Okay, welcome everybody. Thank you for joining me for this presentation about system call filtering with SACOMP. I realise it's day four or possibly even day five of a long week for all of us, so I'll try and keep the energy levels as high as I can during this presentation. Just to introduce myself, my name is Simon Goder. I've been working in embedded Linux for nine on 15 years now. My background is in applied mathematics and I got into the technology industry doing algorithm development for 3D graphics and worked at a semiconductor company, STMicro, in Bristol in the UK for many, many years. And it's there that I got into helping customers use Linux primarily in home entertainment, set-top boxes, those sort of devices. I've been with DoLoss for nearly ten years and I'm part of the team that writes and delivers training in the embedded Linux space, drivers, Yocto, security, etc. So what we're going to talk about today is system call filtering with SACOMP and the key word in the title, which I've just not said of course is the word practical, we're not going to get into the detail of the underlying technology. That's not what this talk is about. What we're trying to give you is an overview of what this thing is and what it can do for you in your system that's the sort of top level title designing to the worst case scenario. It's about when you're thinking about the security of your product, what could go wrong. So we'll introduce some basic concepts which I'm sure most of you are familiar with but it's useful just to make sure we're all at the same level. And then we'll introduce SACOMP and the accompanying library, LibSACOMP. Look at some examples. We're not going to get too hung up on APIs and parameters. That's what the man pages are for. But at least introduce the basic concepts. And then we'll look at how we can use this technology in practice in a real system with things like system D and containers. So when you design a product, your primary goal is that device does what you expect and what you want and what your customers want. It needs to be correct in that sense. But there could be some misuse of that device through some floor design, some hardware problem, some weakness in a piece of software. That weakness may be something you do know about or it may be something you should know about, but it's there nonetheless. And the goal of security in a system like this or an embedded system like this is to try and protect against this misuse of the device. We're trying to prevent or at least mitigate the effects of somebody attacking your device. In the picture there, we can see the device in the middle. It's talking to other devices. It's talking to users. It's potentially talking to cloud services. And we have represented by the rather scary red lightning bolts. We have potential attacks coming into that device. And what we're trying to minimize is the so-called attack surface. We have different attacks being made and the sum of those attacks or potential attacks is referred to as the attack surface. And we want that to be as small as possible. And it can be summarized with a phrase which is used in lots of different contexts, which is hope for the best, but plan for the worst. And that's really the goal when you're securing an embedded system, an embedded Linux device. Some basics, which I'm sure most of you understand, but it's worth just going through. The first is how do applications actually talk to the kernel and ultimately to the hardware within that system? And they do that via a mechanism called the system call interface. And there's around 300 system calls. It varies with kernel version. The later the kernel, the more system calls we have typically. And these are normally called via a corresponding library call from your C library. There's not a one-to-one mapping. There's plenty of system calls which are not supported in the library, but typically you make a library call. It gets turned into a system call. It goes down into the kernel and something happens. So we have an open call here into our runtime library, converted into a sys open into this magic block, the VFS, the virtual file system switch. And it's that block that decides, well, you're calling open, what does that really mean? What are you trying to open? Is it a file on a disk? Is it a display? Is it a sensor? Where do I actually need to run some code in order to service that open request? And special structures called FOP structures, file operations are registered with that block. And it's that that provides the routing through to the underlying driver function, you know, whatever that might be for the particular hardware you're dealing with. So user space can't interact generally with hardware directly. It's a sort of service relationship. If you like, user space asks the kernel to do something, and the kernel generally will do its best to respond to that. Or there are circumstances where it will say, no, permissions, for example. Effectively, what is happening in the kernel is at the highest level of privilege within the system, and user space is at the lowest level of privilege within the system. The second sort of underlying idea we need to get to grips with is how user space processes are actually launched in a running Linux system. And that's done, we have an idea of a parent process and a child process. And the parent will call, a system called fork, and that will create the child process, which is effectively a duplicate. It's slightly more complicated than that, but for now we can accept that it's effectively a duplicate of the parent. And typically what happens, apart from the most simple sort of hacky test programs, is that it will call, and trust me, I'm no stranger to simple hacky test programs, so I know what I'm talking about, the child will call one of the family of execs, so-called exec family functions, which loads a new program file into that child process and off it goes. The parent can exit or typically will continue to run. Often that parent is the init process within the system, the first user space process that runs when the kernel boots, process ID one, it will look for the init program, will start it running, and the init will then launch all the other services. Or, on a more sort of mundane level, the parent will be the shell. Every time you type a command into a shell and hit enter, this is what's happening. And you can see that for yourself, if you use the system trace caller, strace, and you just strace the shell command, the first line will always be some variable on this, exec something, and the new program that's being loaded. And so, when we're training newbies to Linux on this sort of thing, they often only make sense when you show them that they understand that relationship between the parent and the child. So where does Secomp fit into this? Secomp is a mechanism within the kernel that allows those system calls to be filtered, stopped, logged, processed in some way. It's a kernel mechanism, as I say. It uses something called BPF underneath, which is coming up in all sorts of different contexts at the moment. As I say, we're not going to get stuck into the detail of that. Maybe a good place to start, if you're interested, was Michael Kerask did a presentation on this topic. Oh, it must be five years ago now. Have a look on elinux.org. You'll find a link to that. As is often the case, what Michael Kerask says is a good place to start with these sort of topics if you want to know that low-level detail. Luckily, we don't need to know the low-level detail because we have a user-space library, Libsecomp, which provides us a nice set of APIs and supporting tools that allow us to make use of this functionality. So what the diagram shows us at the bottom is the kernel with the second block within that. In user-space, we have our parent process, which is setting up the filtering using the library. It creates a child process. That child process attempts to do something it's not supposed to. Perhaps it's been compromised in some way by a buffer overflow or a command injection or one of the myriad ways that programs can be compromised. And the kernel is able to terminate that process, stop it in its tracks. It can't do whatever the attacker wanted it to do. And that gives us a very powerful level of protection within our system. So as I said, I don't want to dwell on APIs too much. That's what the man pages are for. Ultimately, again, thank you, Michael Kerask and his colleagues. But we can just have a look at the basics here, and I'll build on this in subsequent slides. So we have a little snippet of code. Of course, we have a header file. Always important. And then we're setting up an empty instance of a special data structure which represents the second filter.  And the action we've chosen here is to kill the processes. So if you just left it there, nothing would run in that child process because we're saying any system call, stop. Obviously, that's not ideal. We typically want to do a little bit more than that. So we can then add rules. Effectively, by setting that default action to a kill, we've put a blanket over the whole thing, and we're now putting pinholes in that blanket to allow certain actions to take place. And if you think, look at the list of actions available, we can kill threads, processes, we can trap, we can terminate a process with a chosen error number, we can trace with ptrace, we can log and allow, or we can just allow, or we can lock the bottom one, we can fit into some other monitoring process. The fact that we can allow things and we can kill things means we can think about it from one of two ways. We can say, well, these are the calls we'll allow, but nothing else. Or alternatively, these are the calls we won't allow but anything else is fair game. So we often refer to this as an allow list or a deny list, one way or the other. There's two ways of looking at the problem, if you like. So, slightly expanded example, we're setting the default action to be terminate or kill, but we're adding three exceptions to that. We've got three rules with the action allow, and we've got read, write, and close. System calls map down to integer values, these vary by architecture, so if we're writing portable code, which hopefully we are writing portable code, we use this macro provided by the library that knows what architecture you're on and will map appropriately. The zero here indicates that any parameters are acceptable, and we'll see on the next slide that we can be even more targeted in our rules. Finally, we load the filter into the kernel and away it goes. So this more complex example of a rule, again, not going to get stuck onto the detail, but by placing a three in that third, no, fourth parameter, we're saying we're going to allow sys reads, but we want to check the parameter values. And that allows very fine grain control over what you're doing in that system, and there's a fairly complicated set of macros that the library provides, but what it comes down to is a set of tests that can be applied, equal to less than, greater than, those style tests, and we can see here that we're checking for equality of the first two parameters and then less than or equal to the third numeric parameter, the buffer size. So you can be incredibly targeted in what you will accept or equally what you will deny. One question that might be in your mind at this point is, well, how do you know what system calls your application your process actually makes? You could guess, I suppose, and you could go through a process of elimination, which would be an interesting way to spend a few days, I suppose, but there are a couple maybe more scientific ways we can do that. One is to create an empty filter, but rather than killing everything, oops, apologies, we log everything, and then you run your process, you need to perform tests on it, use cases, et cetera, et cetera, and then you look in the system logs via journal CTL or whatever the appropriate logging mechanism you have, you'll see that SecComp has logged, it's given me the name of the process, just hello world in this case, and the system called number. So that's the architecturally specific system call number. Of course, we need to know what system call that maps to. I don't know if you can see at the bottom, you can see in the PDF, if not. We have a tool provided by the LibSecomp library. You tell it what architecture family you're on, and it will map that back to the appropriate system call. So you can go through that list, make a note of all the different system calls you need to put rules in place for and where you go. We can also use STrace itself, the system call tracer. You can generate a list of system calls. Now there's a lot of stuff on there that we may be less interested in the output, so if you're that way inclined, you can do some command line trickery to strip out all the information and generate a plain list. This is a beauty, this is from some Docker documentation which I found. So it uses the STrace statistics with minus C and does a bit of hacking around with it to generate a plain text list, which is quite handy. One interesting point, if you've got child process that launched subsequent child processes, grandchildren I suppose, then we can use STrace minus FF which will generate logs for all of the descendants in separate files so you can build up a complete picture. And that will even work if you're launching a containerized process. You can trace from the container launch, the container runtime into the running container and get information. So that's a pretty powerful feature. So here's a sort of summary of what we've seen, this very, very simple example. We include the header. We initialize the filter with a default action. We set up our rules and then we create the child process. The parent needs to be compiled with the appropriate link option minus LSECOMP. The child is blissfully unaware, as children often are, that anything is going on here. It doesn't know it's running in this confined environment until something goes wrong. This isn't typically how we're going to work in a real system. We're going to be working as part of a wider framework of processes and applications. It's important to know how this works, but typically we're going to be using something a bit broader. So for example, we can do this as part of our initialization with the init program. Now we're focusing on system D. It's becoming the default in embedded systems. We still see sysvinits being used. And you could do this with a sysvinit, a script-based initialization, but we have to do it by hand, whereas system D has that integration in it. And that's why it's becoming more widely used, because of the integration with security features like SE Linux and those sort of things. So if you're not too familiar with the init process, it's the first user space process, PID1, launched by the kernel as soon as the storage is mounted for the target root file system. And it's responsible for starting up the other user space processes within your system. PS3 is a really nice tool for visualizing those relationships. System D can set system call filters per service. So as part of the service configuration, there's a parameter system call filter that you can use to set system call filters. And you don't have to worry about the APIs underneath. So the example here is just a test service. We've got the variable system call filter equals, and you'll see a tilde or a squiggle, and then the system call uname. The tilde is a negation. It means block. So in this service, if it attempts to call uname, it will get blocked. To make things even easier, system D actually provides a set of predefined sets of functionality that you can block or allow, depending which way you want to do it. The names you can see are fairly self-evident. What sort of things they include, file system, system calls, network IO system calls, module system calls, that sort of thing. You can see the full listing in the documentation. In addition to this, system D has a basic allow list of the things you need to at least your application to start running. So you can add to that basic list, you can add predefined sets in a space-separated list, and you can negate these things as well with the tilde, with the squiggle. So you can build up a quite complex filter fairly easily. So if you wanted, I don't know, certain IO events, but not all of them, you include the IO event set and then negate some of the individual system calls in the same list. So that gives us that control over what we want to do. Often these days, we're dealing with systems that work in some, or work with some sort of isolated execution environment or environments. Systems like LXC and Docker are becoming more and more commonly used in embedded systems. We can have pretty full Linuxes running inside a container with multiple processes, a proper, a normal init program like system D, or we can have maybe very stripped down, lightweight containers that run one or two processes very targeted in what they need to do. And this of course has numerous advantages from a security point of view, from an update point of view, all the aspects of a modern online embedded system. So the two I'm going to talk about are LXC and Docker because they both provide an interface to SecComp out of the box, or more or less out of the box. So LXC's may be not quite the original but certainly one of the very earliest container run times that's been available in Linux. It's still a powerful interface. It used to sit underneath what Docker does, not any more. And if we want to use SecComp with LXC, we have to first make sure that our LXC has been configured and built with the LXC configuration so that the SecComp support is built in. So for example in Yocto in meta virtualization, the LXC recipe doesn't include this feature. You have to manually add it in order to build LXC within Yocto. Once you've got LXC built into, SecComp built into LXC and the kernel appropriately configured with config SecComp, then we can add a line to our LXC configuration file LXC.SecComp.Profile and that points to a text file which contains either a deny list with an explicit statement of that or an allow list with an explicit statement of that. The number 2 there refers to the version of SecComp the support in LXC has been there for so long that it had version 1 support originally. So the deny list we set the name of the system call and the action. What do we want to happen to this system call? So here's an example of the Erno action where we want to return an error code of 1 if this system call is called. The allow list we don't need to give an action because we're allowing it we're just providing a raw list. And so once this container is finished it will apply the system call filtering. In fact that's not quite true if you look at the logs from LXC the SecComp filtering is applied really pretty early on in the launch process of the container and will trap a lot of LXC runtime calls as well. So in my experiments with a single process container that just did a printf in a while loop there were 48 system calls that needed to be allowed before that would successfully launch. So I'm not sure how useful it is. You need to you have to balance getting things to work with there's no point in having a security fence that's got so many holes in it that anybody can get through. Docker as you may not be so surprised to learn has a more fully featured and maybe more structured set of support for SecComp as is the nature of these things. And it actually runs containers with a default SecComp filter. Whether you knew that or not it's already there assuming you've built your Docker with the SecComp feature enabled. And of course you have the kernel support. So it blocks around 40-44 system calls by default some of them are sort of deprecated obsolete system calls. Some of them are known to be risky including the system calls that lets you load BPF code for example. It won't kill the container in the event of one of these calls. What it will do is return a permission denied so it's using the Erno action for that. So you can run without the default profile with the options we can see here minus security opt SecComp equals unconfined. Obviously generally not a good idea. What we can do instead is we can find that default profile we can extend it, we can modify it we can change that and we can add our own calls into that list. It's a JSON file, it's pretty readable, pretty easy to understand. We set the default action and we can set individual system call actions and the parameter switching. The syntax is quite small there but it is fairly straightforward to implement that. And that will go in and it will set the filters for the code running within that container. So what we've seen there is how very briefly how SecComp provides a pretty powerful mechanism for limiting what an application or a process can do. Whether running directly or running in some sort of containerized environment. It's about thinking about the worst case in your system. What if a particular process is exposed? Maybe you only use this on the sort of end user facing parts of your system, the bit where people type in their username or password or whatever it might be, the more exposed parts of the system. We can manage system call filtering per process with the fairly naive mechanism with something like system D or with the container. But it's really important to understand that this is just one tool in the toolbox. There's many, many, many things we need to do to have a secure embedded Linux system. We've broken them down here into various categories. I'm not going to go through all of this, obviously pretty dull but we've got kernel security features operating system features like MAC DAC capabilities. Other things we can do in system D to make the system more secure. We've got the programming the raw code things to think about what compilation options are we using even what language are we using. We're seeing Rust being talked about more and more. Is it the universal panacea that we're sometimes led to believe? We need to think about whether we need to update our system over the air or directly and the implications of that. Are we doing networking do we need VPN secure tunnels platform security very sock dependent secure boot use of if you're on an arm for example if you've got trust zone what could you do in that secure execution environment that would make things better. File system security integrity checking encryption and then maybe more at the management level maybe management is a dirty word sometimes but having a secure development process in place thinking about security at the beginning we deal with customers and industries all around the world and it's sometimes a little bit frightening when people say yeah we nearly finished our project and now we're thinking about securing it and that obviously is an alarming thing to hear. So there's lots and lots of things to think about. So we have a little bit of time so I've got some I'm afraid I'm a coward so I've got some demos that are video recordings rather than doing a live demo I struggled to type and talk at the same time. So if we just pick one of those what we're doing there this is a system D demo so we have a simple service that's just going to call you name it's not doing anything terribly exciting but I just wanted something to be running as a service within my system we're running on a QMU arm 64 built with the octo as it happens so you can see the the process has run it just spits out the kernel version and then I've got the service set up and I have the system call line commented out at this point. So if I just start that service manually we would expect it to start without any issue and be running quite happily and there's the message we expect. Nothing very exciting. If I stop the service edit the file uncomment the second line notice the tilde so I'm going to prevent you names restart the service I think to force the symlinks to be regenerated I need to disable and then re-enable I didn't realise how slowly I type until I see it on the video and we're not seeing any messages as we would expect and I think if we look at the status of that service and I'll start the service first no messages coming out obviously it's not working but if we look at the status we can see that it's failed to launch so the system works for what it's worth all the little snippets that I've used for my experiments again in no way production ready code don't take any of it and put it in your next car because you're going to get problems but they're all on our github it's all freely available and really just down to say if anyone's got any questions ask now or come and find us wherever towards the other side come and find us we'll be here for the rest of the afternoon so thank you very much


I'm Sandra Deon Johnson, and I was duly diagnosed with congestive heart failure and type 2 diabetes. But I've been very lucky. I've been able to get treatment and live with it. I'm on two different kinds of insulin, and I'm on a non-insulin medicine for my diabetes. I'm on eight different medicines for my heart and related things. Over the course of the time that I've been taking them, the prices just have become prohibited. It's only us folks in that middle ground. We're too rich to be poor. We're too poor to be okay. We fall through the cracks. It's like a full-time job.  I work with Dr. Fish, and I understand in the past you've had some struggles with kind of insurance, but you haven't been on the Victoria for how long now? For a couple months maybe. Pest strips are expensive, the lancets are expensive. I prioritize the heart stuff over the insulin because the heart stuff is more immediate. I know over time diabetes will kill me, but it'll take a longer time, and I know that without the heart failure drugs, I only have 13% function of my heart. I don't want to play with that. I don't like the stress of thinking about how I'm going to pay for my meds. Because I'm never going to have any more money or any less money, so I'm never going to qualify for extra help. I'm stuck between a rock and a hard place, and I'm sure a lot of other people are as well.


Wrth gwrs, ac mae'r AME yn cyfremio hulniag ond mewn dweud i hefyd i 7776 yn gyfremio Richard Lochhead o'r unrhyw barthol effu'r cweithioon. Felly, mae'n cwestiwnau ffordd. Felly, mae'n gweld i honi wneud i ddim ni i ddim ni i hwnnau tiniw. Felly, lyst adeiladau o ddim ni i ddim ni i ddim ni i ddim ni i ddim ni i ddim ni i ddim ni i ddim ni. Felly, mae'n gweld i hefyd i 7 mint блwysор, Mr Lochhead. a chael ymddi gweld byddemon i ddigon o ddemrithau am gyfer gweithg―weithgag wnaeth gael maen nhw y trofi, rydyn ni ei nhw i ddim yn ei gufnod i ddigongell gael ffordd iawn a'i ei hemlyniad cydwyn amhell o fawr. I want to begin by paying tribute to Drew Henry MP and to CAB Scotland, Highland Council and to the many community campaigners, such as Rebecca Wymer, who runs Stacks, Bistro and John O'Groats, who started their own petition in July for highlighting the issue that we were debating this evening previously. I should say to all of them and to the chamber I believe that December 2017 will go down as a turning point when, with household budgets already under pressure, the people of Scotland will say, enough is enough, no more rip-off parcel delivery surcharges, and it will also be when the authorities hopefully accept that real action is now required to address this issue. More than ever, Scots will shop online this Christmas as better digital connectivity allows us to park with cash without ever having to leave our homes. For their part, retailers know that in today's marketplace they need to sell online to compete. In rural areas in particular the internet can be a godsend, especially for goods that are not available on their own doorsteps. For a large part of the country, online shopping comes with a big, expensive drawback. Many households and businesses are ripped off by retailers charging jaw-dropping and completely unjustifiable sums for delivery. Alasdair Allan. The member mentions jaw-dropping examples. I am sure that he is about to give some. Will he agree that, in the island communities, the situation is extreme? I think of a constituent in Harris who was charged £61— Excuse me a minute. Is your microphone on, Dr Allan? Ah, right. I think of a constituent in Harris who was charged £61 on top of the £145 price for a parcel, even when the offer was made to pick the thing up from Inverness herself. I am sure that the member will agree that, in all of our island communities, the situation is an extreme one. I will give you extra time. That was a long intervention. I absolutely agree with Alasdair Allan and his constituency. It is indeed of course very much effective, as I will refer to later on. Many retailers deliver free or at low cost elsewhere in the UK but impose hefty surcharges to much of Scotland. A delivery fee of £50 was demanded for dispatching a £5.99 pair of tan towels to a space-head constituent of mine. A £60 surcharge was levied for sending a small £8.99 item to Fockerburs and Nozzle for a Washer. Another Fockerburs constituent purchased spare car parts from Germany with three delivery rather than pay up to £45 per delivery from elsewhere in the UK. What started as a Murray campaign has also gone national. I have been contacted by people from throughout the country via fairdeliverycharges.scot and socialmedia, and I have learned a lot. I am referring to Alasdair Allan. I can tell him that I have been told that a pair of boxer shorts—not ones that I would wear personally—is sold by a Lincolnshire-based IFL store that costs £19.91 can be delivered to Barra for an extra £33.94, but it is only an extra £19.15 to get it to Bulgaria, according to their website. I think that we can agree that that example is completely bonkers. There are many issues. Lack of transparency is an issue. Disgracefully, sometimes consumers are not told about the surcharges until after they have completed their purchase. A lady in the Ruri bought an exercise bike at £155, plus £15.99 for her delivery, which she thought was reasonable. The next day that the company informed her, there would have been an additional £34 surcharge due to her AB postcode. The CAB Scotland estimates that up to 1 million Scots are affected. It is important to be clear that not all retailers impose surcharges and that others keep them very reasonable, but many do not. It is like a delivery tax that costs much of Scotland millions of pounds a year. There is such an inconsistent picture. Some offer free delivery and some are all postcodes or minimal surcharges, and others apply huge surcharges. There is no rhyme nor reason to how many of the surcharges are calculated. I have had cases where the surcharges for delivery to Elgin on the N86 with IV postcodes are higher than for nearby rural villages with AB postcodes, and I have had cases where the opposite is the case. The blunt use of postcodes is a big, big problem. I visited a community in Murray where the boundaries are filled and the houses with IV postcodes are at one end, and they are subjected to huge surcharges, such as £32.99 for a referees whistle and mini-wallet, costing £7.95, and the houses on the other side of the field would only get charged £4.95 for delivery. To add to the absurdity, delivery lorries using the A96 drive past the houses with the higher surcharges, so no wonder that the public are completely exasperated. According to one courier company, Menzies, whose depot I visited and who delivered to all corners of the Highlands, many of the higher charges, such as £74.99 surcharges, for delivering a £61.99 kids' toy, but through Tesco Direct, are unjustifiable. We know that it is not nearly as common for Scottish companies in the north to surcharge companies or customers in the far south of England. Johnston's of Elgin Cashmere, for example, charged the same for delivery anywhere in the UK. Yet Groupon, Kiddycare and others have been criticised for refusing to even deliver to the north of Scotland at all. There is often geographical ignorance and flawed computer software. Another lady told me that she was asked for a £70 surcharge for an item that advertises free delivery. The reason for the surcharge was her AB postcode put on the Highlands. She explained that she lives in Stonehaven next to the A90. That did not wash. One man from mainland Ergyll sent me his paperwork, where the retailer applied a £7.99 surcharge because his home was deemed as offshore by the retailer. As we all know, astonishingly, some mainland Scottish postcodes are not mainland UK, according to many retailers. The banners, which are blazoned with boasting of free UK delivery, are absolutely worthless once the customers get the small print at the end of the ordering process, if there is even small print there. There have been attempts, of course, to tackle those rip-off surcharges. Ministers working with industry and consumer groups drew up a statement of principles for retailers to follow in 2014. Some retailers stick by them, others ignore them. Principles relating to location discrimination and transparency are being flouted by many retailers and courier companies. They are voluntary, they are only aimed at retailers, not couriers and they are largely ignored. I recently met stakeholders in Parliament and I am delighted to learn today that the minister now plans to host a similar event himself. There is an appetite for more action because too many Scots have been treated as second-class customers. UK rather than Scottish ministers have legislative responsibility and it is time for them to investigate and regulate. After ruling out regulations in September, UK ministers this week seem to be softening their position. Ofcom only regulates the Royal Mail, the universal service provider. Regulating parcel deliveries, either through the Post Office Act or consumer protection, which is also a reserved issue, should be urgently considered. We must ensure transparency before orders are placed through better enforcement or better regulation. Many retailers seem to be acting illegally given the behaviours that I have just outlined in the past few minutes. If delivery is free to what is referred to as the UK mainland, then that must absolutely, obviously include all of mainland Scotland. In the meantime, customers can shop around and name and shame the worst offenders. Big retailers like Halfords and Lloyd's Pharmacy have reviewed their charges after I contacted them so that they can change. In conclusion, to end rip-off delivery charges, we need common standards all retailers and couriers that must abide by. I urge the minister, whom I met recently, to discuss this issue, to pick up the cuddles on behalf of customers and the people of Scotland to take the case to the retailers and couriers, to lobby his UK counterparts and to use the Scottish Parliament's new powers over consumer advocacy and advice to tackle this issue. I ask both Scottish and UK ministers to deliver up to 1 million Scots and early Christmas present by pledging to tackle those rip-off delivery surcharges. Open debate, speeches of four minutes. I have 10 members wishing to speak. I call Gail Ross. We are followed by Jamie Halcro Johnston. I would also like to thank Richard Lochhead for bringing this debate to the chamber. I can imagine that this is one debate that will find consensus across all parties. We will all have stories about ridiculous delivery charges to various points, but in my case, my constituency of Caithness, Sutherland and Ross is actually all over the highlands, Murray and in some cases even as far down as Perth. There is some ambiguity as to where these charges are actually going. Are they going to the seller or are they being charged by the delivery companies themselves? The situation in the far north has become so frustrating that local wick man, Gary Gunn, has actually set up his own delivery company to counter the excessive charges. He says that although he has only been in business for four weeks, he took a gamble leaving his job but he has already been inundated with orders. He tells people on his Facebook page where he is heading on certain days, takes orders for certain companies and looking at his feedback is already building up a happy and loyal customer base. We all have stories about excessive, disproportionate and, quite frankly, ridiculous delivery charges to some postcodes. My own postcode of KW, which originates in Wick, is often mistaken as a postcode exclusive to Kirkwall. Whether that is genuine mistake or merely mischief-making on behalf of the companies involved is hard to ascertain, but let me make it clear. According to that font of all knowledge, Wikipedia, but according to reliable sources, the KW postcode area, or WIC postcode area, is a group of postcode districts in the far north of Scotland. Although the area includes all the Orkney Islands, it is named after WIC, the largest town in Caithness and the post town of KW-1. Districts KW-1 to KW-14 are all on mainland Scotland, roughly corresponding to the boundaries of the historic county of Caithness. The area comprises the post towns of Berredale, Brorra, Dunbeith, Forsenard, Galsby, Hallchurch, Helmsdale, Cimbres, Latherin, Libster, Thurzo and Wic, as well as Kirkwall, Stromness and the rest of Orkney. I, along with probably everyone else here, have had loads of examples sent to me, and if I had more than four minutes I could probably relay them all, but I won't. But here's some. Gary told me that Euro car parts delivery to GP mainland is free delivery to Scottish Highlands and Islands 595. He says that what particularly annoys him about aside from living on the mainland is that they have a store located in Inverness, and therefore should know better. James tells me, not exactly extortion it, but the whisky exchange charge £5 surcharge for Highlands and Islands, which they classify with the Isle of Man, Isle of Silly and Northern Ireland. Shona wrote to Kiddiecare, whom Richard Lochhead has already mentioned, that he advertised that he would do free delivery to UK mainland. I think that what he meant is that he delivered to some parts of the UK mainland. Their reply, we currently only deliver to specific areas, we have no plans to change that. Ebey, many of their sellers have the message, no delivery to the Scottish Highlands, and why are flexi-flu charging more to deliver to the Highlands than they charge to deliver to the islands and to Ireland? Amazon, please educate your sellers. The Scottish Highlands is part of the UK mainland, and those are actually contravening trading standards. If something is offered as free to the UK mainland, then make it free to the UK mainland. What is the solution? It is all very well telling people to shop around, but why should we have to? A possible solution being mooted as a network of distribution centres or pick-up points, but that is almost impossible to implement if some companies will not deliver to the area in the first place. Name and shame, keep doing it. The campaign has gained momentum, and the more stories we get, the more we can bring it to the fore and report those companies to trading standards. I think that we do not have time for another suggestion. Those are all very good. Please sit down. Jamie Halcro Johnston is followed by Kenneth Gibson. Thank you very much, Deputy Presiding Officer. I congratulate Richard Lochhead on bringing this debate to the chamber. On fair delivery charges, there is a subject that members from across northern Scotland will unfortunately be familiar with. We have heard from a number of individuals or individual experience already, and I will no doubt hear more in the course of tonight's proceedings. Regrettably, those charges impact most on those who are often reliant on delivery services. In rural and remote areas, the alternative can often be long-round trips to the nearest major town. In our island communities, accessing goods and services can often take longer and be even more complicated. However, excessive charges can sometimes be entirely incomprehensible. Towns like Elgin have experienced many issues, as well as the city of Inverness. Constituents have been writing to me a great deal over recent weeks on the subject, and I would like to share some of their situations. In Orkney and Shetland, the main problem appears to be firms often refusing to deliver at all. My mailbag has been a mix of both small firms and major global companies, and some even based here in Scotland. In the mainland highlands, examples tend to point more to charges and costs. In one case, we have had a gentleman faced with a delivery charge considerably greater than the value of the item that he was having shipped. After some negotiation, he managed to get an agreement to have it shipped by Royal Mail, at less than an eighth of the cost that he initially proposed. From Elgin, we have had examples of a delivery charge being inflated by over £50 compared to delivery to Inverness, almost in the realms where it would be cheaper to have a parcel chauffeur driven for the remainder of the journey. Again in Elgin, there was a constituent who bought from a UK-based company which advertised itself as being able to post to the UK mainland. The offer was retracted even though they were prepared to ship across the channel to continental Europe. Those are just a handful of experience out of many that take place all the time in my region. Not just amongst individuals, it is also an issue faced by businesses across the highlands and islands. The motion before us today makes reference to the cost of delivering a mobility scooter to women in Keith. Again, this is one example, and represents a wider problem where specialist medical equipment is now commonly delivered and people in the region can be excluded. Those are things that people in most of the UK will take for granted. I think that all of us in this chamber will recognise that sometimes there are additional costs for deliveries to the highlands islands. In many cases they are reasonable, however in many cases it is clear that they are not. I would also like to welcome in particular Citizen Vice Scotland's contribution ahead of tonight's debate, recognising many of the problems but also proposing some solutions. In many cases it will be business that has to adapt, but I commend the interests of government too. The minister for wheelhouse has previously noted that the UK consumer protection partnership, chaired by the Department for Business, Energy and Industrial Strategy, is reviewing parcel delivery surcharging. There are certainly similar problems that arise in other parts of the UK, such as Northern Ireland. My colleague and MP for Murray Douglas Ross, who has campaigned extensively on this issue, today raised it with the Prime Minister. He will be having further discussions with the business secretary, a recognition of how seriously those problems in my region are taken in Westminster. I commend the Scottish Government for its interest in this area, which will be helpful in tackling this problem.  Individuals and businesses across the Highlands and Islands have suffered as a consequence. Where we see unfair delivery practice being applied, they must be challenged. I look forward to more businesses recognising those problems and acting responsibly to address some of the many concerns that we have heard here today. I congratulate Richard Lochhead on lodging his unfair parcel delivery charges motion and securing this afternoon's debate. He has taken a lot of work locally and nationally to gather support for this campaign, and I congratulate everyone who is involved. The issue affects many parts of Scotland, including my constituency of Cunningham North. In fact, I first raised it in early 2012. My own motion entitled Time for a 21st century revamp of the parcel delivery service, which highlighted the fact that rural and island areas are worst affected by our outdated and unjust delivery structures, with many customers facing higher surcharges and refusals to deliver by operators. Sadly, five years later, that situation still pertains. For those living in urban areas, it is easy to take delivery services for granted, but as we have heard this afternoon, analysis from Citizen Advice Scotland shows that up to 1 million Scots will be affected by extra parcel delivery charges this Christmas. While some might be tempted by free delivery offers during this time of giving, although 20 per cent of Scots live in areas where parcel surcharges are applied. Ironically, those living in rural areas are on our islands, who are most likely to rely on online orders given the shortage of shopping options and the distance from high streets. That often leads to the almost unbelievable scenario, whereby it is cheaper for a customer living on Arran to have their parcel delivered to a collection point in Ardrossan and purchase a £7.80 return ferry ticket than their parcel delivered to their home. The same could be true for my constituents living in Cumbria, who pay £3.20 to travel and collect their parcel from Largs. Obviously, that situation is neither practical nor sustainable, especially for island and rural businesses that require frequent deliveries offer constituents with limited mobility. Recently, one Arran constituent faced a £10 delivery surcharge on a folding walking stick that costs just £12. While such items might be picked up in most high street pharmacies, for islanders being able to access those products online is a vital lifeline. In browsing the Marts and Spencer website, I noticed that they proudly declared that they delivered to 30 countries around the world, including Australia and the USA, making it even more mystifying that they refuse to deliver large items to Arran with no guidance as to how such items are classified. Since the postal service was fully liberalised in 2006, ending the Royal Mail's monopoly over the sector, the market has been flooded with firms offering low-cost delivery alternatives, sometimes at the expense of good service. As a universal service provider overseen by communications regulator Ofcom, Royal Mail must commit at least one delivery of letters every Monday to Saturday to every address in the UK and offer postal services at an affordable uniform tariff across the UK. Meanwhile, unlike Royal Mail, rival companies are allowed to operate unregulated. For customers, that can translate into surcharges and even refusal to deliver. That also means that there is no ombusment to arbitrate complaints, making it difficult to make consumer voices heard. However, in the Scottish Parliament today, we must support our constituents, make their feelings known and challenge those companies on their discriminatory practices. There is a voluntary code that many companies subscribe to, but surely it is time to move beyond that. The postal address service run by the dispute resolution consultancy CEDR only accepts complaints against regulated member companies unless a non-member agrees to be bound by its decision. The alternative dispute resolution scheme for communications invites dissatisfied customers to refer unresolved issues with unregulated couriers and postal companies, but there is a problem. It can only deal with firms signed up to its scheme, currently none are named on its website and it has not responded to my request for a list of members. During my five years as a community of the cross-party group and postal services, we raised this issue time and again with the Westminster Government, so I sincerely hope that this high-profile campaign is a wake-up call that it needs to tackle the persistent lack of understanding of Scotland's geography and infrastructure, which is punishing many of Scotland's communities, especially on our islands. I support colleagues in campaigning to resolve the issue and look forward to engaging with industry and public sector representatives to bring our parcel delivery services into the 21st century. Rhoda Grant, to be followed by Gillian Martin, Ms Grant, please. Can I congratulate Richard Lochhead for securing this debate and also on his campaign highlighting the very unfair delivery charges that we face in the highlands and islands? The rise of e-commerce has been a great benefit to the UK and especially to those of us living in the north of Scotland and the islands. When it is not uncommon to have to travel long distances to access shops and services, being able to shop online from the comfort of our own homes has been a fantastic development. However, what is not fantastic is being ripped off for merely utilising the same opportunities that are open to all other consumers. Additional delivery charges are not just occasional and occasional nuisance but a common and unjust burden placed on people in the highlands and islands. Evidence from citizens advice confirms that we pay more on average and most of us have stories that we can tell from our own experience. For example, I recently bought some furniture online and although the delivery cost was quite high, I really liked the items that I went ahead, a couple of days later I got an invoice for an additional delivery charge to the highlands and islands, which would have doubled the delivery cost. I immediately got in touch and asked them to cancel the whole order. They came back to me pretty quickly and waved the additional charge. The moral of the story is that they do not accept it. At the very least, delivery costs should be clear and defensible. Personally, I have a principle of just canceling orders from companies who have inflated delivery surcharges. This time of the year it is sometimes easier to buy presents online and have them posted straight to the person if you are not going to see them before Christmas. On occasion, I have had a reasonable delivery cost to gifts going south, only to find that those going north can be totally over the top. When that happens, I cancel every item north and south. They will lose the whole order. Many others often decide to go elsewhere. Practices told me that if I shop online with small local companies, they do not charge exorbitant prices. Shopping locally can support the Highlands and Islands economy and also get beautifully unique gifts to send to friends who live a distance away. Frankly, it is a win-win. Although I agree with companies highlighting bad surcharge practice and naming and shaming those who charge them, for the most part it has very little long-term impact. The reality is that companies who unfairly charge the Highlands and Islands customers feel that they have no need to court their business because it is not profitable. Often online shops contract out their delivery to other companies and, for the most part, that is based on the lowest contract price. Those low prices are achieved by targeting places that are easy to deliver to and charging exorbitant prices to areas that are more challenging. To see a meaningful difference, we need a universal rate for all deliveries. Companies can set their rates, but they must be universal to all customers. At the very least, online shops should be willing to send items by royal mail or parcel force when their preferred contractor exercises such discriminatory practices. Of course, the fear for delivery companies will be that, by carrying higher costs, they will become less competitive than their rivals. This is a glaring example of market failure. We cannot allow the market to operate unfairly. Discriminatory postal and delivery charges plainly show the requirement for public ownership. Until we are at a point where that is possible, I suggest that we need regulation for all delivery companies. Regulation would allow us to ensure that companies cannot undermine other businesses while protecting all Scottish areas from disadvantage. I appreciate that the postage is not devolved, so we need to work with colleagues in Westminster to raise those issues there and campaign for fairness for all areas. We should also explore how we can use the new powers of this Parliament to address the issue. Before I call the next speaker, I say that due to a number of members still wishing to speak in the debate, I am minded to accept a motion under rule 8.14.3 that the debate be expended up to 30 minutes. I invite Richard Lochhead to move that motion. Are we all agreed? We are agreed. I now call Gillian Martin to be followed by John Finnie. I thank my colleague Richard Lochhead for bringing the issue of delivery charges before the Parliament today. For too long, there have been huge disparities in the amount of constituents, including the area that I represent, Aberdeenshire East, that have had to pay. In a summer meeting with the chair of the Turfif Business Association, I was told that unfair delivery charges is their single biggest issue. The Aberdeenshire town is classed as Highlands and Islands by many companies who think that being in the Highlands and Islands is an excuse to charge more. The Turfif is only 40 miles from Aberdeen. One business in the town told me that some of the UK companies expect a minimum spend of £250 for their advertised, in order to qualify for their advertised free delivery. Any less than that, the charges go through the roof. Even worse, some companies will refuse to deliver at all unless the minimum spend is at least £250. The UK-wide consumer protection partnership has promised to tackle the retail side of the issue, and I encourage more transparency from retailers. I welcome that, but the main issue is with carriers. In a meeting that was organised by Richard Lochhead with stakeholders last month, Royal Mail, who had obliged to have equal delivery charges, were present, but no other carriers were. We are not just talking about the small carriers, we are talking about the large carriers, some of them that operate globally. They are silent on this because it is them who are not serving the whole of Scotland, or indeed the whole of the UK, in an equitable manner. My challenge is this, when retailers award delivery contracts worth a tremendous amount of money, they must ensure that they will not disadvantage their customers by choosing a carrier that charges more for delivery to the north. The reputational damage will not be the unseen carriers, it will be the retailers, so it is time for them to be part of the solution here. How much more will a rural household spend on delivery at Christmas time, compared to an urban one? It comes down to this, more money spent on delivery means less stocking fillers, and as any of Santa's helpers will tell you, that does not go down well. One family in Aberdeenshire told me that, when ordering a basketball hoop, they were going to charge us about £60 to deliver to my address, but luckily I have family in Carlyle who were coming up the road, so I sent it there for about £10. That is not just the first time that I have experienced overcharging, which I find ridiculous. One resident said that two online firms would not deliver to Aberdeenshire at all, but rural businesses are also affected severely all year round. North East boiler sales and services limited said that they had experienced higher delivery charges, being in an AB 53 postcode in Tarrif, often being classed as Highlands and Islands, as I have said. In some instances it has been described as not being on the mainland, in Tarrif, which is not even near the sea. The firm told me that the majority of our goods are shipped from England and Wales, and it is annoying that me and other businesses are penalised by higher charges. We know that many people will go to retail companies in Europe rather than pay extra, so that is not exactly good for the UK economy. A speciality food shop that moved its premises from Aberdeenshire to Tarrif now finds itself classed as Highlands and Islands and paying extortionate charges for the very niche stock. Many local businesses also find that they are unable to get next-day delivery at all, so they cannot provide a speedy service for their customer orders. Trafford's cafe in Tarrif tells me that they are constantly quoted a minimum of £15 plus carriage when free delivery has previously been stated by its suppliers. I commend Richard Lochhead for bringing the issue to wider public attention, and we should all continue to call out unfair delivery costs whenever we see them. I urge those in my constituency to report instances directly to Mr Lochhead's campaign or to me directly. I too congratulate Richard Lochhead for bringing the issue. He rightly says that it is not a new issue and I would go along with the credit that is due to Drew Henry and others for their work, but there is no doubt that Richard Lochhead has displayed real tenacity in that. Paying delicate attention to a lot that has been said and Mr Halcro Johnston mentioned that the MP for Murray was raising the issue in the house today. I did notice that Mr Lochhead had given us one example of the cost for relaying a referee's whistle to Murray, and I wonder if the two were not entirely unrelated. However, what we do know is that there is a disproportionate impact on the Highlands and Islands, and there are lots of nice phrases about it. There is the phrase statement of principles. We understand that competition law apprises, but also the example given of extra costs and no volume. It is called capitalism in some respects, but the reality, as we have heard from many of the examples, is that you cannot vote with your feet and you cannot go in to that alternative provider. When phrases such as post-cold penalty, the distance travelled, I think that that is one of the reports that was eliminating. Of course, we know that partial force has a single tariff for the mainland, and in Scotland we know off come of no powers or limited powers, but it is actually known of someone in Mr Gibson's constituency on the mainland who was making a telephone call to a retailer who said that they would be significantly surcharged because it was rural Scotland when they explained that there are literally 15 miles from Glasgow. That changed the tune. I think that I am interested to see that there is going to be some collaboration. I think that this has been an issue for long enough. I hope that we obviously need transparency with issues. I was contacted by a constituent, and I know all of those examples. I never thought that I would be discussing fishing waders in the Scottish Parliament, but there you go. He wanted to name and shame the Glasgow Angling Centre, now known as Fishing Megastore. It was a gentleman in his son. The gentleman lives in Moray. He lives in forest, and the son lives in York. He gives me the mileage, and of course York is further from Glasgow than forest, but the son gets them for free. It seems quite a modest sum now, £9.99, but that was the cost of taking it to forest. He describes himself, and it is correct that he says that he knows that I am a mild natured, but when a Scottish firm does it to its own people, I get a bit annoyed. He described as having a logical discussion with him a few years ago, but I might as well have been talking to the squirrels in the garden, that is what he says. I wrote to the squirrels in the garden, and I got a very peculiar reply. They said that I have received your letter regarding our delivery charges and found it a bit strange that an MSP would chase that up. They then asked for details, so I have chased it up, and I am chasing it up with UPS now. There is clearly a role for the UK ministers here, and if there is a willingness to look at the devolution of power and certainly support my colleague Rhoda Grant in calling for that, I think that the more powers we have here than we can address things like the rip-off that is self-evident in this, it is well done to Mr Gunn in Caithness, if I have caused to be transporting parcels in Caithness. It is Mr Gunn that I will turn to. I do recall living in rural Invernesha, a number as a child. Most of the buses had a section at the back that was grilled off. In fact, parcels came in the bus. That is what happened. Perscriptions came in the bus and they came in that. We have to look at that. Of course, it is very difficult to get competing companies to co-operate, but there are environmental implications particularly for this. If this particular approach could be adopted for other areas, I think that we need to keep talking, but I commend Mr Lockhead for his work, and I look forward to hearing the minister's comments. Thank you very much. I wonder whether the squirrels felt like replying. I call Liam McArthur to be followed by Stuart Stevenson. Thank you very much, Deputy Presiding Officer. Like others, I congratulate Richard Lockhead not just on securing the debate, but for his on-going work, including the recent round table here in Parliament. It has, as others have said, been a generally consensual debate, although I did take exception to Gail Ross planting a flag in the KW postcode and claiming it for a week, but we will move on swiftly from that. I also pay tribute to Citizens Advice Scotland for their latest postcode penalty and, indeed, for their on-going work over a number of years. Now, I remember lodging a similar motion back in 2012, but I think that it is absolutely right that Parliament is returning to this issue and showing a consensus across the parties that progress has not been fast enough, near far enough, and that we are determined to continue with pressing for more action. The postcode penalty reveals, as others have said, as many as 1 million consumers in Scotland are asked to pay at least 30 per cent more on average to have their parcels delivered than consumers elsewhere in Britain. For those of us living in the islands, as Alan Sir Allan rightly said, and for those that I represent in Orkney, the figure is even higher at around 50 per cent, always assuming that you can persuade them to deliver their at all.  We can all, as many have, cite egregious examples of eye-wateringly exorbitant charges of exceeding the value of the product ordered. Only those in Barra who do not wear boxer shorts can be happy with the news relayed by Richard Lochhead in his speech. Cases in which the existence of the islands, as part of the wider UK, are flatly denied by online and obstinate retailers. However, where I think CASP deserves particular credit is in for setting out some potential solutions for this, a call for delivery firms to collaborate more effectively with each other and with the public sector. Consideration of whether the existing post office network in the islands and islands could have a role in reducing delivery costs to consumers across that region. Support for exploring the potential for pick-up and drop-off networks in some areas. I recall when Parliament debated the issue in 2015, that Derek Mackay, who was then the transport minister—I know that I spent the afternoon trying to hold him to account—would be examining the possibility of creating collection hubs at ferry terminals as a way of making delivery charges cheaper. Perhaps the minister might be able to update us on that in his wind-up debate. Although companies can be persuaded—not necessarily the Society of Squirrels that Mr Finnie has been engaged with—they can be persuaded to look again at their charges and at their practices or, at the very least, to improve the transparency of the fees that they are charging. Much more needs to be done, so I very much welcome the unfair delivery charges campaign. I wish it well and offer it my support. I thank Richard Lochhead again for bringing the debate and for his wider efforts on the important issues for those in both our constituencies and well beyond. On their behalf, I hope, we will now see a stepping up of the collaborative effort called for by CAS, involving private and public sector with both the UK and Scottish Governments and OFCOM playing their full part. I thank Richard Lochhead for bringing the debate to Parliament. In 1812, my great-great-great-grandfather David Berry, who served in the British Navy between 1780 and 1782, required a duplicate copy of his service record so that he could claim his pension from the Ministry of Defence or its predecessor. That letter cost him £1.10 shillings to be delivered. When Roland Hill introduced the penny post in 1840, he transformed the whole nation, the whole island, by creating a uniform delivery charge of a single penny. Fundamentally different from what my great-great-great-great-great-grandfather had to pay for his letter. Interestingly, it saved money because it turned out that calculating how much it cost for individual letters, the cost of the calculation was exceeding the amount that it forego in charges by higher rates. Uniform charges can have economic benefits in some circumstances. We just need to get computers out of the equation. You would think that we are particularly disadvantaged in Scotland by our delivery system, but the reality is that if you go out to Edinburgh airport, you will discover one of the three airports in the United Kingdom. There is a huge transport hub together with Stansted and East Midlands Airport that transports huge amounts around the UK every single night. That is not terribly far away from Inverness, from Aberdeen, from my constituents and from the constituents of many of us in this room. The infrastructure is present. It can be done slightly differently elsewhere. I have a particular kind of shoes that I like for leisure wear that come from Australia. Historically, I have ordered them from Australia. They arrive in 48 hours and the charge for delivery is £15. Those are not expensive shoes, by the way. They are about £40. We are not looking at other ways in which the company is making a profit. If the company wants to deliver the shoes to Great Barrier Island off the coast of North Island and New Zealand, the charge is £8.50. Great Barrier Island is five miles further from Auckland than Stornoway is from Ulipo, just compare and contrast. Those shoes that are going from Australia to New Zealand are three to four hour flights and then on to Great Barrier Island. We know that they can be done differently elsewhere. I have constituents who tell me about their problems. The garden centre website advertises free deliveries on orders over £50, except if they are in Aberdeenshire where it is £20. It apparently means only England and Wales. Wayfair, free delivery within Great Britain, excluding extended areas—£25 instead of free for some of my constituents. The kind of stories that I have heard from every member who contributes here in a cross-party consensual way are the same. My wife, even, in an attempt to freeze me has ordered gooseberry bushes and black currant bushes for the garden for planting next year. An extra charge was levied, her teeth are still grinding, Presiding Officer. It is time that we did something about it, if only to stop my wife's teeth grinding. I, too, like to start by commending Richard Lochhead for bringing this debate to the Parliament for contributions from across the chamber. There cannot be many debates that unite Stuart Stevenson's great-grandfather, squirrels, fishing waders and referee whistles, but it is a clearly very important issue that has affected over 1 million people in Scotland. I am more than happy to have signed Richard Lochhead's motion and support his comments today. It cannot be stressed enough how people in the highlands and islands—indeed, other rural areas—should, of course, not be subject to exceedingly high surcharges based on where they live. It is fundamentally unjust and we should be doing all that we can to protect those in rural areas from such high costs. The period 2012-15 saw an increase of 17.6 per cent in surcharges for highland customers and a 15.8 per cent increase for island customers, excluding inflation. The problem is getting worse, and unless we see real change, those living in our most remote communities are only going to suffer more. In general terms, we need to dismantle barriers to communities in rural areas and reduce disadvantages to living in remote regions of Scotland. Encouraging private consumer spending will drive economic growth and help to reverse the population, which has become very problematic in many parts of the highlands and islands, especially Argyll and Bute. I, too, want to pay tribute to Douglas Ross, the MP for Murray, for his efforts in raising awareness of the issue in Westminster. He raised it in his maiden speech earlier this year. To paraphrase that speech, he said that high-delivery charges are disrespectful to the highlands and islands, inexcusable and plain wrong. I know that, in addition to pressing for a debate in the commons, he has called on the Scottish Affairs Committee to hold an inquiry into the issue. I hope that that committee does indeed hold a debate so that the issue can be discussed on a cross-party basis in Westminster in the same vein that we are discussing it here today. As Jamie Halcro Johnston has mentioned, Douglas Ross raised this issue at Prime Minister's Questions today, taking the matter to the heart of the UK Government. The Prime Minister committed the business secretary to meeting Douglas Ross to discuss the issue, and I am sure that it will be productive. It is incumbent on all of us to work together on this issue, as we have demonstrated in the photo call earlier today and in this debate. Through our efforts here in Holyrood and the work of those in Westminster, we can jointly tackle the problem. In an increasingly digital world in which online purchases are becoming commonplace, it is inexcusable that some parts of our country fall behind and are discriminated against due to their geographical location. I know from my own mailbag that there have been some extraordinary examples of individuals and small businesses being hammered by these charges. One constituent from the Western Isles told me that, when he tried to order some floor panelling from a company in England, they were seeking a delivery charge of just over £100. Another island constituent told me that he has to get his business parcels delivered initially to a smaller mainland courier who will then deliver the item on for a fraction of the cost that the larger couriers charge. He told me that plenty of people now make orders in this way. I commend many of those great local couriers, such as Woody's, who are based in Stornoway, for offering realistic and fair delivery prices, particularly for smaller items. However, it remains the fact that exorbitant charges imposed by mainland couriers are unacceptable. Remote areas of the Highlands and Islands rely heavily on imported goods, and we cannot expect our citizens to pay surcharges for products that they cannot find in their local stores. I trust that this debate will raise awareness of the struggle for those in rural areas of our country. I call on both Governments at Holyroods and Westminster to bring fairness to all, and I once again thank Richard Lochhead for bringing this debate to Parliament. Thank you, and I call Kate Forbes, the last speaker in the open debate. Ms Forbes, please. Thank you, Presiding Officer. It is the sixth of December, and I am embracing the Christmas festivities insofar as I have eaten a single solitary advent calendar chocolate. Christmas shopping for me is usually a five o'clock on Christmas eve affair, by which point most of the shops have closed, and I end up with an assortment of truly random things to bestow upon my predictably disappointed family. Even for those who have put the tree up, cranked up the Michael Boobley and are halfway through their Christmas shopping list, the season can have its gift purchasing disappointments, particularly for my constituents in the Highlands and Islands, when so many online retailers think that it is acceptable to charge over the odds to deliver goods and gifts to the Highlands and Islands. In fact, not only do they charge more, sometimes more than the product cost itself, but they justify it by classifying the mainland Highlands as overseas, and sometimes you do not even have the luxury of paying over the odds for delivery because the retailer just flatly refuses to deliver at all. I go home to Dingwall from Edinburgh every week on the Thursday train, and I have never needed a passport yet. Although who knows what will pan out this week, I have never needed a boat either. In fact, I double-checked Google Maps to see if the fault line running through the Great Glen had widened, casting as a drift into the North Sea, but again, despite Storm Caroline, there is nothing to report and we are still firmly, unalterably, irrefutably part of the British mainland. Despite that, Christmas shoppers living north of the Highland boundary line, which runs from Helensburgh to Stonehaven, and those in the islands will most undoubtedly face extra delivery charges over this festive period. It is not enough that the mainland is just classified as not being the mainland. It is also that islands need to get a fair deal too. Every day, the Royal Mail delivers parcels up to 20 kilos for a flat fee to nearly every home in Scotland—urban, rural, island or mainland—so there is no excuse. It is time, as my colleague Gail Ross and many others have said, that we named and shamed the retailers who get away with it. Just last night, I was tweeted a map of the United Kingdom, highlighting in green where Group On delivered and in red where they did not. The red was classified as not being mainland Scotland, and the miracle of miracles is that all of the Highland mainland was not classified as such. Just one story, because there have been many good stories that have been shared so far of a retailer in County Durham, is that there are standard deliveries that would include delivering to land's end, which is 500 miles away, with £6. However, to Fort William and the rest of the Highlands, which is 250 miles away, it was three times that at £18. That means that it costs three times more to deliver something half the distance. To add insult to injury, deliveries to Belgium, France, Germany and Luxembourg were all still cheaper than delivering to the Highlands. I would like to finish by paying tribute to my colleague Drew Henry for his efforts to introduce the Consumer Protection Distance Delivery Charges Bill in the UK Parliament. If the bill had been passed by Parliament, it would have required distant sellers to provide purchasers with the lowest available delivery cost option to introduce a quality mark for responsible retailers and to penalise vendors who advertise free delivery but then impose charges or conditions. It is time that all of us work together to do something along those lines. Thank you very much. I now call on Paul Healhouse to close the Government Minister up to seven minutes, please. Thank you, Presiding Officer. I want to start, as others have done, by paying particular tribute to Richard Lochhead. I congratulate Richard Lochhead not only on securing this important debate today, but I know that he has worked tirelessly on behalf of his constituents, including on behalf of constituents of many members in the chamber. I think that we are all very grateful for the effort that he has put in, not just in recent times but in many years previously as a minister as well. I suppose that I just want to highlight that this is a superb example to those outside this chamber of how an MSP in this place can make a real contribution to tackling an issue that is of great public interest, so I want to congratulate Richard for that. I welcome all his efforts and indeed those of others who have been named today, particularly Drew Henry, as Kate Forbes just said. Richard Lochhead has even managed to make it the front page of the Daily Mail last week, which is a remarkable achievement. I commend the Daily Mail, The Sunday Post and other newspapers for supporting Richard Lochhead's campaign. Given Richard Lochhead's own remarks, I am sure that he will agree that, although some progress has been made, much more has to be done to stamp out many of the unfair practices that we have heard about today. The Scottish Government is committed to continuing that progress, both to protect consumers and to support the businesses that depend on such transactions and to do the right thing and treat customers well. Before looking at the role of the Scottish Government, let me first say that I appreciate the tremendous work in Scotland that many others are doing to improve the situation. Trading standards within Highland Council is leading the way in enforcing consumer protection laws around internet sales. Citizens Advice Scotland is also working, as we have heard, on delivery surcharging issues, especially in relation to parcel delivery operators. Indeed, the research that CES has published yesterday has yet more evidence of the size of the problem. It makes clear the extent to which consumers from a wide area of the northern half of Scotland are seriously affected by substantial additional costs for delivery. They are, quite frankly, totally unacceptable and deeply unfair. It also shows that retailers are losing out on potential sales by imposing unfair charges. The report states that 83 per cent of consumers are more likely to buy more goods online if they feel that there are no unfair surcharges being applied to postage. It makes business sense to stop discriminating against customers purely based on where they live and to value customers who could become repeat customers if fairly treated. Citizens Advice Scotland will now use the evidence that they have gathered to search for practical solutions. It is very welcome that CES is working with partners to identify how co-operation can help to reduce delivery costs and to reduce inefficiency in delivering goods to those areas of Scotland that are affected. All the work that has been done on this issue by MSPs such as Richard Lochhead, Citizens Advice Scotland and others, shows many examples of unacceptable charges being imposed. Often, there seems to be no logical explanation for the amounts that are demanded, and I will refer to a few of those examples later. Richard Lochhead has highlighted some frankly absurd practices, for example, being cheaper to get goods from Germany than England. It should not be a difficult concept to understand that Ellen and Elgin are on the mainland as well. We have heard other examples today in Tareff. As far as I can conclude that Tareff is in the North Sea is quite crazy. I am happy to write to companies where bad practice has been identified and to invite an explanation for such practice. I would be grateful if members across the chamber could either give me details of the companies that they know about or feed them through to Richard Lochhead so that we are able to tackle companies directly about their practices. Of course, I know that what we need is systemic change and long-term solutions. I want to reassure colleagues across the chamber that the Scottish Government is working hard to find these. My predecessor, Fergus Ewing, chaired parcel delivery summits in 2012 and 2013, which eventually led to a statement of principles for retailers that have been referred to. I know that Richard Lochhead was involved in that as well at the time. We work closely with representatives from retail couriers and consumer sectors to achieve a positive change and to share good practice. Those included efforts to ensure that charges reflect actual delivery costs and to provide the widest possible delivery coverage. I believe that those principles have helped to raise awareness of the issue, supported good business practice and reduced the number of customers abandoning purchases that they would otherwise have made. However, while Scottish ministers can promote good practice and, in response to Rhodograt, we will use the powers that we have around consumer advice and information to do that, the regulation of prices for parcels is, of course, still reserved to Westminster. I have got competing requests, but I will take Mr Lochhead first, if I may. Richard Lochhead. Should I firstly add that perhaps a minister can add a press in the journal in Northern Scotland, STV and BBC to the list of outlets that have been sympathetic to the campaign? In terms of the UK minister's softening position, has he noticed how in the last few days there have been comments from UK ministers who now may be more sympathetic to regulation? Indeed, and I give my apologies to those other media outlets for leaving them off the list. I am pleased that they have supported the campaign, and I have noted a change in tone that I will refer to later, if I may. I think that Mr MacArthur was wanting to make an intervention. I am very grateful to the minister, and I also assure him that the Archerian and Radio Orkney take a close interest in the issue as well. However, before moving on to what he will legitimately say are the responsibilities of UK ministers and UK regulators, can he perhaps update us on the progress made in relation to the issue that I raised in my comments about potential drop-off points at very terminals and the like? Minister, and I suppose that more people will be mentioning more newspapers in due course. Thank you, Presiding Officer. Certainly, in relation to the points that Liam McArthur has made, I will come on to the matters around the UK Government. I certainly recognise the positive suggestion both in Citizen Advice Scotland's report and indeed the one that was referred to by Mr MacArthur about looking for sensible opportunities to use central pickup points for goods, and indeed that may be a solution, a wider issue that we face with local high street retailers who are often open during the days when resident population away commuting to work can then come back and then they are obviously closed. There could be a solution there to tackle more than one problem, which I certainly will be happy to pick up with Mr Yousaf in the case of the ferry terminals. However, the UK Government, unfortunately in terms of the initially refused to adopt the statement of principles, but we were very pleased when ultimately the announced the change of heart and adopted them across the UK. From a pragmatic perspective, we need to see more positive actions like that from Westminster because, of course, many internet retailers are based outside Scotland. Indeed, this issue does not just affect Scotland. An MP from Northern Ireland secured an adjournment debate at Westminster in September 2016, which led to the UK Government producing a leaflet outlining retailers' responsibilities. That, again, was welcomed. The Scottish Government welcomed that step at the time, but meaningful change will obviously only happen if the UK Government takes a far more active role in that. I am reassured that the UK Consumer Protection Partnership, which was referred to by Mr Halcro Johnston, is chaired by the UK Government's Department for Business, Energy and Industrial Strategy, and it is reviewing the evidence and parcel delivery surcharging and intense co-ordinated action by partners to address any consumer detriment. That is welcome if meaningful action is the result. I firmly believe that it is clear from Mr Lockhead's own data that examples of unfairness will emerge from this work, and I will seek to ensure that UK ministers deliver much-needed change in cases where charges discriminate against communities in Scotland. I was encouraged last week when the UK Digital Economy Minister, Matt Hancock, said that the UK Government would look into the matter, and we need to see that translate now into affirmative steps to address this unfairness. Around a year ago, I wrote to Margo James, the UK Minister for Consumers, who I have a good relationship with, but to explain the continuing importance of the issue, and while no action was taken forward by UK ministers at the time, as they believed that it should be left to the market at that point, I will be writing again after today's debate to convey the concerns that have been expressed across the chamber, and given the apparent movement indicated by Matt Hancock himself, Richard Lockhead, Citizens Advice Scotland, and other campaigners, and indeed the media, can take much credit for this change of heart. If I may briefly refer to a couple of comments that have been made by members in relation to the debate so far, we have had some really useful contributions from our right across the chamber, and I believe that some of them have highlighted specific examples that show and demonstrate the extreme unfairness that there is at local level. I would endorse those points but also remind members that we would be keen to get practical examples that I can take forward in subsequent discussions, and to that I want to turn now. This debate, of course, is a welcome addition to discussions and improving the online shopping experience for all consumers. There is much going on, and the Scottish Government will, I promise, continue to play its part in helping to find solutions that are tailored to the circumstances of Scotland. A meeting hosted by the Scottish Government in August of key partners highlighted the value of collaborative working to find sustainable solutions, and following my meeting with Richard Lockhead to hear evidence that he had gathered, I planned to host a round table to take that process forward. Let me be clear that there are no easy solutions to the long-standing problems that we have been discussing today, but I believe that we can build on the progress that we have already made. It will involve a range of initiatives and players, all with the aim of delivering the real change that is needed to eliminate the unfairness that is experienced by so many members' constituents across Scotland. I look forward to the support of members across the chamber in doing so, but I commend Richard Lockhead and all members here today for making very clear the impact on the local constituents. Whether it is waders from Glasgow or shoes from Australia, there have been some great examples here of just how ridiculous the situation is, and I hope that we can work together to make sure that this is the last Christmas that customers in the north of Scotland face such prejudice in the online markets.


I'm Sabine Artur-Prijone, I'm a professor of Sex and Gender-Sensitive Medicine at Radbaal University in Deinerands in Nijmegen and at Bielefeld University in Germany. In the last 10 years we have definitely seen an advance in the integration of the gender dimension in science, which is probably a combination between more knowledge arising and hence also an effect that more researchers get into it, but also of course the consequences of funding agencies requiring mo-focus on sex and gender and also journals requiring mo-focus on sex and gender. So although we are not there fully and this is not normal for everybody yet, but we're still getting to a point where more and more researchers are incorporating it and hence we're also seeing an uptick in the knowledge that is being produced and in the integration in practice hopefully also to follow. Now when we think about the gender dimension from a Horizon Europe perspective there's actually three layers that are addressed and one is the gender representation in teams. The second one is the gender representation in decision-making processes and the third one is the integration of sex and gender in content so in the work that we're doing. And while I would say we're definitely seeing a progress in the incorporation of sex and gender in the work that we're doing, we're also seeing definitely more representation in the teams in general. I think the part of the dimension where we mostly need to still work on is the representation in power dynamics. So are we seeing gender equality in leadership in scientific teams? I would say this is probably the one that still needs most work and where we still need to see most progress. For a research institute to systematically integrate that it really means that it needs to be incorporated in all processes at all levels. So that means that all the supporting facilities can play a role here from a grant office to all kinds of facilities, to ethics commissions we're working with, to all kinds of processes we go to be it training for for example students or for staff. So all of these layers can incorporate sex and attention to sex and gender and require it and then of course what also needs to happen is for the researchers themselves to embrace it and bring it into their practice. So it is really a combination between a top-down offer which has to be led from the top and a bottom-up request which then is incorporated in our practices.


Yeah, are you feeling excited? I'm feeling excited too. I couldn't sleep last night How are the pants? Good. Way to recover! This way this way this way. Let's go. Let's go. Let's go Does that make sense? So if you're coming down this lane, you're swinging high because your partner is swinging low to get that tic-tac-toe Yeah, so I just wanted to say this is crazy nostalgic for me I'm really excited to be here with you guys, and I'm just really proud to be doing it with this group I washed my whistle in my pants, and it like doesn't work properly anymore so Let's bear with me. I don't know last time that was cleaned off Thank you, yeah And they're making that path that a missile pass, right?  You're welcome Thanks, appreciate it. Get the car. You're here.  Okay?