All right, let's go ahead and get started. Thanks for joining us this morning, everyone. I'm sure it's been a long week and a late night. So I appreciate you making the effort. Is that good for volume? All right, wonderful. So we're gonna talk about a few different integrations that we've had the pleasure of working on in the Drupal space. And we're kinda using a bit of a storyline of telling the story of three different integrations, seeing what they had in common, what didn't work, and kinda talk about a little bit why Drupal is a really great platform for doing these types of third-party integrations. So before we dive into the fun stuff, kind of a little bit about us, so I'm Lev Zippin, I'm the CEO and co-founder of ThinkShout, and I'll be joined in Acts 2 and 3 by Talna Hogue, our CTO, and Gabe Carlton-Barns, our engineering manager. And so we'll each kinda talk about a different product that we've been able to integrate. So first, a little bit about ThinkShout, so it's kind of a few core things that we identify with. Number one is who we work with, so we work almost exclusively with nonprofits and mission-driven organizations, and it's really kind of a big part of who we are and what we do. So a lot of our integrations, while we design things to have a really wide array of use cases, it's one of our kinda core philosophies that we'll talk about a little bit more that we think leads to successful integrations, we do target a lot of our work, a lot of our open-source contributions towards the nonprofit sector. So we offer a full set of services strategy, user experience design, development, and support, like most other shops do, and one of the things that we're really most proud of is that our over 60,000 websites are running on our open-source contributions, and we'll kinda talk about three of our most popular modules that are included in those numbers as well. So our philosophy is always that in our work with our clients, we try really hard to abstract any of the work that we're doing into reusable building blocks that we release to the community, we leverage those tools in our work, and a lot of grassroots organizations that maybe couldn't afford to work with an agency like ThinkShout, they can then leverage those tools on their own or with smaller, independent contractors, and we think it's really one of those great situations because our clients, they get their sites based on widely adopted code bases as opposed to a bunch of custom code that was written just for them, which as you all know, can be really difficult to maintain. The community gets a well-maintained contribution, and it's not poorly altruistic. ThinkShout gets some lead generation and marketing, of course, by having those tools be out there. All right, so I'm gonna start off and talk about Mailchimp, our favorite email service provider. So full disclosure, Mailchimp has actually been a client of ours for some time, and I'll kind of tell you how that started. We've been co-marketing together this solution for over five years, so we try to be objective, but I thought it'd be good to disclose that. So like every good story, the one about us using Mailchimp does have its origin. So back when I was on my own, so before starting ThinkShout in 2011, I had my own company kinda do an independent work for a number of years, and I had a case of what I used to call Shiny Object Syndrome, so there wasn't really a, I never meant to start up, I didn't like, and I had all these different side ventures, none of which went anywhere, but one of them did have a need for integrating with an email service provider. So this was back in the Drupal 4.6, Drupal 5 days, and I wrote out the Mailchimp integration with Drupal, and the project was actually, it was something called Mom Hub, and it was like a Google Group's clone for parents to organize playdates. I just had my first kid, so it seemed really like a fabulous idea at the time. Not around anymore. So I wrote out this integration, I did a little research, Mailchimp seemed like a really great email marketing platform. They had really cute monkey stuff, I liked it. And Mailchimp, that was kind of the start of its rise, and it quickly saw meteoric growth within the email marketing space. Drupal was also seeing its own tremendous growth, and those two kind of forces together made the module all of a sudden become more prominent and grow, and I was on my own, and I started getting pelted with support requests constantly. Like, oh, can you help us do this? Can you add that? You guys know what it's like in the Drupal issue queue. And as an independent contractor running my own business, it really was not something that I had time for. In addition to my client work, and as I mentioned, having a new kid as well, so I reached out to Mailchimp back in the late aughts, and to their credit, they had the foresight to see what this partnership, sorry, they had the foresight to see what this partnership could lead to. And so yeah, when I reached out to them right away, they're like, yeah, that's a great idea. We'll definitely support you, and we can work on this project together. So starting back then, we basically had an arrangement that we more or less have still today. They pay us kind of on a monthly basis to basically support the module, and then we do more structured project work to do major feature enhancements to Mailchimp. So adding different tools. Over the years, we've added things like activity reporting and the ability to send campaigns and really enhance the power of the integration. And we'll kind of talk a little bit more in detail about those different features. But so we kind of in parallel support the community and the module. We respond to bugs in the issue queue. We're constantly doing minor point releases to make sure it's up to date. And at the same time, we're doing major new feature enhancements. So for example, right now, we're doing Mailchimp has a big priority to focus on their e-commerce integration. So be able to basically close a loop like when you send out an email, promoting something you want to sell, and then kind of closing the loop from when you actually sell it on your website. So that's something we're really excited for that we're working on with them right now. So the basic structure of the integration, it's we have always kind of taken a layer cake approach to our modules. So with the goal that you only should be using the code that you actually need. So the Mailchimp module is broken down into the underlying base module which manages authentication and communication with the Mailchimp API.  And then built on top of that, we have a signup module which exposes what you'd expect your basic signup forms. And I'll talk a little bit more of that in a subsequent slide. We have a list module, which is one of the more powerful features of the suite. And it allows you to basically synchronize one or more of your Mailchimp lists with one or more Drupal objects. And again, I'll talk more about all of these later on. Activity which tracks all of the email activity for any entity with an email address and the ability to send campaigns natively from within Drupal, embedding Drupal content in those campaigns as well. So you can use one or more of those and you don't have to use all of them. All right, so diving a little bit more into each of the features. So subscription forms, this is like the most common use case with an email marketing platform, right? So you want people to sign up for your newsletter and we provide a lot of ways to do that with the Mailchimp module. There's, I'm hopefully gonna have time to do a real quick demo, but the way it works is that all of your lists are exposed. We basically create an entity in Drupal for every list that you want to expose as a sign up form on your site. And you can expose those sign up forms in either a page or in a block. And then you can obviously, then you can use the rest of Drupal's ecosystem to place those blocks contextually. You can create any number of pages with sign up forms embedded in them and you can give those pages custom URIs, put them wherever you want. You can do some access control around them. It's pretty slick and easy. And again, sticking to our approach of giving you really a flexible approach that meets a wide array of use cases. This exactly speaks to that because there's no one way that an organization wants to do its email marketing and this lets you do it in any number of approaches. So this is, this is, this is probably the most powerful and complicated aspect of the system. So we've used this type of architecture in a number of our modules including entity registration which was also quite popular. But it's a field based architecture. So the module has a special field type called the MailChimp subscription field. And that field has a bunch of field level settings which connect it in the background to an email list. And then the display of that field is actually gonna be your subscription form. And the value of that field when you're creating content actually nevermind, that's it. Yeah, so the value is gonna be whether or not an individual is subscribed when you create the entity. So when you add a subscription field, you can then display, you can use the display settings of the field to determine how it displays like as a checkbox, as a signup form and whatnot. And you specify which list is associated with that field. So a really common use case would then be so you've got a user object, right? Your user object and you can manage fields and add fields to users in Drupal, right? You can add names, addresses, phone numbers. You can also add this MailChimp subscription field. So when a user goes to edit their profile, they'll have a separate section of their profile which will allow them to subscribe to newsletters. And behind the scenes, we manage all that communication with the MailChimp API. And the way, one really important note here, right? Somebody could communicate with the MailChimp service in lots of different ways, not necessarily through your Drupal website. Or they could manage their profile from the MailChimp site. They could clip the unsubscribe link in the footer of the email. Well, so that's obviously, that's a canonical source. So we kind of have a caching technique using MailChimp's webhook system that then clears the cache when a change is made on the MailChimp side. But you can't override using the Drupal form values, whatever the actual subscription status is within the MailChimp site. But that field is available to you throughout the Drupal ecosystem. You can use it in views. You can use it in rules and anywhere else. So activities are really neat features. So what this lets you do, this also takes an entity-based approach. So we create an activity entity, which is basically like, okay, we have a Drupal entity. We need to figure out the email address of that Drupal entity. And we create mappings for each object. So using the user example again, you could say, all right, so I wanna be able to look at a user and see all of the email activity for that user. So we create an activity entity where we say I wanna track Drupal users. Here's the bundle I wanna use. Users only have one bundle. And you gotta specify which of the attributes of that bundle is the email address. And then you are able to track all the activities in the Mailchimp API that was ever sent to that email address. And again, you can see that all within Drupal. You can track opens, clicks. You could track opens, clicks, any other events that Mailchimp tracks. And finally, we have a campaign feature. So this lets you actually create your campaigns from within Drupal. And this can be great if your staff is already trained in Drupal and you don't wanna also train them to use the Mailchimp interface. But even perhaps more powerfully, you can embed Drupal content. Using a token-based approach.  You can actually just embed tokens in the campaign here. And when it gets sent out, it'll transform those tokens into the actual content from your website. So that can be really great. So a question that often gets asked is, well, why would I use a third-party service for sending newsletters when I can, there's the newsletter module, which is really well-used and a really powerful tool. There's a number of other modules and capabilities within the Drupal ecosystem that would let you send out email newsletters without using a third-party service. And this is kind of a theme kind of throughout our integration work. You know, I always like to say that, you know, let the cobbler make the shoes. You know, there are some things that you really are best left to a specialized service provider. In the case of email marketing, you know, Mailchimp and similar services like Campaign Monitor, Constant Contact, Exact Target, what not, they provide some really compelling features that you are gonna have a really hard time recreating within your own server infrastructure. One of them is certainly deliverability. So there's lots of different firewalls, lots of different corporate firewalls, lots of spam prevention tools, and to actually get your email into the inbox of your users is no small feat given all of those hurdles that you have to get over. And a service like Mailchimp, that's what they do. Like they've built a million, you know, multi-million dollar business on ensuring that when they send an email, it gets through to the recipient. Additionally, accountability and reporting. So when you send an email from your web server, it's often the ether, you have no idea what happened to it. You don't know if it was sent, if it was caught in the spam filter, if it was opened, if any links were clicked. And I don't know if any of you have used Mailchimp, but it has a really, really rich and powerful reporting interface that there's no way you could recreate on your own. And then finally, consistent appearance.  And to actually have your email look the way you want it to look in all those different email clients is really, really hard to do. And Mailchimp's templating system, you know, ensures or at least helps you. I have a higher chance of your emails looking good on all those different platforms. So, you know, that said, the results. When I first started working with Mailchimp, there were about 300 reported installs of the module. About five, six years later, there's over 25,000 and growing. The list has been very linear. And, let me back up a sec. So with that, you know, I think that, I'll keep going, sorry. So the community gets a well-supported integration with a popular and important service. And Mailchimp gets new customers and respect from the community. These are, Mailchimp would have certainly gotten some of this work anyways because they provide a great service and they do a great job of marketing it. But by having that really well-maintained integration that we kind of promote together with them, I think that they gain a lot of respect from the community. There's a canonical module that we know works really well with the Mailchimp service. And that's more likely to kind of increase adoption. And again, it's not all altruistic. ThinkShell gets the hourly work from Mailchimp. We get some lead generation by being the authors of that module. And, you know, and to some extent, it burnishes our reputation in the community as well. So I'd like to joke around that it's, you know, truly one of unique win-win-win situations. The community wins. They've got a really great module that's really well-supported and maintained. Mailchimp gets to grow its customer base. You know, ThinkShell gets the benefits that I alluded to earlier. And it's definitely a good situation. So, I think maybe I'll skip the demo until later to make sure we have time for the other points. All right, so again, I think Tano's gonna jump in and talk about Salesforce next. So, yeah, next we'll talk about Salesforce a little bit. Imagine most folks are familiar with what Salesforce is. Gigantic CRM system that's out there. So our first encounter with Salesforce on our projects was in late 2011, 2012, where we had an organization forum of regional association of grant makers. I think I got that right. It's a pretty long name. And they needed a new association management system. And they wanted Drupal on the front end. They wanted it tightly integrated to manage things like membership access, interest groups, event registrations, all sorts of things built in there. So we created this great Trello board of high level features that we needed for this association management system. And one of those cards was this one here that I dug up recently that says Salesforce integration and a little bit understated here where it says big issue needs to be fleshed out. I don't know if we realized at the time what a big issue it was, but it turned out to be pretty significant. So a bunch of these associations were already planning to use Salesforce as their CRM. And we wanted to integrate that with Drupal. There was another group that was just gonna use Drupal for their CRM and we were gonna have a separate application for them. And we realized pretty quickly that pretty much all these groups were going to use Salesforce. So we had to figure out how to build this integration. So we could have just used Drupal, right? We had kind of started on Redhand at the time which is our Drupal native CRM. You could build theoretically, you could build everything in there if you wanted to. But it really just wasn't a great fit for what these folks wanted to do. They already had users that were using Salesforce. There was requirements within Salesforce that could have been recreated in Drupal or would have been extremely costly and really difficult to maintain. And that's a pretty common theme that there's certain tools like Lev was saying that really are best done elsewhere. For a simple application, the CRM within Drupal can work great. But for something as complex as what Salesforce can do, it's really hard to recreate that. The Salesforce ecosystem is gigantic. It's probably more than, much larger than this at this point but the app exchange environment is gargantuan. There's far more integrations there than there are with Drupal. And there are much different kinds of integrations than what you get with Drupal. You also have a really different mix of users where the folks that are using the CRM heavily are not always the folks that are producing content on the website. And it can be really difficult to convince those CRM users in an organization that yes, Drupal is a great choice for all of their CRM needs. So there's other reasons to do things like reporting can be really challenging with Drupal when you're starting to instruct users how to build views to create ad hoc reports. I don't know if anyone's had to do that. It's not a great experience trying to explain to people how to use that interface that aren't more technical. So what it comes down to is trying to find the right tool for the job. And in this case, Salesforce was really the right tool and we needed to figure out a way to make it work. Building on this a little bit, the idea of using these integrations really lets you extend the reach of your website in ways that would be very difficult to build natively. Drupal is great, but it's really not the right tool for absolutely everything you can dream of. So in trying to figure out how to build this integration, we started from the side of well, what are the key requirements that we need? And we needed a few things to integrate well with Drupal to be able to do all the membership stuff, event registration and the complex functionality that we needed. So one of those core ideas was we needed to be able to map Drupal entities to Salesforce objects. We needed to be able to set different fields to push and pull in different directions. So we wanted the email address to go up to Salesforce, but not to come back down, for example. Although that's probably not the right example because that does go in both directions. But there's other things that we didn't want to go in both directions. And we wanted the ability to customize. Like mapping interfaces are great, but there's so many edge cases that we needed the ability to say, yes, when we're pushing the membership field from Salesforce to Drupal, we want to bring it into this field, but we also need to validate it against these possible options and assign a user role based on it and do all sorts of other stuff. So we needed that extensibility and flexibility. We also wanted to have legitimate authentication and good authentication. So use the OAuth authentication system and then also use the REST API for performance and simplicity purposes. So, great. There's a Drupal module out there that does Salesforce integration. But it didn't really meet these requirements. So there was the 7x2x branch of the Salesforce module, did a lot of things, was used by a lot of folks, but really didn't meet our requirements for this project. So we took a step back and said, well, how can we modify this to do what we need? And ultimately the answer was no, we needed to rewrite it from the ground up to really fit those requirements. And so building on the idea that Lev was talking about where we try and build these modules in a really flexible abstract way so that they can be core building blocks, we started this Salesforce 3x branch. And the way this worked is we started off, so there's the form of regional associations of grant makers, call them frag for short. So we started off with them and it wasn't reasonable for them to invest the entire cost of rewriting this module. And so we made an investment ourselves, a significant investment ourselves into doing this. So it was really a partnership between our client and ourselves and rewriting this module. And we knew that long-term this would pay off for us because we would have other clients that we could then bring on to do Salesforce integrations and that really expand our business from there. And that's what happened. So we started with the forum and then we moved quickly, still while we were developing the forum project, we were working with another group facing history in ourselves, which had a very complex Salesforce integration, the Los Angeles Conservancy that was doing event registrations and donations through their website. They also needed Salesforce integration and these were all kind of happening at the same time. And then of course now, now that we've done this work, it's out there in the community, it's got over 1500 installs, that's really just the 3X branch of the module. Lots of other organizations are using it that we have no idea about and it's taken on a life of its own. But there's one critical thing missing here is that you don't see the Salesforce logo here, right? So unlike MailChimp, they are not official partners or sponsors in this module. There's a lot of reasons for that in part because they have sort of similar products. Their Salesforce communities product has some similar ideas and it's a per user licensing piece. It's a very different model than what a Drupal integration has. But when we talk to them frequently, trying to figure out ways to work together, but ultimately this module is supported by the community and the clients that pay to support it. It's a pretty different thing than MailChimp. We're not able to be quite as proactive in terms of things like upgrading to Drupal 8, which I'll talk about in a minute, adding new features, that sort of thing. It's a really great module. It gets incremental improvements as clients need things, but there's not a pool of money there just to support it. So I'll talk a little bit about some of the features which I think are, there's some really cool features that are in here. I'm gonna show you some screenshots of different things. So this is the mapping UI where we're mapping the Drupal entities on the left side to the Salesforce objects there on the right side. So you get to pick, I wanna map contacts of type general to the contact object in Salesforce. And you can even specify the record types in Salesforce as well. There's all sorts of interesting stuff with the data models in Drupal and Salesforce look really similar until you start doing it a little bit and realize like, well, bundles in Drupal have unique fields, record types in Salesforce. Really don't have that. They all have the same fields. There's not really any data validation happening in Salesforce, but Drupal's really aggressive about data validation. So it seems really easy, but it turns out there's a lot of little ins and outs to it. Next thing here is the field mapping. So we take for every mapping of objects to entities, you can decide what fields you wanna map. And on the Drupal side, you can pick properties. This is Drupal 7, so you've got properties, you have fields related entities. So if you have an entity reference or a text on any reference, and even relations, which is a little less popular or less known module, but we use it for Redhem. And then you can choose the directionality. So that's what I was talking about before. I want the membership information to flow from Salesforce to Drupal. There's really complex membership rules in Salesforce. I don't wanna recreate that in Drupal. So we just have one field that pulls that data from Salesforce and just goes in that direction. And then the last piece of the mapping is that you decide the triggers and whether it's asynchronous or not. So there's the action triggers. When do you wanna push things to Salesforce and when do you wanna pull back down to Drupal? And then the asynchronous stuff is related to the SOAP API. So when we did this rewrite, we primarily rely on the REST API. A lot more pleasant to work with than the SOAP API. You can do things all at once, push objects individually. Tends to be a lot more performant. But there's times when you do wanna batch things out. Maybe you're running against API limits. Maybe you're doing something that really doesn't need to happen real time and you wanna have a little bit more resiliency to Salesforce being unavailable or something, then you would use the asynchronous or the batch options. Some of the other features is we have this. This is a later feature that actually came from one of our clients facing history after the main push on the module had been completed. So they wanted to be able to see a little more information about what was happening with all of these syncs. They had a couple hundred thousand roughly contacts that were being pushed back and forth. And they wanted to figure out some of the problems that were happening. So we built this UI where you can, it sounds awfully similar to the mapping UI, but it's actually the mapped object UI. It's a little confusing. You can look at all the objects that are mapped and see what the history is. So you can see on here that these are contacts. There's the Salesforce thing that they mapped to, the object, and then you can see the history. So the last push was an error, and here's the error message. Or we've pushed successfully 10 times and the third time was an error, things like that. Very helpful for debugging the integration. Drupalate. So I mentioned this earlier that we don't have someone sponsoring Drupalate development on its own. It will be coming. We fully expect this, but we don't have a particular target date because we don't have a contract to say, there's money to do this upgrade. So it's dependent on client projects that are gonna help sponsor this work. It's gonna look really similar to the existing module. A lot of the reason we did the rewrite is we wanted to really leverage the entity system. A lot of that is very similar in Drupalate in terms of concepts. So we're gonna see a pretty similar module on Drupalate when we do do that. There are other folks in the community that are doing some work on it, and that's great. It's nice to have other folks contributing to it. We're definitely excited for our first big Drupalate Salesforce project. It's probably not too far off, but it'll take a little while to really get that momentum for us to do that. And I'm not gonna do a demo because the wireless is iffy. All right. So I'm gonna talk about Commerce IATS, which is a plugin for Drupal Commerce that integrates with the IATS payment system. So I know it sounds a little bit less exciting than MailChimp and the rich integration there and with Salesforce. And it seems pretty simple. You're gonna take some credit card numbers, you're gonna submit it to a processor and everything should be fine. And why would we even get involved with this building a plugin like this when you're doing exciting stuff like Salesforce or MailChimp? But it turns out that there's a lot more to payment processors than just taking credit card numbers. And the story of how we became maintainers of the IATS module is a little bit more complicated. That's what our maze demonstrates here. So our parts here are played by ThinkShot, that's us, over in the far corner you see Los Angeles Conservancy, which Tauno mentioned. We were building a site for them and so they already had a relationship with IATS and Drupal Commerce, of course, the Los Angeles Conservancy site wanted to take paid registrations and donations. And so we said, well, let's use commerce for it. This is a great tool in Drupal already. And they already were using IATS for payments. So how hard could it be one little payment integration? So here's the Los Angeles Conservancy site that we were to replace. This is an image from 2013. So they contracted with us to build their new site with ThinkShot. And a key feature of their site, as I said, was selling tickets. So they had this relationship with the credit card payment processor called IATS. And there was a Drupal Commerce integration module for IATS already. So here you can see the page for it at the time. Note that there are two total commits. There is a release there. And so we thought, great, we'll try this out. These commits by A. Dixon, who's a member of the community, great community work. There's a module for that. Cool, we tried it out and it wasn't quite ready for prime time. So needed a little bit of work, but here it was. Townhill, I think, reached out. Or maybe it was Lev at the time. And got commit access to the IATS module. A. Dixon was done with it. He said, I don't have a project for this anymore. So we started making commits in April of that same year, or of 2013. So worked on it a little bit and it was, we got it to a point where we could take credit cards through commerce and submit the payments and process them. And that worked, very basic improvements. And we launched in July 2013. LAC's new site, beautiful, all done. And commerce payment processing, entity registration, sales force. Cool site, and so we're done with that, right? We don't need to deal with this commerce IATS thing anymore. We're gonna be the next A. Dixon. We're gonna leave the module behind and say, well, whoever needs it next, you can make some improvements. We looked a little closer into IATS though. We talked to them or saw their website. And we noticed a similarity. So these are quotes from ThinkShouts and IATS websites. ThinkShout, we use technology and strategy to elevate organizations creating positive change in the world. That's coded language for we work mostly with nonprofits. And IATS payments is payment processing products to nonprofit organizations. And that's all they do. They only work with nonprofits. So we saw there's something here, you know? Maybe we should talk to these guys. So we reached out and started a conversation with IATS that went very, very slowly. So we launched that site 2013, middle of 2013. And the next year at the nonprofit technology conference actually had a meeting with IATS. And we talked to them and inspired by sort of the history of the MailChimp module. Super healthy. We convinced them that they should work with us and got contracted them to do maintenance, to do improvements and built a new version of the IATS module improving on a lot of the things that were wrong with the first one and could add features. And so this is the IATS module page yesterday. And our most recent release right now is 7x211. So we've had 11 releases on the module. I guess 12 with 2.0. And you can see the number of commits over there. There's over 400 commits. Most of those are, in fact, all of those people are ThinkShot employees. And it turns out that you can do a lot with the payment module. We added features such as doing direct debits instead of credit cards, doing direct post so that the credit card information doesn't touch your Drupal site at all and you can offload a lot of that compliance issues to IATS. We built a tool, you can plug in a USB card reader and run cards right there into your website and charge them to IATS. We built refund processing into the module. So now instead of just having a payment module that will do credit card processing, but you're kind of stuck there, we have full featured payment module and we can go to our clients when they want to use Drupal commerce and they say, well, then we have to process our own payments and we need these features that, you know, we could get from some other service that does it for us. So we say, we know a company that's focused on nonprofits, knows your needs and integrates awesome with Drupal commerce. And we also have some budget to do maintenance with them because IATS is taking care of us and when we're working together so that we can make improvements. We also helped IATS. Their API had a lot of functionality but not a lot of great documentation. So our team created some documentation for their API that they can now share with their other API builders. So we have a nice relationship there. Another nice thing about this, of course, is when the Drupal 8 question came up, we could go right to IATS and say, hey, we have some interesting work. We could build, you know, your integration with commerce for Drupal 8. So we have a roadmap for that. Of course, we are waiting on commerce payment plug-in specifications to be finalized so we can actually do that, but that's supposed to happen soon. Now, once we had a nonprofit-friendly, full-featured commerce payment processor, we sort of thought, what can we do now? We have these other tools. You know, Drupal commerce is beautiful and functional and does lots of cool stuff. We had built our own CRM into Drupal and we had this payment processor. So we thought, where can we go from here? One of the big things that nonprofits want is single-page donations. And they want to take single-page donations from people. They also want to ask those people questions and record that information and they want the processing to be quick and easy right there on the site. So that single-page donation form was something that was really hard to build with just commerce. And so we had to build a module to do it. And that led us to build a red-hand donation, which is a tool you can integrate with red-hand and commerce and create single-page donation forms. So when we go and talk about building this for clients, we say, yes, we know a payment processor that does work with our customizations to how commerce behaves. It will work with any mature functional payment processor for commerce, but we know it works with IATS. So that's been really valuable. In most of the instances in which we've built red-hand donation out, we've used IATS payments. So you can see this is a, the screenshots sort of broken up because this is a long form. But this is an instance of the single-page donation form. Put in all your information, select a donation amount, put in your billing information right there. That billing information gets dropped into the CRM. So you get, you can send that person a letter in the mail and you can record that information long-term as you're tracking your relationships with your constituents. And it processes the payment right there and it creates a separate table of donations so you can do reporting on that with views. It matches with your existing CRM data based on email address. So if someone comes and makes a donation and you already have data on them, it updates the address you have in the database for them. So pretty cool stuff. This also supports commerce recurring and commerce card-on-file. So we worked with IATS to make sure that their payment processor was working with commerce card-on-file module as well. So you can do recurring donations with these forms. All with point-and-click configuration. So we were really excited about this and so were some other folks and we decided to take it further and build a social fundraising distribution. So based on Red Hen donation and Drupal commerce, we built Red Hen Razor, which is a fundraising tool, a social fundraising. So you can create campaigns, get other people to join your campaigns. Obviously there's some sharing tools in there. Check out leaderboards and compete with other groups to do fundraising stuff and you can do it all in Drupal. So you're capturing all your own data and you don't have to get exports from some other service you're paying to do this stuff. And of course it has the full Drupal ecosystem and you can customize everything that's in it with the power of Drupal. And you can process your payments through commerce and the IATS module. So the original instance of this was built for the Capital Area Food Bank of Washington, DC and they've already raised $400,000, over $400,000 with this tool. And you can also, if you wanna play with this, by the way, you can go on Pantheon and just like point and click install it. This distribution's right there. So cool. So three integrations we talked about, all very different in their way, but there are certain threads that go through and lead to successful integration. I think the one that we've talked about the most is actually having the official backing and support of the organization you're integrating with our tools. So we have that with IATS and MailChimp and that's great. We get consistent funding from them to do issue maintenance, to do support and to keep making enhancements to those modules and you can see it in the release history for those modules, they're consistent and we get patches up for things. And that's awesome and we love that. Obviously the win-win-win situation that Lev talked about. There's also a big deal with the stamp of approval sort of saying this is the official integration, right? If you look at, I think, Instagram, there's like a couple of different integrations out there and if you go and you're looking for the tool to use for one of these services with Drupal, you know who it is and so that's sort of the stamp of approval there. So you can make no ambiguity about what tools you should use. So the other thing is that there's this advantage of the sort of functionality fast, right? We talked about with Salesforce, you could build these reporting tools with MailChimp, you could build tools to send out your own campaigns and the same thing with IATS payment processing, you could probably build your own payment processing tools but you get that functionality very quickly and you don't have to worry about the details. If you integrate with somebody who's already doing that. Also, Drupal makes a great hub for all of these so we have a lot of sites that use all of these integrations and more, Drupal's really has a very flexible architecture and really sophisticated data structures so it makes a great platform for integration so you can jump into any of the process of the life cycle of an entity and fire off your integration right there. And of course, the other big advantage is the community engagement and community alignment. We all know the power of the Drupal community and I think the thing that happens with MailChimp, for example, we have MailChimp hats at our booth today, we can sort of cross market and be coordinated in the way we both address the community's needs so MailChimp comes to us and we're the experts on Drupal and we can go to MailChimp and say, what can you do for Drupal and what do you want Drupal, the Drupal community to know about you and to learn about your services. There are a lot of sort of advantages to doing integrations and not just building everything out on Drupal. I think that you sort of see what some of those are. Now I've got the standard slides here about joining us for sprints. I'm sure you've all seen these, but we'll take questions about our integrations or about the sort of process of building integrations if anybody has them. I don't know the fees at the top of my head. IATS is very affordable. I mean, they're target non-profit community that's very price sensitive. So I think they're cheaper, but I mean, most payment processing services in my experience very close to like 3% per transaction. I believe IATS is less than that. Right. Well, the Salesforce Foundation itself offers free Salesforce to nonprofits. And as a result, the nonprofit world is really psyched about Salesforce. A lot of people come to us saying we wanna use Salesforce. And then you have folks who are in the nonprofit world who learn Salesforce, learn to like it, go to other organizations and want it again. So oftentimes, people come to us with Salesforce in mind already. I think that reminds me of a lot of the ways that our modules have developed in the past, which is oftentimes we'll build it for a very narrow use case, and then wait for someone else to want the similar thing and then expand it from there. We're in a different place there where we're dealing with multiple clients so we can look for those opportunities. I mean, my thinking is I think if you can hire a developer who is comfortable doing those things and you have the resources to do that, then that's gonna be a great option, especially if you get it out there in the community. Then other people can start using it, giving feedback and giving other contributions. I think that's the starting the snowball sort of technique. I think the other thing you can do is build it for your needs, but do put it out there, even if you can't release it as a 1.0 release, even if you release it and say there's some code in here that isn't abstract, but put it up there for the Drupal community to see and for other people to work with. Let somebody else abstract it for you. Well, I mean, we talk about our integration so people know they're out there. I think that's it. I don't know, we're pretty careful about making sure you get the right name space, you know? Name it something that people are gonna find. Lev? You're the eyeballs guy. Or like what happened to MailChimp at the beginning before the, oh, I'm sorry. So that's a really great question. It's a topic that's near and dear to our hearts. Probably the ones who don't be honest and talk about it more, but that's the general space, and I'm on the private sector side, marketing innovation is a flavor of that. So I think it's a really exciting idea, and we have the Salesforce of bidirectional sync and we want to store all of the... You mean specifically with the payment processing, or? No, no, it's, you're not missing it. Counting departments tend to be very, very specific about what they want, so for most of the folks we work with, we put a layer between the accounting and the data sources, so either if we use Red Hen CRM or Salesforce, we'll have reports or exportable views that the accounting department can use to get the data they need so they can manipulate it and look at it exactly the way they want. Salesforce does have some integrations with accounting software, so if we use Salesforce, Salesforce is usually the database of record for any financial data or contact data, and so that becomes like the sort of central hub. Drupal feeds data into it, and other sources feed data into it as well. Manually entering check donations, things like that, and then the finance team pulls the data out the way that they want it. So yeah, that's a good question. It's a pretty challenging space because of how specific and picky finance departments tend to be. Yep. QuickBooks, Financial Edge, what are the other ones we hear a lot? No, there can be with, so like the Salesforce world has a lot of integrations, so on that level you could do it, but not direct from Drupal. We haven't done any direct integrations. Yeah, just running reports. Anyone else? Questions? If you do think of any more questions, please feel free to get in touch with any of us. We got a booth, 216, and Think Shout is, you know, we exist on the internet and you can find us there. Twitter, email, whatever. Thanks.


A very good afternoon Honourable Prime Minister Mr. Modiji. I am Mohan. I am a stand president of booth number 238. My village name is Chenna Panayur from Perambulur Lok Sabha. Dear sir, I proudly saying today I got a greatest opportunity to talking with such a greatest, strongest leader of India and also world. With your permission, I have one question to ask with you. Shall I? Please. Please. Mohan, every worker has every right. Thank you sir. First of all, we want to thank you for the recent GST decision that will benefit MSME sector. Tamil Nadu is the hub of MSMEs while earlier government became famous for giving loans to big businesses. Yours will be known for helping small businesses what drives your belief in the MSME sector. Thank you sir. Thank you Mohan. Thank you for your question. I am not surprised that a Kairakarta from Tamil Nadu asked a question about MSME sector. The Tamil people have always been known for their spirit of enterprise. Even in mudra loans, given for small and medium entrepreneurs, Tamil Nadu is one of the top recipients and for that I must congratulate Tamil Nadu. Let me tell you why I greatly respect our MSME sector. When it comes to India's growth story and the role of small industries, small is big. Small industries may seem small but their impact on employment is big. This is a sector which employs a large number of people. Small industries may seem small but their impact on bringing people out of poverty is big. Small industries may seem small but the hearts are big. They believe in a dream and they take risks for it. This takes a big heart. What is a government's duty here to believe in the dreams of its entrepreneurs and to help them make it a reality? This is why we have helped small industries with big reforms that are making a big impact. Our commitment to MSME sector is all for all to see. 15 crore collateral free mudra loans are a proof of how much we trust the MSME sector. Our 15-9-minute loan approval initiative is a proof of how much we trust the MSME sector. The fact that we have mandated public sector companies to buy 25 percent of their needs from MSME sector is a proof of how much we trust our MSME sector. Many people think ease of doing business helps only big companies. In big glass buildings, this is completely wrong perception. Ease of doing business helps our MSME sector and small businesses the most. Easy access to electricity, quick online approvals, transparencies, these are all helpful for our MSME sector. You mentioned the recent GST council decisions. From day one, we had said that we will keep improving GST as we move ahead and make it simpler and easier. All this has been made possible by the feedback of the people. The limit of annual turnover for availing the composition scheme was increased from Rs.1 crore to Rs.1.5 crore. This will help more smaller businesses, allowing them to pay tax at a flat nominal rate and reduce documentation needs. No clerical work. For suppliers of goods, the exemption limit for registration and payment of GST has been raised to Rs.40 lakhs from Rs.20 lakhs. This means that a supplier of goods does not need to register with GST if he is run over Rs.40 lakhs. This will help a large number of MSMEs. Free accounting and billing software will also be provided to small taxpayers. Making business easier also means devoting special focus where needed. Tamil Nadu is famous for its textile industry. We had taken steps to boost the textile sector specifically. To ensure that more and more people are employed in this sector, the government bears the entire employer's contribution of 12% under the employer's provident fund scheme for new employees of garment industry. I am happy to note that our Kair Kartaj in Tamil Nadu are actively following what is happening in the GST council. Let us keep sharing the people-friendly decision with people in our booth and especially with MSME and traders.


Hello everybody, this is Ahin and have the pleasure to present our paper entitled as second order security with almost no fresh randomness, which is a joint work with Amir Maradi. Masking schemes are one of the most popular content measures against side channel analysis. And, which is based on randomizing sensitive data during the execution of the cipher. So in masking a scheme, we usually divide the sensitive variable into some shares and the which make or forces the adversary to recombine the shares to recover the key. But how we can evaluate a given mask design. So to this end probing model was proposed. So adversity can probe the intermediate values and each probe are exact and independent. And it has been shown that security in this model also provides security in other models. And if any decombination of intermediate values does not reveal anything about the circuit, then the design is secure against these or their side channel attack. And due to its simple basis and seem due to its simplicity and its abstraction, probing model is basis for many proofs in such an analysis. However, it does not properly work in hardware implementations. And the reason behind these is glitches glitches are unwanted transition at the output of a combinatorial circuit. And these five usually are mainly due to the unbalanced path of the input of a combinatorial circuit. So, in this model when a probe plays on a gate, it propagates backward up to last synchronization point. So here is a simple logic circuit. So if you probe the output or one of the output, the probe propagates backward and the adversity have information about the all for input beats that are involved in the calculation of original probe. Tertial implementation is the first methodology which is immune against glitches. TI or tertial implementation is based on three condition correctness non-competence and uniformity, and the number of input share depends on the algebraic degree of the target function and also the security order D. However, D plus one sharing is independent of the algebraic degree of a target function and I here I brought a simple to input and gate first order secure design did a single bit fresh mask. So, in this methodology, the mask version is divided into two parts. One is called component function. So you can hear one of them here with this box and we have a register layer and each component function should be registered. And then we have a compression layer to generate two output shares. It has been shown that we can have a first order secure to input and get visa fresh mask in this paper. And the question is, can we extend it to the second order or not. So here I recommend to watch my presentation. About the paper reconciling first order masking scheme, because this is the extension of that algorithm and probably might be helpful to watch it before. Watch this video. So, let's start with a very simple to input and gate. And we would like to have a second order realization of two input and get two shares. So it forces us to use nine component function as you can see here to have second order non completeness. So the construction will be something like this we have nine component function register layer here and the compression layer here. So we want an algorithm to find a uniform sharing, which means a X one X zero and X two should be uniform and also the entire design should be glitch extended probing secure. So to this end we follow below steps. We make the set FL, which means that F zero to set F eight because we have nine component function, and each of each includes all two input constant three coordinate functions. So for example for F zero, which gets all zero and B zero, we have four different coordinate function, namely all zero B zero, all zero B zero plus all zero, all zero B zero plus B zero and also all zero B zero plus all zero plus B zero. So each set is one. And then, if we assume that F zero F one and F two are compressed, then we search for a top of which is glitch extended probing secure and also their X or which means that in this case, if I go back to the last slide, X zero is a balance function that the output has as many as one as zero. So what glitch extended probing secure means. So we have this construction. So it should be secure when I when the attacker put to probe on one in on F zero and one on F one. Because F one and F zero or second order non complete so we don't need to check a this one as it at most have two shares out of three shares. So the next one that we should check is one probe on the X or in the compression layer and one in the component function. So because of glitch extended probing model these will expand to three here. And we have to check these four probes and check the security of them. And then we have to check the next one and also the probe on the F two, which is a component function. Once we found find the top of which will face these checks and also secure in glitch x and the probing model, and also their X or which means that X zero is balance function then we add these, these functions to the set F zero one to and do we do the same to make two other sets and as the last step we search for the top of whose X or make a correct sharing so in tertiary implementation we make something correct and non complete and then we search for uniform sharing by adding correction terms but here we at first have something non complete and second order secure in glitch extended probing model and also uniform and then we find something correct and we see whether is there any correction or not. But it's not the end we have to check some more probes. So we get the first element from this set and the next one from the other set and the last element from the last set. So, so far we check whether these construction these construction and these concern is second order secure or not but we have to check whether if one probe is x zero which is expanded to three probes here, and also one probe on the other element means F zero here F three here is secure or not. So we have to do these checks as well, and then the other probe on this one and this one. So we have to put another probe on X one and these four should be checked but this one expands to three more probes or these set of six pros should be checked whether it's secure or not. And basically it has identical joint identical joint probability distribution or not. So we have a secure design, which means that this element and this element is secure we should do the same for this element and this one basically one probe here in the x zero which is expanded to three, and then one in each component function and one on X two. So we have to check this element and this element and see whether it's second order secure or not. And the last step is, whether this uniform or not. And if it was uniform and also have a correct sharing, then we found a solution. So as you can see, compared to the first order security it has way more checks, and the complexity of the algorithm is pretty high. So the application of this technique on to input and get the without fresh marks and with a single bit freshman leads to no solution, but we had, we have found many solution with two fresh mask beats for index or function which is a obby plus C for input variables for obby and say we have millions of solutions without fresh masks. So this motivated us to apply our technique to forward quality projections, and we know we have six classes of quadratic projections, and which means that using one of these classes and tool. We can build any forward quadratic projections. So we start with the simplest one, which has only one coordinate function, which is, which is quadratic here. And we already studied an index or, which is basically this coordinate function, but all solutions are not necessarily a joint, a jointly uniform solution so we search for a uniform sharing, and we found more than 500 solution which is the second order secure and also fulfill the joint uniformity. And of course without any fresh masks. So we further studied the next one. This one is a more a bit more complicated. It has two quadrant function with algebraic degree of two. Of course it requires more checks on because the attack I can put one probe on this coordinate function one in this coordinate function. And basically one on the compression layer of the first and one on the component function of the second one and the other probability is to put one probe on the compression layer of this coordinate function and one and on the compression layer of this function. We also found many solutions without fresh masks. And we also applied our technique to other quadratic projections, and we found some solutions. However, we found no solution for q 300. And it's not possible to realize three shares second order mask variant of this one, because basically this the coordinate function has all three month quadratic monomials of three inputs. But this class can be decomposed into two quadratic by junction. And we can make those decomposed functions a second order secure, but at the composition, we need some fresh masks. So here we have F and G, which is quadratic. So we should add some fresh mask in the compression layer and store the result in the register to make sure that the design, the whole design is still second order secure. So F is second order secure G is second order secure but composing them, not necessarily is second order secure. So because of that, in the compression layer we add some fresh mask, store the result in the register and before giving it to the next function and if the output of the G also goes to the another function nonlinear function then we should add some more fresh mask here. So as in cases study we applied our algorithm to catch up and catch up has a five with this box with quarter to coordinate functions. And you have designed a two share, which means the first order and three share Jesus. Second order round based implementation of catch up without any fresh mask. I would like to highlight that this is the first time the second order secure catch up without any fresh mask is presented. So here is the synthesis result. So as you can see we have we use no fresh mask the area overhead is roughly the same but we have a bit more delay. So basically the critical pass. So the next is the case study is skinny the for this box of skinny can be decomposed into two quadratic function. So you can see here and three affine functions, and all affine functions are a bit permutation and negation of the input and output so this means that you can construct a skinny encryption function with only eight fresh mass as you can see here. And then, as I said before, we have to add fresh mass at the interconnection of the two quadratic function to ensure the security and because affine functions are just bit permutation. We don't need to place any register here so basically we have one register before this box and to register layers before the compression and also one register after compression of the first quadratic bijection. So the next case study is Midori, it's pretty similar to the skinny, we can decompose it into two quadratic function, however, affine function are not just bit permutation like Midori so we can decompose it into quadratic function and basically integrate the a three into the this quadratic function also a two to the the other one and make the G and F. So basically we have two new quadratic bijections and we can apply our algorithm and it and we found more solution and actually we need more checks because of a one because the attacker can put a probe on a one on the X or and put one probe on the compression layer of F or compression layer of G. So, we have found several solution for F and G and as I said before we need eight bit fresh mass to connect or basically compose the G and F and the result of the A1 should be stored in register. Here is the general structure of the Midori and as I said the output of A1 should be stored in the register at the interconnection we need some fresh masks and before connection you always need register to ensure glitch extended probing security. So, the next case studies are present and prints and present spots also can be decomposed into two quadratic bijection like Midori and Eskini, and I'm not going to repeat the procedure for the present this box. And for prints, in the encryption function of prints, both S plus and its inverse are used. So, as a matter of fact, none of them can be decomposed into two quadratic bijection. So, we decompose it, the S box inverse into three quadratic bijection, which means the H, G and F are quadratic bijection and you have an input F on A1 and we should store the result of the A1 to the register and then compose the F, G and H. And as before at the interconnection of F and G and G and H we need fresh masks to ensure the security. To implement the S box we used the affine equivalence property of S box and S box inverse of prints which means that which means that with affine function A we can implement S in the round function. And basically we implement a secure version of S1 and we place A at the input and output of this inverse to implement this. So, here is the result. The S box has a security order tree with only three shares, we need only eight feet per S box. And the same hole for the Midori and present but prints is decomposed to three quadratic functions and as you can see the number of fresh masks is reduced. The area overhead is roughly the same as the state of the art and is very better than some proposed designs and actually the throughput of our design is the most in the prints. We have a work on present which this is only an S box implementation which needs more than 500 bit and more around 150 clocks like to perform only one present S box which is second order secure. And which is the cost of our implementation is extremely lower compared to the state of the art. We evaluate all our S box construction with silver, which is verification tool and does not simplify anything and has not any false positive or false negative, and we check our construction under the glitch exam the probing model. And because analyzing full encryption module is not possible with silver we implemented our design in FPGA and collected traces and perform the T test and all of the design were secure using 100 million traces. So, in this paper we introduce a methodology to achieve three shares second order secure implementation of quadratic functions without any fresh mask, but we need fresh mass when we are going to compose them. We also presented first order and second order secure design of ketchup without any fresh mask. We also applied our technique on some light with block cycle like a skinny me do your present and prints and presented second order variants of them. Thank you all for watching my presentation, please do not hesitate to contact me if you have any question or if you have any suggestion. Thank you very much.


So I'll just launch into it straight off, see this voter ID, UID link, which is being proposed now, like we all know is not anything new. The idea has been forever that this will be, everything will be linked with everything and the UID number will be, should be found everywhere in every database. This was the original plan, this was the conception, so it should not be surprised that it's happening now. It's just that it's not a good idea. What is more recent is an admission, if I can call it that, by Mr. Ramseh Vaksharma and AP Singh on behalf of the UID AI when it was started. Speaking as founding members of the UID AI, they have said, and it's on YouTube now, they have categorically stated that this UID AI and the database that is created was not created by them, thinking that it would be of use to the government, but that it could be used to create a digital economy. That is, it's there in the other 2.0 proceedings. It's on the session that they had on digital what's it, commerce, digital, what do we call ourselves, a digital economy. So it's in that session. So it's kind of open now and there is no doubt at all about why this was created. This is very useful to know because it also tells us why exclusion, which has been caused by the UID AI and by the way that database works, why exclusion has not been a problem. And that to create a business infrastructure and in 2018 when the case was being argued in court, Mr. Nellakini wrote an article in the paper where he said, listen, this is really not just an ID, it's creating infrastructure, it's like creating a road, anybody can use that road and that's the purpose of this whole exercise because it will boost the economy. So I think one of the, from the time that we started, that the project started where they were saying that this has to do with delivering services, that the poor need an ID, that the poor need to do whatever it is that they need to do whatever they can to be able to identify themselves to the state and that that is the purpose for which this whole project was started from there to the admission now that it was never intended for the state. In fact, they use very interesting language where they say that the state is now holding this captive, that they've usurped this system, which was never meant for them and they are advising Mr. Ram Sehwaj Sharma and APC are advising the UIDA that it's time for them to stop being a regulator and for them to take it back and give it back to the digital economy. So that's something that I'm stressing on because I think we need to be very clear that they are not, if we listen, we can hear what's being said and that will help advance our understanding. The second thing is just a brief on what is this database with which the voter wants, voter ID, election commission wants to link it. What kind of a database is this? So we know that it is a database that was started. I think Debushesh Basu says it very well in his piece for the business standard, which is titled Torture Under Transparent Taxation because now you have income tax proving to be a huge problem because the way in which that income tax system has been the digital system has been rolled out is proving to be a huge disaster. So why is he is angsting about it, right? So thorough testing before the launch and continuous debugging through feedback after the launch are the cornerstones of any software development. Amazingly, a tech savvy government, which has digital India as one of its missions, didn't do this adequately. Remember, Aadhar and Boots and Services Tax were launched with the same attitude, no need to test or bother about feedback. So this is what that whole project is characterized by, that you launch it, you see how it goes, you see what works. There is a whole population that's waiting there to become experimentally-delete experience. And these are now known positions. So there is very little to debate on. What is interesting about this, though, is that one of the persons who's been pushing for this is Mr. Kureishi, who's actually quite a liberal kind of person with whom one can hold a conversation. But on the UID, he seems to think that that's fine. In fact, in one of the interviews, he says, Nandini Likini came to my office and told me when I was there that it's a good idea and we decided that we will link these two. We have seen that throughout this project, it is marketing of this idea rather than actually, you know, figuring out what is happening, what this project is about, that's what has been characterized by. It's just marketing. So we find I was actually intrigued when on 9th November year before last, when when Mr. Ramseh Vaksharma's book came out, they had a discussion on and after discussion in 2020. From October 31st, there was an there was a expose.  I mean, from October 31st till well into December, almost every day, there would be an article about how minorities, scholarships had got siphoned off and how the UID was used for the siphoning off and it just required three people, the principal of a school, a business correspondent kind of person and one other, you know, the person who's operating the machine for them to be able to get together and siphon off a whole load of monies that were meant for minority scholarships. And so this started on August 31st and on 9th November of 2020, you have this discussion on Mr. Ramseh Vaksharma's book and there are four bureaucrats who are sitting there and having this discussion and they seem completely oblivious to there is any problem at all, that UID has not that it has produced any problem that people are having difficulties with it, that corruption is actually being fostered through this and that, you know, it's very important that the Indian Express expose, they did not expose it as something that was happening in the government. They got information from activists in the field that this is happening and they did an investigation themselves. The system hasn't responded to this at all. So now they've referred it in 2020, they referred it to the CBI, they referred it to a whole host of people, nothing has happened. Two days ago we found that there was a, you know, in Delhi, Delhi High Court, it's a case that was registered for the court in 2020 January and in 2020 January, the court is telling them because there were some 400 and odd people who accordingly the charges that a district magistrate had taken all these, who is himself from Rajasthan had taken in all these people from Rajasthan and enrolled them as having Delhi addresses so that they could apply for a job in the DTC and somebody filed saying that listen, it needed domicile, these people don't belong here but it was a fraud that was committed. So there's a case that's been that he wrote to the Delhi government, the Delhi government filed a case and it hasn't proceeded because the UIDI refuses to cooperate. So it's a, we're reading things like this every day and it amazes me that you have whole bureaucracies which say we have no idea what any of this, this is technology, this is fine, there is no problem, if there are problems here and there we kind of sort it out, we figure out what we do but we are not going to acknowledge the kind of problem that exists. This is the project and this is the bureaucratic response to the project. We also recently saw meaning like yesterday, Money Life had out an article where they said that as a, they had written about an RTI that they filed where they said that 8 crore, 8 crore updates every year is what the UIDI says they manage. So it's 7 to 8 crores, they don't give you the breakup, they say we don't know what the various breakups are, it could be for address, it could be for name, it could be for mobile phone, it could be for whatever, for biometrics but there are 8 crore updates that happen all the time. So this is what, which essentially means and I'll just move from there to this thing called the target report which I'm sure many of you have seen where the target report was given in 2011 January and Mr. Nilakani was its chair and they had said, it was about all these revenue systems and how the revenue systems have to be, what's the best way to deal with them because you have to introduce technology. So tag ups stood for technology advisory group on unique projects and in that, in the sixth chapter in the report, they have a thing called, they talk about what they call a self-cleaning mechanism and I'm just going to read two, three lines from that for you. As the saying goes, this is about data quality, as the saying goes, garbage in, garbage out and IP system is only as good as the data it consumes. The system design should have a self-cleaning mechanism. For instance, for example, the UIBAI proposes to authenticate the identity of a resident based on data they have provided during enrollment. The system is self-cleaning and please listen to this a little carefully. The system is self-cleaning because it is in the resident's interest to ensure that the system has correct data in absence of which he cannot authenticate his own identity. So what they will, it is through incentives and it goes on, further clean data can be insured by standardization of processes, matching and verifying information, work flow, simple and well-defined open platforms, blah, blah and penalization for non-compliance. It is through incentives that data quality can be managed rather than micromanagement of stakeholders. So it's a fascinating thing where they say, if people need to be able to use their identity as reflected in the ID system, it is up to them to clean up their own data on the system. And this links up with why people have to keep going again and again and again to the UIBAI to clean up their data. This is a self-cleaning and this is what the election commission wants to depend upon. We know that the process by which the UIBAI created its database and the process by which the election commission constantly works at keeping a good database are completely different and that the election commission takes on a responsibility and a role in the creation and continue an upgradation of that database constantly because that is its job. Its job is to make sure that people do have the right to go and that people should not be obstructed because they are told that you don't have an ID. That's also the reason why the election commission does not confine itself to only one ID being a relevant ID and there's something that you can use. It's not just the voter ID. There are a series of IDs which are government given IDs which they say can also be used as an ID for people to go and vote. Now by linking it up with the UID, they make the UID the basis for even the election time for the voter ID. So the absurdity of its kind of beats me. I can't understand why somebody who's worked so hard to create a proper electoral role will end up, you know, we'll say that okay we'll link it up and we will depend on a database that has been created without any process. You just have en-rollers who can sit anywhere to have common service centers which sometimes shut down sometimes because they're all commercial spaces and we have seen through the years, you know, starting I think from maybe one of the one of the early ones which hit the headlines was what do you call it, Dania getting a voter ID, not a voter, sorry getting en-rolled on the UID. Then you had a person in Hyderabad who's supposed to have en-rolled over 800 people as biometric exceptions except that he couldn't have done it because he had already been thrown out of his job so somebody else was using it. You have the Kanpur fraud where you found that they could also, you know, they could put things in, they could take things out, they could create IDs. You have the Rajna Khaira investigative report that was done, it goes on. It's like endless and none of these get acknowledged. Finally, we have however this Indian Express report has finally found its acknowledgement in a government document and I think we need to know, we need to see what it is that they are saying. This is the Ministry of Social Justice and Empowerment which very recently, very about a year and some ago, they have, you know, about a year ago, they've said they're talking about, you know, the minority scholarship scheme and how that got hijacked. And they said three central sector scholarship schemes namely pre-metric, post-metric and merit come means are being implemented by the Ministry of Minority Affairs for six centrally notified minority communities. The committee, the committee are quite disturbed by cases reported about the alleged misappropriation of funds, funds going to fake students under these scholarship schemes for children belonging to underprivileged minorities in six states which are under investigation inquiry. In one state after inquiry, the fraud is stated to have happened due to passwords leaked by certain vested interests as well as other book ports. Taking advantage of illiteracy, lack of awareness among parents and children of minorities is also exploited by such elements. While the ministry representatives have always been claiming that the system is fail safe due to all transactions, verifications done online, a dedicated portal, cash transfer through DBT and similar measures which are definitely the need of the hour, it is disconcerting for the committee to observe that such instances of corruption happened. However, minuscule, this must have deprived the genuine beneficiaries of government scholarship schemes and may lead to some children dropping out to being unable to afford the school fees, other expenses. During this evidence, the ministry representatives informed the committee about further safety measures. This is last year, okay, so this is 11 years after the project started. The ministry representatives informed the committee about further safety measures under their consideration, for instance, preserving the files of scholarship for the students for a period of five years, creation of an Aadhar ball in coordination with Meti, requirement of signatures of school principles in verification, report filed by teacher, at least two persons physical verification, creation of student data bank with the help of department. So the number of things that they have to do to remedy the problem that has been created by the UID is quite stunning. And we find that, you know, there is an, this report I found was fascinating also because there is nothing that they've received from the government. There is no investigation report, there's nothing reflected in this report. So what you find is that they are looking at, you know, they are looking at newspaper reports and saying it seems this has happened and it seems that has happened, absolutely no input from the government, except saying, oh, we'll open other walls after this. So, I mean, election commission, I think needs to understand what kind of a system it is that they are dealing with. Now we, you know, let's just look at two other quick, you know, two other reports quickly. You find that Mr. Rijiju had said that actually, some standing committees had already okayed the linking of UID with voter ID. So why are people complaining now? Now when you go and look at what is this place where they, where they are supposed to have said, okay, you find that this is report number 101 and report number 105 in 2020, in March and September 2020 on the demand for grants. Now in the 101 report, they are talking about the election commission having launched that 2015 purification authentication program to weed out bogus voters by using unique ID Aadhar number, which has to be, which had to be suspended because of the Putta Swami case. And then they go on to say the commission has approached the law ministry for appropriate legislative backup for which amendment to the representation of the people at 1950 and the other act 2016 is necessary. By this process, there would be an, this is significant too. By this process, there would be an inclusion to the privacy of the individual. But the objective of purifying electoral role will serve the public interest. That's it. No other explanation offered for why privacy should be given a go by. And it's important, I think, here to just pause for a minute and see that, you know, privacy means different things in different places. The most significant thing in terms of privacy, I mean, at this point, I would think are two, one element or three, one element of privacy is that you should be able to reflect yourself as you are. And if that gets taken away, that is also a violation of privacy. So if I'm not able to say, if I go there, if I come to and say, I'm sure, and you say, no, you're not sure at all, that's actually a violation of my privacy, if I can't establish who I am. The other thing is that this is about the secret ballot. I would have thought that in all this consideration that they have, they say free and fair election, that it should be a secret ballot should be one of the most significant. And the moment you link this up to the UID. And at this point, I mean, I'll just read the last line of this and move on to that. It says here, it was therefore pleaded that the purported invasion of privacy may be permitted for linking voter ID card with Aadhar number. Now these are not permissions that the government can give, these are constitutional protections. So here you have a threat to the secret ballot. And the third thing is that it's not, the moment the voter ID is going to tell the UID, UID AI, that this is the person who we are looking to authenticate. UID AI then has that information. And that number, the person that number holder will find, because you have no choice today, they have to put their number in various databases. All of us know what is being done with us. So they have to be in multiple databases. And linking these, I mean, this idea of convergence, Rahul Mathan, who otherwise supports the project, the only thing he concedes, and this was also the first try legal report, was where he said that convergence of data can happen. And that's something that should be watched against. AP Singh, Mr. AP Singh, when he came to the Delhi School of Social Work, and when we had a discussion on this at that time, he said, the rest I'm not sure about, but convergence, it is true, will definitely happen. So we are talking about punishing people if they are not going to be voting the way you wanted to be, knowing about people in the first instance, huge possibility of manipulation, because you know so much, the government knows so much about all of these things. One question that could be asked is why do you say that the government knows nothing, this is the UIDIA, and that it's an independent agency. But when we look at the other act of 2016, we find that the government controls the UIDIA. The government under that law has the power to give directives to the UIDIA. And if the UIDIA does not follow its directives, it can take it over for six months at a time. So we are really talking about an extraordinary kind of thing in that law. And so for the election commission to say that they will bank on something that is entirely controlled by the central government is a very strange position in which we find ourselves. I think it's also useful to look at other provisions of the other act. I'll mention only one more, which is section five. Now if you look at section five, if you look at section five, it says special measures for issuance of other number for certain category of persons. The authority shall take special measures to issue other numbers to women, children, senior citizens, persons with disability, unskilled and unorganized workers, nomadic rights, or for such other persons who do not have any permanent dwelling house, and such other categories of individuals as may be specified by regulations. This provision was an indication of all those who the UIDIA recognized even then are likely to have difficulty in getting enrolled. And then you have a problem in 2019, they had to say, okay, if your biometrics don't work, if you're not able to authenticate yourself, then locally they should deal with it. This is a system that has admitted that it doesn't know what has happened. I'll refer to only one more document and then we can come back to it later. And I'm forgetting what the document first wanted to refer to, it came to my head and moved out immediately. But so let me move to the last thing that I want to say, which is that the UIDIAI, and this again is said by Mr. AP Singh at that other 2.0 meeting, where he says that there was magic that was created by the project and that magic play in 3 numbers. And those 3 were Jandan, Adhaar and Mobile. He said these 3 linked together can produce magic. And he says we have already created the system which houses the magic. Now it's for the UIDIAI to make sure that this magic is actually realized, which is basically to say that these 3 numbers put together will identify people in various ways, which will allow for various businesses to be built on the personal data that can be acquired through these 3 numbers. The UIDIAI, the election voter ID does not require all this kind of information. Voter ID requires that it's only about ID and saying where you can go. That's it. So there are two arguments, I mean two things that they say that one is deduplication and the other is about migrants being able to work. Now on deduplication, there is no evidence that they give you at all to say what is the extent of duplicates that they have noticed. What is the difficulty that they have in the other systems that they have in place for them to be able to deal with deduplication. I mean is there a duplicates, isn't the system that they are doing also producing some kind of result, is there no other way by which you can do it. Because in the violation of a fundamental right, one of the principles of proportionality is that you do not violate it. You put instance right to privacy, you will not violate it. You won't violate it unless you simply have to and it will be to the minimum that you need. Here they haven't even said what the extent of the problem is and if they don't know the extent of the problem then they have no actually no right at all, no constitutional right to use this. The second thing is when they talk about migrants, so actually there is no evidence on deduplication and I think we really, really need to demand some kind of information on this because the same thing happened with fan clubs. They just said and that was it. There was no need for them to establish anything more. On migrants, they say that of course Mr. Nelligini in a recent interview on this new book has said, oh you know the migrants they go to the cities and then they are not able to vote there. They just have to vote there and change their address and then they'll be able to go and vote you know where they are staying there. So it's a very glib way of treating this and of course the easiest thing according to them is that you can change the address at any time. So I'm not sure what kind of a protection that that provides to ensure that you're a voter. Maybe I mean I'll be a voter somewhere one month, somewhere else the next month depending on where the elections are. So it's a very strange and skewed way of looking at this but apart from that if they decide that they are going to use biometrics as part of their authentication mechanism, then two things to remember. One, in 2019 when they started talking about one nation, one nation, letters were sent around, there was a circulator. I have a copy of the Dupura letter where they say that there are a series of people. So they say you know people above 60 people below 15 people who are disabled people who can't move, various kinds of, if there is only a one-member family then you find that you know they may not be able to authenticate themselves with the fingerprint. So they can actually nominate a person who will then give their biometrics on behalf of the person themselves. It's a it this is another very strange kind of thing where my identity will be determined on the basis of somebody else's biometrics. Now this ought not to surprise us because when questions started getting asked and they were the UIDA found itself in a tight corner in 2014-15 up to you know 2015-16 from the time of the August 11th order till the dog got fast, they said that they were setting up something called the UBCC which is UIDAI Biometric Centre of Competence. And the logic for that was that the nature and diversity of India's working population makes biometrics a challenge. And then we thought okay maybe they set something up, maybe they got some kind of you know maybe some report something. We actually found when we ferreted that not a single penny, not a single rupee, not a single paisad had been spent on setting this up. So it was you know they recognized the problem, they knew they didn't want to be questioned, they wanted needed an answer if they were questioned and at the end of it when nothing happened they passed a law where they said we will share everything other than biometrics. So the biometric database as is the demographic database, these are completely unaudited systems and these are known to be full of evidence. This is the database with which the election commission wants to link the voter act. Just think about what that means, there is a whole lot else which I just thought of some of this and set this up. Thanks Parmini. Thank you Vishyaji. So I had a question in regards to what does one do in the face of this, right? Like much of the work that we're doing at one board is about making the citizen conscious of these developments and these shortcomings and issues. But what can citizens actually do in terms of taking action in order to kind of push against these developments because we're seeing over the YouTube channel there is a lot of there's a lot of faith in the EVM as because it's technology and people feel as a technology to be exact and correct and therefore not at fault. So how do we, what kind of instruments can we use to kind of take action and make push against this? I think the kind of thing that we need to do in relation to EVMs may be different from what we need to do in terms of the voter ID and UID link. For this reason that EVMs are something that people encounter only during an election. It's only those who are working on it who are aware of what kind of problems there could be. It's only someone who understands how software gets used in these systems who will have questions about, who will know how to ask the questions about it. It's only someone who understands the nature of the source code who will be able to tell us what these issues are. So in the popular imagination, how you question a technology of this nature, so it's not that clear. It becomes a little clearer when we find that there are other countries in the world which have rejected it. Which countries you believe, in all of us commonly believe, believe in technology. So if they are saying no to it, then what are we missing? So that could be one kind of question. But on the voter ID, UID link, I find that actually people are just feeling pressured and pushed into a corner because unlike the EVM, in the UID, everyone is being honored into trying to work the system again. If you look at the J-PAL report, you know, that Karthik Murli, the Ren's report, you find that they say that a large number of families are able to link their UID with the PDES because at least one of their fingerprints work. So if there's a family of five and there's one person whose fingerprint works, they are saying, okay, at least we're able to link So it's a deeply defective system and people are experiencing it. I was actually very surprised at the recent feeding which I attended on digitization where I found that every person coming from the different sectors, whether it's labor or it is banking or it is agriculture or whatever, all of the food work, everybody, you know, they would say, for instance, on the Social Security Code that all unemployed or unorganized workers, everyone has to get on to that database. So they say, okay, you get on to the database, to do that, you have to give your UID, then they want your backup number, then they want your PAN, then they want you to keep reporting to them about where you are and all this has to be done through technology. And at the end of this and throughout from 2010 till now, there has been no hiding. Even the UIDA hasn't hidden this that fingerprints are a problem for migrant workers. Biometrics are a problem for migrant workers. So this is slightly different for that reason that there are so many, people have just fallen off the map and nobody is even counting them in. People go to the ration shops every month and find themselves in trouble. So I think, you know, with its helplessness and choicelessness that is pushing people to happen. They are not going it because they expect the system to work. They just know that they will be excluded if they don't somehow try to include themselves. That's the cruelty of the system. But that also makes it easier for people to understand. All right. Thank you so much. I think we have a question in the chat. So what is the unique aspect of India's rule of law that makes the creation of this kind of citizen database possible in a state of exception? See, I think we need to apportion some of that responsibility among different agencies. I think one of the things is that in the, okay, this is just my way of reading it, that it is correct that the state has a responsibility to make sure that everybody has what they need, not just to survive, but to be able to move on in life. Which means that if I'm in a PDA system today, you know, five years or 10 years down the line, I should not need to be in that PDA system. If I have been below poverty line for a certain period of time, I should have been able to move out of the poverty line. I'm not sure we are calculating. We are looking at it. We are looking at trying to somehow make the system work, but we are not looking at what it will mean to get, so in my head, freedom from the state. And this does not in the libertarian sense, but freedom from the state in terms of not having them piss me with, you know, with UAPA or with, whether I'm a minority or not or whether it's whatever, that is a very important freedom. And it's a freedom that we have lost in large measure, because we have participated, we have allowed ourselves to lose this, which means that, you know, people will often ask, have you all, have you got yourself a mobile phone and ask, you know, they'll say, but how will you operate without it? I'm like, where is the problem? Is the problem that I don't have a mobile phone or is it a problem that the system will not allow anyone to operate without? And do you know the number of people in this country who don't have mobile phones? And if they're going to be maintaining that, the artifact becomes more important than what they need to get on in life. Isn't there a problem there? So I think in our, there is a way, I keep saying this, but, you know, it's a strange thing that in this country, which taught the world non-cooperation, we are the most obedient that you can find, which is why when people say we need systems like this so that, you know, there won't be anarchy, I can only laugh. Where is the anarchy? We are just much too obedient. It is, I mean, that is a problem. I don't even mean it, you know, I mean, there's a certain liberty, of course, in that, but it is meant in seriousness too, because if something is wrong, it's wrong.  What I'm doing is not bad. The sedition law is right. I can't obey. If I obey it, then I'm obeying something that I know is bad. How can I do that?