservation folks they're happy to help you. In addition water conservation has a series of reports that they run to look for things that are anomalies or unusual patterns of water use and they reach out proactively to customers as well including having the ability to look at AMI data that automated meter infrastructure data and if a site is perhaps using twice as much because they have a leak that they're not aware of that'll show up on reports and our water use efficiency team contacts folks regularly letting them know you have a leak that's a violation of our water waste ordinance you're going to need to fix that. If it were just simply a way a standard way of doing business you know I'll have to actually talk to our experts over in the engineering services and see how that would be what would happen if their ongoing business were simply doubling the water use and it was well beyond the demand fees that had been paid at the time of connection I'll have to get more information unless Director Burke may have something that she can add but that's a little bit outside of my area of expertise. So Chair Galvin it is a great question what how we set demand fees is based on the peak month so we are looking at the highest water use that they're going to have based on what they're estimated to do. We if they're you know going to make changes in the future we look at that capacity that they currently purchased and then we compare that to what their use has been if they're proposing changes if there's a differential and we need to charge additional capacity fees or demand fees. On a day to day we are not comparing their usage to the actual demand fee capacity that they paid for but we do as Colin mentioned have a lot of tools to identify if there's someone that usage has crept up significantly. We also have a very conservation-based rate structure so both on the water and the sewer side that are encouraging folks to be as efficient as possible with their water use. Thanks Dan thanks Jennifer Lisa. Thank you it's actually just dovetailing on the last couple of questions. So just for clarification that kind of next trigger point on the use as compared to what was incorporated into that first building permit would be in the event that they applied for a new building permit but not necessarily a monitoring in between. And I guess a question on there is also is it customary? I'm not a rates expert in so or a fee expert in that way and so is it customary especially in significant droughts for any kind of structure to be built in into into water demand fees? Thank you very much. Great presentation Colin by the way. Thank you so much. I'm not completely sure I fully understand the question but I think what you may be asking is are we doing something that's sort of a standard business practice? Are we kind of doing a best management practice for drought response? Is that kind of in the neighborhood of what you're? Yes and particularly on on new construction whether it's I guess it would be particularly in commercial but if the next trigger point for reevaluation wouldn't be in the until in the event that they came in for a new building permit is there anything that's customarily built in in between? Well certainly you know for for our drought response when we get to the point where we are rationing water we look at the water use history of each site and particularly for commercial and we look at whether or not they are their businesses directly tied or their institutional use whatever the case may be directly tied to public health and safety. If it's not directly tied to public health and safety they have to cut back a little bit more but hospitals of course were pretty generous in their allocations they do have to cut back but it's a very slight amount because hospitals are going to have to be able to respond and be able to serve the public right so we want to make sure that we have reasonable allocation set based on public health and safety but a typical business would have to cut back their water use based on their water use history and they have to abide by that and so if they exceed that allocation their subject to first we reach out it's progressive enforcement hey you're out of out of step with the water allocation what can we do to help you you've got to come back into compliance we don't have any water any extra water there's there's no room everybody's on a strict ration if they continue to violate their penalties and worst case scenario because it is considered a water waste it's a prohibition when we get to that point we could technically shut them off if it were severe enough and they were recalcitrant clearly that's not what we would like to do as a first step of course obviously we always want to work with our customers we want them to be successful so that we can be successful but it's pretty it's pretty strict when we get into water rationing we really have to be very proactive and careful about our water at that point so yes regardless of whether there's a new building permit involved or not there are strict water allocations that folks will have to abide by should we get into a severe shortage thank you very much that's really helpful appreciate it thanks Lisa thanks Colin any other questions from the committee members at this point okay seeing none um we're now taking public comments on item 3.1 if you wish to make a comment via zoom please raise your hand if you are dialing via telephone please dial star nine to raise your hand um Roberta do we have any live public comment you're not no public comments and do we have any voicemail but any any any comments of other types no public comments all right thank you very much um well then we will thank you for that presentation as very interesting i'm glad to see that we i think the 100 percent uh makes perfect sense uh it seems fair uh and effective as well so um i would hate to think what i mean the the concept of having a future demand pay more because they're new um you know i'm glad you're able to avoid that because there's it's uh they need to carry their own weight but and that's i think that 100 policy does just that so good job on coming up with something that was fair and reasonable so um if uh director work would you like to introduce item 3.2 is that is imma going to be bringing that to us yes uh thank you council members so i remember some of the committee so item 3.2 is an update regarding a potential regional organics processing facility um and preparation of a request for proposals related to our compost site and emma walton our deputy director of water reuse operations will be making the presentation thank you welcome emma thank you for having me good afternoon uh council member soya and members of the subcommittee thank you um director berck for the introduction am i sharing the correct view of my presentation okay perfect so i'm going to give just a pretty brief um overview um and presentation on what we have going on with respect to the potential regional organics processing facility uh that we've been kind of working towards for the last uh five years or so um and bring a recommendation um for preparation of another rfp uh for the potential use of our biosolids compost facility um now that we are no longer in negotiations with uh renewable sonoma so a quick background um as i think all of you are aware in october of 2015 our in county organics processing facility located the central landfill closed due to stormwater runoff issues since then zero waste sonoma the joint powers authority whose mission it is to um address waste aversion in the county has been looking for an in county uh solution to process our organics that we create here and in may of 2017 they released an rfp soliciting interest from outside vendors who wanted to own and operate and build a facility in county in exchange for flow of commitment or a commitment of flow excuse me uh in august of 2018 zero waste sonoma selected renewable sonoma um as the preferred vendor renewable sonoma as part of their proposal had identified uh the city of santa rosa's property adjacent to the treatment plant as the facility location or the site location for the proposed project um and in february of 2019 the vpu authorized an exclusive negotiation agreement with renewable sonoma for the lease of that property we've gone been in negotiations with renewable sonoma since february of 2019 as they've as they continue to refine their project and further developed their develop their proposed project um and we got to a point where uh in december of 2020 we took um both to the bpu and to the city council an item enclosed session um to review potential um uh lease term and price for the um for the for the lease of that property so just as a reminder the property that we were negotiating regarding was uh to the west of the treatment plant the original location actually was um greenfield property to the north of the plant but through some negotiations uh we identified that the preferred location would be to the west of the plant um on the property that is that was at the time currently the home of our biosolids composting facility um that facility closed in may of 2020 um as the water department identified more cost-effective and efficient way to process the biosolids that we had previously composted at that facility so that opened up the opportunity to negotiate for the use of this property with renewable sonoma uh just an aerial view to give you a sense of what the property looks like and where it is you can see in the foreground there um our uh our facility the the compost facility can you see my cursor yeah okay so here's the compost facility itself um this is um a storage pond um that we used for various um purposes operational purposes and then right here is just a bio filter uh that we used to filter the air inside that building so um this is the facility that we're talking about uh today so recently um we have had some unfortunate um outcomes of our negotiations with renewable sonoma uh in may of 2021 renewable sonoma decided to end negotiations with zero waste sonoma uh for the commitment of green waste and and negotiations with the city for lease of the property uh they were unable to secure financing to support the project and decided to remove themselves from negotiations um in zero waste sonoma uh since since renewable sonoma ended negotiations zero waste sonoma has been considering its options in how to move forward um with bringing um uh in county uh an in county solution back for um green waste composting and um they anticipated that a release of a draft EIR for a proposed project upon stage gulch would be coming out in september and i do not believe that has been released yet i have not seen a um a copy of it so i could be mistaken on that but i have not heard that it has been released but last i heard from zero waste sonoma they were anticipating um that to be released in the very um near term uh they are hoping that this project will um meet the needs of uh the joint powers authority and will be able to take um green material from in the county and have it processed at that facility uh they don't know if at this point if they're going to go back out for another rfp to try and cite another facility um i think right now they're just kind of in a wait and see um a point since negotiations have ended with renewable sonoma for the city we have been left to contemplate how we're going to use this previous biosolids composting facility um into the future um we have identified some immediate near term needs for the facility and are also interested in exploring future operational needs for the use of the facility for the water department and that's why we're here today so kind of what has changed since we were previously in negotiations we learned a lot through the process and and going through the negotiations with renewable sonoma one of the main things we learned was that the benefits that we had originally anticipated from co-locating the two facilities the green waste composting facility adjacent to a wastewater treatment plant really just didn't come to fruition we had we were open to a lot of different synergistic um exchanges and at the end of negotiations we just really didn't have a whole lot of interaction between the two operations that were beneficial to the city or beneficial to the water department and the other things that have been going on with respect to our biosolids program and our bio in particular our land application program is that the san francisco regional board is reconsidering how they are permitting land application sites in south county in particular in the valend area we all of our south county land application sites are within the san francisco regional boards jurisdiction and are within the san francisco valend area they've recently become re-engaged in our in our application and are very interested in our program and have a lot of questions about how we're undertaking our program so one of the things that we have historically done for our land application sites in south county is we fall under federal regulations because historically san francisco did not want to permit our our sites they just wanted us to fall under the 503 regulations and so we have historically done that and been in compliance there is a statewide general order that they could apply to us and on those lands and if they were to do that we would have to modify how we currently operate our program and in particular there are requirements around storage of biosolids on land and if we were if if san francisco regional board were to decide that they want us to go under the statewide general order we do have an immediate need for our existing biosolids compost facility to stage biosolids so that we would be able to store biosolids and then truck them to south county consistent with the time frames that are part of the statewide general order so that's kind of the the near-term need that we have for that facility and it's going to be absolutely critical to making sure that we are in compliance with that statewide general order the other thing that's going on in the biosolids world is SB 1383 which is diversion of organics from land bill we are anticipating that with the passage of this bill that the demand on land application sites is going to increase as you may be aware we rely on lease agreements in south county for our land application and we have concern about if there's more wastewater treatment plants in the area looking to land apply biosolids because they can no longer go to landfill that could potentially impact the lease agreements that we have with landowners in south county so we really want to start thinking proactively about that that circumstance and then lastly we when we closed our biosolids compost facility we entered into an agreement with lis tech which is a biosolids processing facility in fairfields we structured that agreement such that it was a shorter term agreement with the sole intent of bringing our biosolids and treating our biosolids and processing our biosolids in county for the long term we we we saw and understood that our biosolids composting facility was not a cost-effective solution we recognized that we could truck biosolids to lis tech in the near term to gain some savings while we look for a long-term solution and a more cost-effective solution to biosolids processing and we believe that the biosolids composting facility could potentially help us bring our biosolids back to in county and construct and establish a long-term solution to our biosolids so with that our recommendation and really the reason we're here today is to get solicit input and feedback on how to move forward with this but at this point our recommendation is that we would issue an RFP or a request for proposals to evaluate potential opportunities for Santa Rosa water to utilize the closed biosolids compost facility for our own operational purposes and forgo offering up the site as a potential regional organics processing facility our recommended next steps would be that we would work with the board of utilities to develop an issue and evaluate an RFP and evaluate the potential long-term options that would come out of of that effort we would suggest keeping the council informed through written communication and updates on potential future use of the site for our operational purposes and the fact that we're considering not offering up the site for zero-way Sonoma to utilize as an in-county organics processing facility so with that I'll open it up for questions and I'll stop sharing so we can all see each other Emma I'm curious do we have first of all how normally would we be storing biosolids if we needed if we had to reduce our our spread and we had to store what do we what kind of vessel do we use to store and do we have enough space now that we have that area back under our control under our complete control do we have enough space currently to satisfy the needs of those vessels that would be holding these biosolids until they were either able to be spread or processed in some other way yes so how we currently do it right now is on our south county properties which are under the 503 regulations we are allowed to store on the land on on the on the farmed land itself so we truck it down we use a small portion of the acreage to store biosolids until it's ready to be spread and incorporated and and that's really highly dependent on each farmer and when they do their cuttings and how they do their cuttings and so we work very closely with our farmers to make sure that we are storing and spreading and incorporating biosolids that work with their operation if we were to go under the general order we would no longer be allowed to store biosolids on the land for more than 24 hours so as soon as you put it down you have to spread it and then within a certain amount of time you have to incorporate it that's very impactful for us our operations with regard to trucking and spreading and incorporating it's additionally very impactful to our farmers because they may or may not be ready to spread and incorporate biosolids at the time that we produce them so we would utilize the we will be utilizing the compost facility which has all the infrastructure we need already in place to store biosolids stage them there then when the farmers are ready to accept them we would truck them at that time spread and incorporate within the specific time frames required under the permit great thank you for that committee any questions for you ma van so i was on the the review committee when we did the original proposal reviews and i know we had several other what i'll call credible responses to the rfp has there been any thought given either at the city level or even with zero waste and going back to any of those original proposers to see if they have any interest whether it's to negotiate something to use our facility and we become the regional group or in conjunction with net zero yes there's always yeah that's a great question zero waste sonoma has considered that as an option it was one of the things that they were originally looking at when it was looking like renewable sonoma was going to end negotiations they have decided that they are not interested in reaching back at this point they're not interested in reaching back out it's been i want to say six years five years since those original proposals were submitted and so if they my understanding is if they were to entertain another project they would put out a new rfp and solicit for new proposals from the city's standpoint because we're part of the jpa right now our flow our our material is committed through the jpa and we would not um we're not currently in a position to solicit for just our material or for the on behalf of the jpa really that's the zero waste sonomas project and they're they're prerogative and another thing i did want to mention that through the lessons learned um and and you probably remember this as part of the original proposal or as part uh part of the original rfp we offered up the land north of the treatment plant um and through negotiations we we agreed to allow them to consider the property west of the plant after going through the process it really became apparent that our compost facility and what is currently paved out and what is currently improved is not large enough to support a regional facility the acreage is just too constrained to really support a project that would meet the entire needs of the jpa so if we were to participate in a project in the future the compost facility and that acreage really isn't the correct acreage to be uh negotiating around any other questions from the committee and thanks for the answer camera very nicely done no other questions so um we're going to move to public comment we're now taking public comment on 3.2 if you wish to make a comment do you zoom please raise your hand if you are dialing via telephone please dial star 9 to raise your hand um any public comment berbera no public comments any other types of comments received in any other from any in any other uh process or way no sir okay i appreciate you allowing me to use such technical language um well if there are no other um questions or comments from the committee we will and thank you all for being here um and for this update emma and jennifer um we will um adjourn the meeting council member soya if i could ask um on the staff recommendation uh is the committee's uh direction to support our recommendation the next steps let's um let's do a eddie are you ready to support the recommendation of staff i am okay thank you and dan absolutely looks like three yeses don't forget lisa oh lisa i'm sorry i've been here plenty of times don't take that as a slight you know you know that's not a slight agreed with with with enormous uh applaud and appreciation for how how phenomenally our staff worked through that entire process it was um yeah and and it continues and thank you thank you all it's uh well hope hope for good things in the future i'm looking forward to um not having to deal with um finding new sites to um to deal with our biosolids it's an issue that many cities that many any city that has a composting or that it has a has biosolids a water processing plant um anywhere in the bay area especially those under the san francisco um uh orders are um up against the same problem so it it does complicate things and we look forward to the next update hopefully it'll be good news so thank you all very much thank you thank you thank you everyone