So welcome everybody, it's my pleasure to announce the next speaker and talk speaker is David Holton he's specialized in Crypto cracking using FPGA's he has already given talks at the CCC events About the a 51 attack and it's the organizer of the tour camp and tour con in the US Please give a warm welcome to David Holton The state is yours. All right All right, thanks a lot Okay, so I'm here today to talk to all of you about legacy crypto and more specifically DES and This may be a little annoying for a lot of you in that All of us thought that DES was dead back in the late 90s like nobody's gonna use this anymore But it turns out that does is actually used in lots of different protocols that are still used today So did anybody see the talk you gave in 2012 with moxie Marlin spike on cracking MS chap v2 Okay, good. So a few people, but I'm just gonna do a quick overview of this because it's kind of part of The background for this talk so MS chap v2 is basically a way of doing mutual authentication using a password and It's used in primarily pbtp VPNs and WPA enterprise and so if you connected to the wireless network here using you know using them in password you were using MS chap v2 which relies on DES and Another thing is that the research that we did is nothing new Actually, Bruce Schneyer and Mudge and David Wagner published a very similar attack back in the late 90s And so this attack was known about for you know Almost 13 years up to the point that we that we presented a practical way of exploiting it And so people knew for you know over a dozen years that state actors well-funded organizations could Basically break any of these protocols that they relied on MS chap v2 and Just as a quick overview of how MS chap v2 works You have you know, hello You get a random server challenge the client generates a challenge and then that's kind of a hash together to create your challenge hash But the the important part here is that you have this challenge hash, which is your known plaintext It's actually sent across in the clear so both sides can can you verify the password and then? then basically use DES to encrypt this challenge hash with Essentially the NT hash of the person's password Which is essentially the the password equivalent and then that creates a challenge response it gets sent sent across and that's how you verify that the client has the correct password to authenticate to a service and Up until this point people had just tried attacking the user password because obviously You know common most of the time the password is the weakest link in most of these systems people choose horrible passwords and That's usually the you know the fastest way to attack this and so people would you know Do dictionary attacks and tried all the commonly used passwords in order to to try to break this and using programs like John the Ripper or sleep or There's a number of different ones that that rely on a word list But if you wanted to crack say, you know a 255 character Password with uppercase and special characters and everything you're looking at around 92 bits that you would have to brute force Which is you know would take a ridiculous amount of time Whereas by attacking the DES operations in this to crack the NT hash We're looking at you know on the order of around 2 to the 56 to the 57 sort of operations. So It you know wasn't till recently that this sort of attack was actually feasible to actually do an attack on DES and And so this was outlined in the late 90s and so we thought oh, why you know, it should be easy to do this I built, you know a couple of DES crackers using FPGAs so we thought let's let's try to actually make this a practical attack and so looking into this some more and One thing that you start to notice is that? Your NT hash is 128 bits and a DES key is 56 bits and so So actually this NT hash in these first two, you know is the fold to the 56 This one is only six a 16 bit key that's being used. It's just zero padded to be to be 56 bits and When you look certainly at the complexity. Yeah, it's you know to the 57 or so But because of that 16 bit key you can basically throw that away that you can do that with any sort of computer You could do it with an Arduino right and so so now we looked at attacking the first two keys which are the full to to the 56 and One thing to notice is that they're encrypting the exact same plain text between these two DES operations And so a naive implementation of this is that you crack both keys totally separately Where you know you go through the whole key space to try to crack one key and go through the whole key space to Crack the other one but one nice thing about them using the same plain text for both is that you can go through the key space just one time and Just have two compares after you do your DES operation to crack both of the keys And then on average you're going to be cracking both keys and around 70 percent of the key space So I mean you can do the math there, but it really comes down to around two of the 56 DES operations to break this And so, you know, we demonstrated that yeah, you know There's a slight optimization where you can do it in to the 56 instead of the two to the 57 point whatever that that Schneier and Mudge pointed out back in the 90s and The other big thing about our talk is that we made it accessible to everybody so everybody could perform this attack and And and so how we did this was Moxie Marlin spike already had this service called cloudcracker.com had anybody heard of cloudcracker It was somewhat popular in in 2012 and so We basically hooked up a bunch of FPGAs in the back end and tied it into cloudcracker.com and published this Python app that would extract All of the key material for cracking pptp VPN exchanges And then you could just submit a token to cloudcracker and then within 24 hours We would send you the DES key or the NT hash And so then you could use that NT hash to authenticate to the pptp network decrypt all the traffic You know, it basically do all the all the different sort of attacks that you would require a password to do And a lot of you may be thinking, you know, we gave this talk in 2012 You know the ff came out with a descracker in 99 or 98 and so Shouldn't des be super easy to crack at this point and So just a quick overview the the ff descracker in 1998 took around 9.2 days to go through the whole key space And we wanted to get this down to around 24 hours And so looking at all the available options out there If you use say aws ec2 CPU instances It would take around 80 000 cpu cores and cost you know in the order of a hundred thousand dollars or so To crack a deskey in that type sort of time period assuming that they had those instances available for you to spin up On gpu instances, uh, you know, it would be around 1800 gpu's and take around 20 000 dollars in ec2 credits to to crack a key And what we offered was 20 dollars to crack a key and it would you know return it back in around 24 hours And this was essentially a hardware that we were kind of like doing burnin testing on with my company Because we make fpga boards And so um, so we would just you know run them through the system to crack deskeys You know to to test them out before you ship them out the door to customers and then eventually A lot of this hardware kind of went end of life right now. It's a few generations behind And so now we can't we don't really sell them anymore so it ended up getting kind of migrated into my basement and uh And so now I have the server in my basement that cracks des and less than 24 hours And then you know, of course after you gave this talk in 2012 everybody rushed to fix everything, right? Right? I mean, of course everybody fixes everything, right? and so specifically one of the You know bigger vpn providers that we pointed out specifically in our talk iPredator and you know said oh, you know like these this this company has you know Many many customers and they're vulnerable to this Their fix was basically to just do a little post on their web page saying that They recommend that you don't do pbtp vpns, but you know, they still offered the service. So everybody kept on using it, of course, right? um And then and then also people kind of dismissed our attacks on wp enterprise in that everybody does strong certificate checking I'm sure all of you have installed the certificate For the the network for shot 2017, right? Can I guys see a show of hands of who actually installed the certificate for the network? Okay, so a few people that's good But you know in large enterprise environments Enforcing that across all of the different, you know clients and people that are bringing their own devices and connecting to the network Is very problematic and and in a lot of cases These operating systems don't do very good certificate checking So anyway, we we started running the service and Almost immediately I started seeing very interesting jobs pop up Just as an example here this top line is kind of a standard job, you know, everything's fairly random But then you look at this one and like the plain text is one one two two three three four four and that seems strange for You know, basically a random shot one of you know, a couple challenges So, you know, that seemed a little weird We're wondering what that was and then also we got these where both the cipher texts are exactly the same and so That you know, that's very crazy odds to end up with something like that And so we're like what are people using the service for? And and then we started seeing articles of people, you know Using our service for cracking wp enterprise, which is great And and then also this kind of popped up Has anybody here used the smb capture module of metasploit or a responder or anything like that to crack windows authentication Okay, well anyway So this is kind of the standard challenge string with windows authentication that if you're doing Windows authentication man in the middle attacks Most of these tools will just set this as the challenge And then there's already rainbow tables for attacking the password based on You know captures using this challenge and so I was like, oh, well People are obviously using our service for cracking passwords that they aren't able to crack with with these password based rainbow tables And and so people are obviously using the system for all sorts of other Purposes and what we were originally intending it for And then one day all the traffic kind of dropped off to my server And a cloud cracker went down mysteriously. I still have no idea what happened to it, but Since I run tour con I thought maybe we could offer this as a service of my conference And so we started this website called crack.sh Which is basically just a you know, pretty front end to the desk cracking service And it takes the exact same You know format as as the cloud cracker system did for for cracking these jobs And so um Then you know, I kind of took it by myself to look into what people were using this for and try to add more features to You know make it applicable to a lot more a lot more things So what features should we add and and the really the main point of all this research that we've been doing for You know six years now is how can we finally kill des once and for all and How can we get rid of this legacy algorithm that's been known to be you know insecure for 20 years now So looking into windows authentication for landman and ntlm v1 If you if you look at how how this works, it's actually very similar to ms chap v2 The only key difference is that your challenge is actually set entirely by the server instead of being hashed with a with a client challenge So um, and I think that this is technically ms chap v1 that that they're using for windows authentication And I I think that there's still probably other systems out there that use ms chap v1 In which um, you know this attack works works great And so um, so yeah, we saw people you're using this because um One of the things with using a rainbow table or using uh, you know Password-based dictionary attack is that you're attacking the password But with our service it works a hundred percent of the time no matter how complex the user's password is and so So yeah, I started talking to people that were doing pentests and they were saying. Oh, yeah, you know like uh They're we're trying to crack an account that um doesn't even have a password set or you know It's like a one of the computer generated accounts that has a randomly generated 255 character long password And they're actually able to crack the nt hash and then log in as that user that you aren't really supposed to be able to log in as And so um, this is this is very interesting in that um, a lot of people were thinking that their password security policies were really doing something But in this case, uh, it didn't really matter. Um, how how complex the passwords were And so um So we ended up adding in some support where you can basically copy and paste in from S&B capture directly into the website and then for $20, you know, you would send you the key And uh, and then you could log in as that user on the network And uh, and then also in in the meantime, uh, this program called responder came out, which is basically um a way of doing Windows authentication man in the middle and so Uh, if you fire up responder if it uh, it looks for any sort of net bios name resolution requests And then it basically just resolves them to the tacker server And then you can do downgrade attacks to downgrade them to landman or until mv1 Do the full um, you know miss chap v1 authentication and then um, the result is that you end up getting this This uh response value that then you can feed into john the ripper or feed into our website and crack the key based on that and so um So with a lot of networks, especially ones that have, you know, some older devices on them that require landman or until mv1 Um, you know, you fire this up on the network and you're going to be getting just millions and millions of You know devices responding to you that are just, you know Automatically trying to connect to different, you know, um file shares and authenticate on the network And uh, and then also with wpa to enterprise, uh, since then there's been, um, they've come out with host APD wpe, which is, uh, basically a host ap um Uh server that you can run on your device and then it essentially, uh, you know Fakes a base station people connect to it and then it gives you a nice hash that you can crack with john the ripper or feed Into our website and then um the resulting nt hash that you get from our server, um You can authenticate with to the network so now you can log into the to the you know enterprise network and um and do it Without even knowing the person's password because you have the hash of their password And then also um in the meantime, uh karstin nil gave a talk, uh back in 2013 about Cracking over their updates to sim cards. Um, so And most sim cards there's actually like a, you know full java virtual machine that um Supports all sorts of different things and uh currently, you know Your carrier can send remote updates to your phone and update your sim card firmware and then do all sorts of things Like you know listening to your phone calls or you know Scary things like that and so he demonstrated that a lot of these cards are actually secured with single des and um And basically, you know outlined how you could use a service like cloud cracker or crack.sh To crack these over their update keys and then um, you know installed All sorts of nasty malware into people's sim cards And and then also if anybody here watches mr. Robot, this was featured on mr. Robot in season two episode nine so We we also wanted to make it so that any sort of other weird protocols like um lots of uh Radio protocols use des still um lots of satellite protocols, etc Um, we want to make it so anybody could use a service to crack anything anything that uses des So we decided to create a general purpose interface where you just kind of provide Uh the parts of the plain text that you know and parts of the cipher text You know and you can um and then we basically Run it through the FPGAs and send you a list of all the possible keys that meet that criteria And then you can do further checking on it. Um later on with software And so we have you know, basically just a simple kind of uh, you know We do the des operation and then apply a mask and do a compare and all this is up on github if you want to um try to Crack something that you found And so after I put together this interface, I wanted to you know, just show create an example app for this and um so my friends had worked on uh some kerberos attacks and They'd mentioned that they'd come across a lot of networks that still Use our support doing des kerberos authentication And um and this was you know, this is stuff that was supported back. I think pre windows 2003 But a lot of networks still have legacy machines on them that require this to be enabled and so um So I thought oh, you know, this should be fun. I'll try to crack des kerberos And so, um, there's all sorts of uh different parts of the protocol that you can use to crack the des key and um But the the key part is you have to be able to get uh, you know A network capture of them actually authenticating and you know getting tickets and stuff like that using des And so I just put together a simple editor cap filter that substitutes Basically any supported encryption type with uh does cbc crc, so um So now, uh, you know man of middles, uh, you know a connection and then says oh, we only support des cbc The client connects the server and um, and now they're going to be you know Communicating just using des And then because the whole protocol uses asn1. There's all sorts of uh plain text that's basically fixed just as part of You know the headers in asn1 That pretty much are always there And uh and then because of how cbc works we can basically attack any block in the whole You know message that's encrypted with des uh to figure out the key So it's only a matter of you know looking through the asn1 and figuring out where it lines up with uh with static values to To figure out how to extract known plain text and your cipher text to create a token to submit to the website And um and the reason why this this works is basically because um with cbc It basically the part of the ciphered block chaining is that you have The cipher text of the previous block that gets x-word with your plain text And so both of those values are known and so then you can you know use that to crack basically any block within the chain So um also on github, uh, you can take this uh, you know python script and point it at a pcap file And uh if it's using des cbc It'll you know automatically figure out the known plain text and create a submission token that you can submit to the website And crack the the des key for it And then of course, you know this works no matter how complex a person's password is because we're actually attacking the underlying protocol And not the password And so um another interesting thing that came up is that I started receiving people asking uh People emails from people asking if I could crack uh des crypt and does anybody remember? Back when your you know password file had uh had a hash in it that Had you know a des crypt Password yeah, I mean like nowadays nothing supports it right and so why are these people trying to crack des crypt hashes right? um, and so I started looking around and um, I guess that des crypt was it's basically 25 rounds of des uh to hash the password And um, and then they add in some salt to mix it, you know mess up the s boxes to salt it But it was originally designed so that running on a pdp 11 It would take you know over a second to compute a password and so obviously it's a bit faster nowadays But nobody uses this anymore right? right So it turns out that cunyx, um You still uses uh des I think that they actually support two different types They either support des crypt or their own proprietary one that's fully reversible so des crypt is actually the most secure option that they support And um, I found this press release from them from two years ago saying that they're in 50 million vehicles And i'm sure that they're in way more. Um, basically a lot of infotainment systems use cunyx And so, um, if you look at a lot of these talks that people are giving on on car hacking For example, uh, this one right here is from the charlie miller g pack From from his white paper and there's the password file with the with the des crypt hash in it Um, this is another talk that I found that, uh, you know, they just showed the past the shadow file From a from cunyx, uh, you know system running in a in a vehicle somewhere And then you know searching around online, you just find all these forums of people asking people to crack their des crypt hashes So, um, so I was like, okay, maybe there's there's something to this And so I implemented, um You know an fpga core, uh and support for the service to crack these and uh, you know Just runs through the whole key whole entire key space So we can guarantee that it cracks the password 100 of the time And um, and this is basically, you know, all 90 95 possible characters including nulls and stuff so 96 to the power of eight And then times 25 rounds of des and so it takes around three days for for the system to brute force at all And so I thought oh, I'm just gonna you know own all the things. I'm gonna get all these cool passwords and um, so you know you can take any of these plug it into the system wait three days and uh You know, I'm definitely going to find some really secure passwords using this method, right? You may you may sense a recurring theme in this talk um So I even had a friend. I was like, okay, give me give me the best password file that you have and and uh, He's like, oh, I just like opened up, um Uh one of these on star systems. It's basically in every, you know Any every vehicle that has on star and I got the shadow file off of it. So here you go try to try cracking this I'm sure it's really tough And it turns out that it's just root The root password for on stars root Um So the the g pack it's dt donkey for this other one. It's like vui. It's all just lowercase Alpha, you know, like I could have just cracked this with john the ripper and you know in a day or whatever on it on my arduino, so I I'm very pissed off at this point. So if anybody here has any sort of These hashes that might be difficult to crack Please let me know because I wasted a lot of time implementing this To go through the whole key space and I really want it to work on something that's that's difficult to crack So that's kind of how I feel um, but anyway, so uh the api uh for for just cracking arbitrary does stuff is up online You can check it out on github and um And then you know, we basically send you a like a gzip text file with a list of all the keys So you can you can try all of those And uh the the real thing, you know, it's like we're trying to fix this somehow and um And so I like to use this one example of of ways to fix things and as far as security So does anybody here remember session hijacking being able to steal cookies? You know over unencrypted, uh, you know web sessions and stuff So does anybody here remember fire sheep the firefox plugin? Yeah, yeah, so that got a lot of press And so, you know, it we knew about session hijacking for a good half a decade and um, and all these services, you know Like uh, facebook and amazon and like all these major websites Uh, never fixed it. They were like, oh, it's not an issue. Uh, you know only these wily hackers know how to do this But then it took, uh, you know a couple people making a firefox plugin that made it So you go on any public wi-fi and you see a list of all the sessions out there You can just click on them and log into someone's facebook account. It took that for Suddenly, you know within a month or two facebook does, you know ssl across Everything, you know amazon does ssl across everything all these websites now are fully ssl secured and so, um So this is kind of like, uh, you know that essentially what our project is trying to do is, uh Slowly but surely make it easier for everybody to do this sort of attack In order to get this finally phased out And it seems like an impossible task to kill a legacy crypto algorithm, but that's kind of our goal at this point so So then we started asking ourselves like how do we actually motivate this change more than just having a service out there that costs $20 and um, the biggest problem with the service is that, you know, it's It's a you know system with 48 fpgas Costs a lot to power it and the biggest part is that we need to have some sort of form of rate limiting So that people don't abuse the service and so that's why we charge the $20 And um, and so we asked ourselves what if we could make the service free and So going down that rabbit hole We were like, okay. Well, so to make it free, uh, we have to make it fast enough So that you know, we don't have to care too much about rate limiting or you know, we can we can deal with it And uh, we have to make it so you know draws less power and a lot sort of stuff And so obvious solution is maybe we could make a rainbow table of this And um, the the main issue when you look at making rainbow tables, especially of this size is that it's a very large key space Just for reference like the largest off-crack table is Around two to the 52 and a half and you know, we were looking at doing two to the 56 Which is you know, about 10 times bigger than the largest password rainbow table out there And um, and then also one thing what does is that uh, you know, it's a block cipher So we have plain text that we have to take into the equation so um Our our base our design goal was to make it so that it was just for a specific plain text And so of course we chose the one one two two three three four four, which um, we could use to attack windows authentication And um, and then we also wanted to make it have a really high success rate because um, you know, we you wanted this to be a service that was very reliable and um And especially because we're doing cracking two desks, you know the lower the uh the success rate than the higher You know, um chance of us not being able to crack You know two keys and we only crack one and that then it's not really worth it So um, and then the other thing is we wanted to make it as fast as possible so it could be close to real time And uh, so, you know, it just becomes that much more easier for people to use So, um the hardware that I just had uh available Um, I was like, okay. Well, I could I could easily afford six terabytes of nvume drives because they're super fast and um, and then I could also borrow some uh, you know high-end FPGAs for my work So these are being borrowed for now And uh, you know, I can borrow a server and so, you know, it doesn't doesn't cost that much to put this together And so I came up with some parameters The chain length is around half a million links per chain And then, um, you know around, uh, 275 billion chains per table It's like, okay, we'll have three tables and then this will get us a crack time of under three seconds. That sounds great. Let's do that And so, uh, to then I had to generate the tables and so I managed to borrow some hardware Um, I managed to borrow like 48 FPGAs, um, they're pretty high-end and so it's like, whoo, let's get going here and uh, you know put together a design and used, um A bunch of techniques that we figured out with putting together the first does cracker. Um, one of the main ones is that with the large FPGAs uh, you end up having lots of routing issues and so Um, most of our designs nowadays just have a really really narrow bus that we use to connect all these different cores together And then, um, essentially placed and routed just for individual regions on the FPGA So each one of these squares over here are individual clock regions And then, um, then we just kind of chain them together in a way that we can, uh, you know just Essentially kind of create a ring, um For passing data between all the cores and then, uh, it makes it so we can clock it faster and, um and you know just uh make a Use some more of the FPGA and um, it's just a lot more efficient to do it that way. Um So anyway got the core going got the hardware started running it and Then of course there's hardware problems, you know anytime you deal with hardware, um You know running 48 FPGAs of these of this size in one system obviously Creates lots of uh overheating issues. So had to deal with that Also turns out turning on, you know, like over a hundred des cores in an instant Uh power supplies don't like that for some reason Um, you know just like immediately going from drawing two amps to drawing like 40 or 50 amps Lots of power supplies don't like that So we had to refactor a bunch of things, uh, you know fix a bunch of issues And eventually we got it fixed And um Finally got some tables back that we could check and unfortunately there is a really high collision rate. So then Uh, it basically meant that the tables that we spent, you know a few weeks building were unusable But we learned a lot of lessons and so Um came up with some new parameters basically because of the collisions we had to pare down Our ambitions a little bit. So we went to 12 tables instead of three and um And then that kind of increased our crack time to closer to 12 seconds Which is still still reasonable, I think so um Then more more issues, you know, like the hardware that we borrowed ended up having to actually go out to customers for some reason and so So we ended up having to return some and then um, you know, it's been a few more weeks generating tables And now we have our cracking system up. So this is uh, the system it has six FPGAs and these are the NVMe drives They're just like the tiny little m2 laptop ones and PCIe adapters and then Just to channel all of the air over to the FPGAs to keep them cool. I just put in some foam To channel the air. So it's um very very high end here And uh, and then it turned out that our coverage was better than expected right now we're at about 99.65 success rate and um, because Ideally we would have uh 12 FPGAs, but because we have six we do like the first half of the tables on six and then do the second half and so uh 92 of the time, it'll crack the key in under 12 seconds and then um And then you know, if it doesn't crack it then then it'll take another 12 seconds um And so for two keys our total success rate is still over 99 percent and um, you know Most of the time it'll take less than 24 seconds, which is pretty quick So anyway, um, it's free anybody can go to crack.sh and uh submit jobs and it'll Crack desk keys with this plain text, uh, you know within a matter of seconds So, uh, I thought I'd just do a quick demo. Um, so you guys can kind of see one of the practical applications of this. Um It might just be kind of useful since a lot of you it sounds like haven't used responder before So let's see here. Oh all right So I have a cali linux running on the left here for some reason my video is uh acting a little weird, but Yeah, I will okay So um, let's try firing up responder So now this is uh, you know on on the internal network between the windows host and and cali linux And this is the same as you know having You know laptop running cali linux just plugged into a corporate network And now whenever any machine that's running windows on the network, you know Goes to any file share or whatever. It's basically it doesn't matter what the file share's name is it's going to respond to basically everything on the network um Now so it just captured um, you know sent out that one one two two three three four four challenge and got response back here So now we can take this response and um Go over to crack.sh Just uh type an nt hash I'm pasted in here Oops, and now you know just type in your email address And uh, I didn't want to do this on the network for various reasons and so I kind of had this pre-canned But basically within You know most of the time within 24 seconds you'll receive the nt hash for that user in an email And we also have an api if you want to just automatically build this into responder or any of your tools So now um, this is essentially the password equivalent for for that user And then if we switch back over to here, you can do um something like smb client And tell it that we're going to give it the nt hash instead of the password Oh And then just paste in the nt hash and now you know we're on the on the system And um, and then also, uh, I assume some people here use metasploit or ps exec or okay, so um So there's also this cool feature in metasploit. You can also there's a bunch of different tools that do this, but um It's basically a way to get a shell on the system using Using an nt hash so you can um, you know, there's a bunch of different modules for doing stuff like this But um, I'm just going to show the ps exec module so So we're gonna Basically tell it to call back to us with uh shell and uh And then our samba password is just our hash here user client And uh, I tell it to exploit So now it's connecting uh, authenticating with the server Or with the you know the windows machine over here Using that that nt hash and then um, you can just say oh, I want to show them and now You know, I'm running as a system on there and um, you can do Basically any sort of commands um on the system As that user so then you can install backdoors or you know, whatever nefarious things you want to do So um, anyway, that's uh The quick demo of responder using this and uh, and yeah another just to Hammer this in a little bit more, you know, it doesn't matter how complex the user's password is doesn't matter Even if the user, you know set a password if it's, you know, a computer user or something like that This attack works for that 100 of the time within around 25 seconds So um So if we look at this in the scheme of morse law, you know We have the eff does cracker that came out in around 98 ish and uh, you know Took about 9.2 days to go through the whole key space and now fast forward about 13 bits in the future, you know 20 years We're looking at uh, you know in theory if morse law holds true For you know, if the eff did the same sort of thing today They'd be able to crack any deskey with any plain text and all that within around 97 seconds And you know, you could scale that obviously to well funded organizations and governments that have you know A few million to throw at this to get it done in a matter of, you know, uh, you know less than 10 seconds so um So I guess uh, you know With these legacy crypto algorithms, we're going to be seeing this more and more prevalent over, you know The next few decades of uh morse law catching up to these And uh, and then also another thing in the mix is that now, you know, especially with time memory trade-offs and rainbow tables You know with uh somewhere around 20 000 dollars. We're able to crack deskeys in 12 seconds, uh, especially with All this new Cool, you know nvme technology. There's other sorts of storage technology that's coming out That's just going to make these sorts of attacks even faster. Um So, um, so yeah, this is a really big issue. How do we get legacy crypto to be phased out? And we're trying this method right now and we'll see if it works. Um But uh, we really need help from everybody. So We have an api uh that you can use to integrate the service into any of your applications We'll probably be coming out with one that goes directly into responder that will just automatically, you know, reverse it to an nth Somebody already put together an airbot plugin so you can connect this to slack or irc If you want to submit jobs to the system over irc or something should be kind of funny And then uh, if you want to run it yourself, we put all the code uh up on github. It's all open source. Um, so uh, the this desert top is the actual software that um Kind of uh does all the lookups and run stuff, uh on the fpgas And then uh, this is actually the fpga project the desert t fpga and it's a vivato project that you can build for for any fpga um We also uh, thanks to the knock team and also uh yellowcation We managed to get a copy of the six terabytes of tables up on the network and um, and so if you go to Uh, either of these websites you can start downloading them And we're also trying to figure out the best way of getting it out to you know Be mirrored and torrented and all that sort of stuff So if anybody has any ideas or happens to run their own mirror for open source projects And can spare six terabytes or can leave this conference with six terabytes of drives Um come see me after the talk And um, and then obviously there's uh, you know, this all this stuff is built on uh the shoulders of giants So there's um tons of research that You know, it's kind of the precursor to all of this. Um, you know, I talked with moxie and marsh a while ago Ian foster you have a talk earlier today helped with some of the host a piece stuff that I was working on and um and then again special thanks to to protagonists in the knock and uh yellowcation for for helping get the stuff Online when I approached them basically yesterday afternoon and asked them if they could help me Get these tables up so people can download them So, um, anyway, uh, help me kill legacy crypto And if anybody wants to run free jobs once again, you know, this is just a method of Of you know, uh making sure the system isn't abused. So just email me if you have any interesting research ideas um everything's online and uh, and then also This whole thing is, you know, basically all the money that this generates goes directly toward running our tour account events And so our next tour con event that we have coming up is in san diego at the beginning of next month and um Then we also have uh, we also run the us hacker camp called tour camp and that's going on next summer. So Just as an extremely shameless plug for tour camp. It's a lot of fun We're out on one of the islands in washington and um There's people ring, you know pay phones and lasers and same stuff that you see here So if you want to come party with some of the american hackers, um, don't forget to Add that to your calendar. So thanks a lot for your time Thank you very much david and we have plenty of time for questions. The microphones are open If you have any question just queue in front of the mic crickets Okay, we have the first question Do you have any numbers on um, how long it takes? So the Expansive it is to round this on um easy to f1 Instances. Oh, yeah Yeah, so um, so yeah, there there's amazon f1 instances that came out recently and um And yeah, I was on their beta program and played around with it a little bit It looked like based on their pricing It would it would still cost like over a hundred dollars to crack a diskey like a hundred and ten or twenty dollars I think that's what I calculated. So um, so yeah, we're probably going to eventually migrate over to that But hopefully the pricing will be a little bit better Or maybe we could just add it as an option if somebody, you know, just wants to You know, we could provide an AMI or something if somebody just wants to pay it out of their pocket to to run it on there Cool. Thanks. Yeah More questions from the audience It seems like you've done dares pretty much as thoroughly as can be done So what's next? Well, so so I've done some research on On automotive like a mobilizer algorithms like high tag two and dst 40 and 80 and stuff like that And so I mean there's lots of low hanging fruit and that's sort of you know in the rfid crypto stuff Yeah, I mean basically anything less than 80 bits is probably something that that we could you know look into But yeah, it'll be a while before we can attack anything, you know much higher than that But if anybody has any ideas, please let me know So you basically already answered this one, but uh triple desk or double desk basically the to take keys That's way out of reach still right Yeah, yeah, um, I mean maybe once yes storage and uh, you know the Being able to do meet in the middle attacks and stuff like that is a lot more feasible than We'll be able to do that. But yeah for now. It's it's kind of uh I mean for for me like practical attacks are things that we could do, you know in under 24 hours um Because then if it takes longer than that then it's not really going to be you know that that useful to the most people And so I think it'll be a while before that's a reality, um but Yeah, for now for now a triple desk is safe for people like us at least Any more questions Okay, well, um, what if anybody wants to chat more about this or wants to help spread the tables then, um, please Come and see me after I'll probably be just right over here for now. So Thanks a lot. Yeah, thank you very much, david


Okay. Let's start this. So, good morning everyone, good evening to others. It is my pleasure to welcome everyone to IOM's live session, Protecting Migrant Workers Across Supply Chains Through Blockchain. My name is Tara and I am so very grateful for the incredible experience and expertise that is reflected by the panelists today. So joining us is William Gois, President of Migrant Forum in Asia, Mi Young Park, Chief of Mission for the International Organization for Migration Vietnam, Shuba Sekar, Director of Human Rights Eurasia and North Africa, the Coca-Cola Company, and Mark Blick, CEO, Diginex Solutions. As those of us here today know, the UN Global Compact is about mobilizing a global movement of sustainable companies and stakeholders to create the world we want. This mission feels even more vital now that a global pandemic and growing social discontent have highlighted so many of the weaknesses in our institutions and systems, leaving many populations, especially minority and migrant populations, struggling for survival. To realize this mission, the Global Compact supports companies to do business responsibly by aligning their strategies and operations with human rights and to take strategic actions to advance broader societal goals with an emphasis on collaboration and innovation. This is what IOM's live session today is all about. Before COVID-19, migrants who make up only 3.4% of the world's population contributed nearly 10% of global GDP. I hope that good that has already come from global current events is that there is greater appreciation for the outsized and vital role that migrant workers play in all essential sectors, from harvesting the food on our plates and producing the communication devices in our hands to the medical professionals currently at the front lines, promoting the rights of migrant workers will contribute directly to achievement of the Sustainable Development Goals from the elimination of poverty, economic growth to achieving sustainable cities and communities and so much more. We must also realize that we cannot achieve recovery from COVID-19 nor global goals without the essential contributions of migrant workers and businesses that respect them. Our speakers today will shed valuable light on how this is possible through listening and responding to the needs of migrant workers, aligning strategies and operations and leveraging collaboration and innovation. So on that note, let's start today's discussion. William, recognizing that migrant forum in Asia is a regional network of non-government organizations, associations, trade unions of migrant workers and individual advocates in Asia who are committed to protect and promote the rights and welfare of migrant workers. Could you please open our discussion by sharing more on the prevalence of migrant workers within and from this region? Thank you for this opportunity. Thank you. Can you hear me now? Yeah? All right, great. Thank you and thank you for this opportunity to be part of this panel as well. Just to start off, we have migrant workers in the region and when we're talking about migrant workers in the region, you have to think of the spread of the region with the largest number around 40 million plus just in the Gulf region alone, 40 million from the region itself. And a large concentration of these migrant workers are in the Gulf countries, the GCC countries. But then you have other corridors as well. You have Japan, South Korea, the East Asian Corp. And then you have the Southeast Asian corridors as well, which is Thailand, Singapore, Malaysia, Brunei kind of thing. And with this kind of spread and you have the spread of migrant workers from workers in the informal sector right up to workers in the formal sector. So you have that whole diversity spread from domestic workers to pilots and incidentally today's international domestic workers here as well, fine domestic workers here. But and this is where we are in this region. When you look at the numbers, it's enormous. When you look at countries of origin, it's growing. There are new countries of origin coming on board in a much bigger way. And in traditional states like India, you have new states coming on board. So you had, of course, the traditional states like Kerala, Tamil Nadu and things like that. But now you have new states coming much, much from the North, new states coming on board as labor deploying states and largely again to the Gulf countries. You have the strengths of these different countries of origin also in terms of and when I'm saying strength in terms of bargaining power in terms of having policies and regulations for protections of their workers varies from maybe Philippines being at the top with very strong protection measures for its workers. And then you have countries like Bangladesh and Nepal, which have seemed to have weaker bargaining power. And then you have with India the state levels of variance among states where you have a state of Kerala, which has very sophisticated laws and policies and programs. And then every new emerging states from India like Bihar, which will have very not not enough kind of regulation and protection and even mechanisms. So it's not all it's it's it's very, very diverse in that in that regard. You have different processes in the region, which bring together states to learn from each other in this practices, but it's a long way before we actually get some kind of standards and some kind of common thing or common practices that would uphold the rights of migrant workers or protect the rights of migrant workers in the region. Some of these processes are like the Abu Dhabi dialogue, you have the Colombo process, you have the ASEAN forum on labor and migration, you have the Bali process. And not to say there's not enough of these global and regional processes out there for states to kind of learn and bring up their kind of standards for the protection of their workers. But in very many cases at least among countries of origin, we have seen it's largely a race to the bottom of the barrel in terms of how migration is become such a how states have become so dependent on the deployment of migrant workers and largely in the in the low-skill sector, low-skill, low-wage sector, almost like an economy of scale in terms of deployment for emergencies. But I'll stop there briefly. Well, and thank you for that, William. I really appreciate you not just highlighting the prevalence and the sheer scale of movement of workers in this region, from this region to others, but also that you started to talk about systems of protection and mechanisms that are in place to consider this. From the experience of your members, can you tell us a bit more about why these protection measures are necessary? Why in what ways are migrant workers exceptionally vulnerable to exploitation, forced labor, or even trafficking? Look, I think it starts from the very first process itself. I think there's so much of hype in countries of origin. There are schemes like a flying out pay later kind of schemes where people can take loans from from loan sharks, from from agencies, from even from government kind of banks like in Bangladesh, where you can take these loans and then you can begin your process of going overseas kind of thing. Very often workers don't know what they are getting into, so that we've done a lot of work on contract substitution. We've been in the drama on this for years about workers not knowing what is on their contract, a recruiter telling them what is in it, not having the contract in their own language, going abroad, finding that it is not what they had expected, either in wage conditions of work or accommodation. There's always some variance from what was explained to them in the contract or told to them and they are not being seen that I've been seeing the contract and they're having no choice but to take it or come back home and they've already invested too much in that journey to even think of coming back home. So it just begins, so as you and you take as you when you go along that step, then you come into the conditions of work, accommodations, the hours of work and things like that. There's so much that is not known and even have known in the sense of told by the recruiter or by the agent or even in a pre-departure orientation about life in a country, in a destination country, the variance between what you've been told and what you expect and what you actually experience in the country of destination, there's a very, very big variance and this is the biggest challenge because at the end of the day in countries of destination, the support systems that you would necessarily have like let's say trade unions or associations of migrant workers, these in many countries are disallowed or there is no space for that. So in a certain sense, a worker goes out and goes out there on his or her own and then has to go into this whole element of survival kind of thing. So I think this is the biggest challenge we find and it starts with withholding of documents, the threat of withholding of documents. There are already laws that says and companies have put in regulations that say you cannot withhold documents but we have been told that it's a practice that continues even till this very day and that withholding of documents is like hangs over a migrant's head. If you ask for those documents or in any way you request for those documents, employers threaten that you can get undocumented or we put you in an irregular status and to avoid that workers just continue to believing that okay it's safe and nothing is going to happen. So it's that, it's wage theft that happens, a lot of work people, we get this constantly and I will speak later in the second round about wage theft campaign that we have launched kind of thing because this is a very big thing. The number of cases that we get on a daily basis throughout the year on just workers not being paid and not being paid for a month, not being paid for two months, three months, six months to that scale kind of thing and I think it's important to look at those vulnerabilities and then there's the gender dimension of these vulnerabilities as well. You know it's how it's gendered, it's ethnicity, it's nationality, it's a whole cross-section of where you are coming from, what your background is that increases or puts you in situations of vulnerability in the workplace. Great thank you so much William for shedding a bit of light on so many factors that make migrant workers vulnerable from pre-departure through their migration to when they're actually employed at the workplace. If I can turn to you Mia, could you build on what William has been saying about the vulnerabilities of migrant workers but maybe focus a little bit from the experience of IOM on what is it about their mobility? What are some of the root causes or drivers behind this vulnerability? Okay thanks for the invitation Tara. So at IOM under our general labor migration work and our migrant protection work we partnered with various stakeholders and we looked at the entire migration journey so from their home when they're seeking employment during recruitment process on their travel to the destination country at the workplace and then back to the place of origin and each stage of migration process there are risks involved and due to the vulnerabilities just discussed by William we see that migrant workers are more likely to be exploited, their labor rights abused and their human rights violated and what we've identified is that often problems start from the very first step the unethical recruitment practice in the countries of origin so even before they start moving so I'll be echoing what William said but it's very important that there are three main risk areas first is excessive recruitment costs that leave many in debt bondage so recruitment cost is basically fees and costs incurred for workers to secure employment so this could include transportation, visa, medical checkups, orientation, training, accommodation so most of them are legitimate costs but the issues are that first they tend to be excessive and inflated but most importantly second that they're charged to the workers and we've seen cases where the recruitment cost workers had to pay was double the amount of their annual income so many end up being in debt bondage which lead them to be financially incredibly vulnerable. Second is deceptive recruitment practice such as multiple you know triple contracts with different terms and conditions and often in languages that they don't understand and I've seen contracts signed by the same person with two different salary amount and very different and many of migrants do not even get paid the amount they're told some don't get any income at all so these practices lead to workers being really informed, uninformed, confused, exploited with no place to turn to for help or clarification. Third is restriction in movement and this happens during recruitment phase so I'm not talking about restrictions in movement at the destination country which is also serious but this happens at the recruitment phase that their passports and personal documents bank documents are taken at the recruitment so they can't drop out of the recruitment process and look for other options and this ultimately leads to a situation where they're not able to walk away from explorative working or living conditions at the destination country. You know I would say all of us here and those listening and would never pay to secure our own employment we would never sign multiple documents we would never give our passports or bank accounts to our companies and if we're demanded we would think that that's absurd and we would simply not accept it but unfortunately for millions of migrants these are wisely used practices and so often they have no choice but to accept them and some believe that they cannot even question them. In addition as as William said host governments and companies often are not aware of these practices and also because they don't see migrant workers as their priorities for protection there are lack of regulation and even if there are laws and policies they're not very implemented and enforced well and you know this is just at the recruitment phase but maybe most significant because once you start under an explorative condition it's very likely that you will end up working in an explorative situation at the destination country. So just to sum it up the inherent vulnerabilities of being migrants and then the discrimination inequalities and weaknesses in labor migration system makes them exceptionally vulnerable. Thank you Mia. You and William have painted quite a dire picture. There are a lot of vulnerabilities associated with highly complex processes. What can business do to mitigate these risks? So the only way I think for businesses to mitigate these risks is to recognize and understand that it is in their interest to own these issues and take the lead. You know they can approach this from the risk management perspective you know the the reputation of risk the direct financial risk associated with them or maybe from the corporate responsibility perspective that it's a right thing to do it's a moral thing to do. But practically as employers companies want healthy qualified workers those who are hired roughly in a fair and transparent manner those who have clear understanding of your business your expectation the terms and conditions of their work and those who generally want to work for your companies. So to ensure they can recruit such productive workers and also manage their risk a number of things can be done. First companies need to better understand their migrant workers vulnerability and their own industry specific risk. They need to take actions to make their own recruitment practice and their supply chain more transparent so they can see what's happening. I'm not just talking about first year supply chain but the entire second and third year labor supply chain. And they also need to be familiar with regulatory frameworks international standards and good practices and this will help them develop their own specific policies and guidelines. And once they have good data and framework it's very important that they make sure that this is well communicated and that they're actually applied in the management system and ensure due diligence and provide close oversight to the employment practice. Of course setting up grievance and remediation mechanism that actually can be accessed by the migrant workers will be needed. But of course this is a lot you know easier said than done which is why under the Crest Initiative which stands for Corporate Responsibility for Eliminating Slavery and Trafficking Initiative I want to support companies to conduct supply chain mapping develop guidelines. We also have tool kits available for bands employers recruiters to carry out due diligence to conduct ethical recruitment. We also provide training on the subject as well as direct assistance to workers and pre-departure post-orignal orientation and training. And I think all these efforts are even more important during COVID and post-COVID area. The restriction in mobility, high unemployment rates, poor economic situation, naked migrant workers seeking employment even more vulnerable and desperate. You know they may resort more to using unqualified unlicensed agencies use irregular channels to channels run by smugglers or also online virtual fast-track procedure may be encouraged by companies and they need to quickly hire workers and labor expectations and audits may be reduced and all these will further increase risk and we're already seeing an increase in trafficking cross borders in several reasons. So we really believe that it's important than ever that companies take actions to end the current business model that exploits migrant workers. No migrant workers should not pay to secure their employment. Recruitment related cost and fees should be borne by employers and if employers own these costs recruitment agencies will have to ensure that they provide cost efficient cost effective competitive quality service to their clients which are the companies and the workers and ethical recruitment is in the interests of employers and companies it will help with their productivity sustainability and credibility. And the good news is that brands are starting to recognize this and actually are taking actions but of course this cannot be done by business alone and governments civil societies you know unions recruiters and workers and international agencies like IOM we all have a role and it would work better if we work more in partnership and collaboration to make the real meaningful change. Sorry that was a bit long. No but so important and it was helpful that you articulated so many of the principles that are behind ethical and responsible recruitment and I'm delighted that we have one of the brands that you referenced that has made a commitment to ethical and responsible recruitment on this call so if I can ask Shuba you know the Coca-Cola company has made this commitment could you tell us a bit around what were the benefits that Coca-Cola saw behind making a commitment to ethical recruitment and maybe just more about the journey that brought you to this space. Thank you Tara and greetings to everybody from New Delhi India. So you know as pointed out by the other speakers that the migrant foreign migrant workers are at the extreme end of the global inequality spectrum. Many of them are victims of modern day slavery this issue was there before the pandemic and it has become worse you know with the crisis so we started focusing as a company on this area in the Middle East and elsewhere in 2007. So we have an extremely robust you know auditing third-party auditing process and we started picking up issues and this was before you know the just legislation scheme like the California transparency the modern slavery so the kind of understanding you know early days was limited so what we first started doing is really you know getting to the nuts and holes understanding it by virtue of a study when we understood the dimensions of this problem we kind of updated our policies to expressly prohibit forced labor and human trafficking in our supply chain but of course that is policy but we went on you know to take several other steps to bring that policy into practice. One area of course has been pointed out which leads to debt bondage is the recruitment fees at times it takes workers two to three years to pay back those fees so this is one of the major causes as pointed out and so we enhanced our safeguards related to recruitment and ethical practices and these safeguards were built into our you know protocols and policies and you know our auditing you know process. We each here conducted about 2000 audits in you know all our workplaces worldwide you know we've done about 25,000 third party assessments to date but not stopping at that you know because we have a due diligence approach we collaborated and I think this was pointed out by Mia that you know it's extremely important to collaborate because this dimension is huge so we kind of collaborated with four other organizations to launch the leadership group for responsible recruitment for promoting ethical recruitment. This is with IHRB which is the Institute for Human Rights and Business, the ICCR, the Interfaith Center on Corporate Responsibility, the IOM and Verity and now as an active member of the consumer goods forum we also publicly committed to the three principles that is no passport retention of the workers, no recruitment fees to be paid by the workers and the third is no contract substitution. So we've kind of you know also hugely focused on capability building because it's not enough for us to understand it's extremely important to build the capability of the supply chain constituents. So through CJF, through other forums and also individually as a company we've kind of you know invested a huge amount on building capability in making you know the constituents understand dimensions of this issue and what is in it for all of us and like pointed out you know as a responsible company which has been there for several several decades you know it's our reputation is extremely important we believe in doing the right thing we take a rights-based approach and you know we have embedded this in our way of doing business so you know we kind of make sure all our partners also understand our values and our commitments. Thank you Shuba and it's wonderful to hear about about how you are trying to articulate your values and realize them through all of these important commitments and I'm going to come back to you in a little bit to hear some more examples of how you are trying to take this work forward but before I do so I'm going to turn to Mark. Mark could you tell us briefly about different solutions and how can you see the potential for technology to overcome challenges that companies may face in trying to implement ethical recruitment practices. Thank you Tara and thank you for hosting this panel and hello to everybody online. For those of you who are not familiar with Diginex Solutions we are a data infrastructure company so what that means is we collect we service and we share data typically amongst the complex ecosystem of stakeholders in a more direct and hopefully impactful way. We have a core focus on social governance indicators and combating forced labor and what we really believe in is transparency and greater immediacy driving meaningful change. I think from a technology perspective first off it's important to view technology as just a tool in terms of getting all the relevant stakeholders working together and providing the right incentives for participation which is typically either around efficiency or security so answering a question of how does this make my life easier or how does this make my life safer and ultimately whilst technology is just a tool what's most important is the practitioner and the practitioner being the hiring manager, the recruitment agency, the government official, the United Nations civil society, the brand or of course the Michael Mbaka and what we're looking to do and have been doing is connect all of these different stakeholder groups together through those three core actions so the collection and surfacing of data enabling the ability to audit and investigate that data and then finally giving a platform through which people can report and publish that information and data to relevant parties and ultimately what we're looking to solve for and I think well Jane can be condensed down to this singular statement is I need to know what I'm looking at is what you're looking at and given this framework we're extremely focused on three or four key things which is creating digital tools to help eliminate the exploitation of vulnerable people involved in the Michael Mbaka ecosystem reducing friction and inefficiencies in the current offline recruitment process and William I noted your points around fly now pay later and loan sharks and education around that and that's something we're very focused on particularly in Bangladesh right now providing a scalability to reaching the last mile issue so it's of course working in at the factory level is important but I think as we've all mentioned here being able to reach far upstream past the township into the past the recruitment agency into the broken level of countries of origin is important in connecting with hundreds of thousands of potentially remote potential remote workers and then ultimately bringing transparency into human labor migration which in turn encourages good behavior great so it sounds like technology specifically blockchain really has the capability of building trust creating or strengthening accessibility increasing efficiency and and like you said scalability so issue but if I can come back to you could you tell us a little bit about Coca-Cola's experience with adopting of new technologies to try to strengthen your efforts in the space of ethical recruitment Shatara while focusing on you know the three principles of ethical recruitment and you know doing our due diligence in our workplaces around the world we kind of came across two aspects one is that the issues arise not in the you know not of course there are some aspects which happen in the workplace in the receiving countries but there's a lot that happens from the villages that start from the sending countries the countries of origin second is that the auditing and due diligence doesn't reach the contracting level so that's several steps I mean as we've mentioned there's a whole you know network of recruitment agents which kind of make a worker you know from his village reach the workplace and therefore we were looking at you know how can we address this issue and we were exploring leveraging technological solutions to drive social impact and supply chain transparency and accountability so last year towards the middle of last year we piloted an initiative using blockchain in the Middle East with our bottling partner Digenex which is our technology you know provider and with guidance from IOM where you know specifically focusing on contract swapping so as I've explained by Mark there is you know there's a registry where you you know put in the documents and it's it provides an extremely secure framework you know which cannot be preferred with now this app with that it has was developed also has various built-in functionalities so you know we also saw whether it could capture information like passport retention what is the kind of fees that the worker has paid where they've come from so there's a whole lot of flexibility that you know a responsible business can work with to ensure that you know they're capturing this information now we you know in this in the bottler facility where we piloted it we went and you know along with Digenex actually got the feedback which was good they found it easy to use because it was in their phones they had the documents that they needed the human resources teams which also are the interface you know for when the worker gets onboarded they found it you know seamless and easy to use in fact you know they were very happy and they actually wanted to kind of upload a lot more contracts than we initially planned you know when we started the pilot how we're going to demonstrate the full potential you know to really enhance the transparency we also needed to onboard the recruitment agencies and the workers in the country of origin which was what we had planned for phase two of our pilot which unfortunately because of COVID had to be delayed but we do intend to you know restarted once the situation allows us to do so that you know will help us get an end-to-end kind of model which we present for scaling up you know we can also put that to other interested partners now thank you so much for sharing more about that I am I really appreciate how it sounds like a highly consultative and participatory process went into into tailoring this tool so that it was right for the workplaces for the workers and for the labor actors by extension so looking forward to hearing more about this from you after phase two but maybe just to go back to Mark at Diginex would you like to add from I know that Diginex has been doing work in this space you know cross sectors across countries would you like to add more from your experience and actually implementing this technology with workers with recruitment actors with employers yeah very much very happy to so I mean first of all thanks to Tuba and Coca Cola for being such wonderful partners on this project and I think we developed fantastic learnings from it and look forward to continuing to engage through E-Min and we started this journey around two and a half years ago I'm looking to create human-centric tools to help prevent or at least combat initially it was around contract substitution as William mentioned to begin with and that document handling component of our work remains very critical and has also now expanded to include other documents such as visas medical certification and evidentiary documentation around fees and salaries we've also begun allowing employers to send documentation for example health and safety policies you need to demonstrate to external parties that people only have received but have acknowledged and read as well as tracking things like training hours something that came up repeatedly is my work is we're not always aware when they were going through a formal training session because it could be baked into things like onboarding session or reaching meetings to be able to track those hours and then again report that either internally for sustainability purposes or externally to the local ministry of labor or whatever it may be so on our additionally on our original project which was working with by Burmese migrant workers on Tyshrimp arms we were looking at five mostly demographic data collection questions and that was that was our theory to begin with you couldn't ask any more than five questions because otherwise people would get bored and not want to participate any further this has now expanded up to 35 different questions covering both demographic and social governance indicators that can be used to identify and combat potential cases of forced labor as well as for both internal and external reporting and we're able to complete this document document verification work and collect responses to these 35 questions in around six minutes primarily through through mobile although we have found that both region and demographics can have a significant impact on on user preferences as we experience with with Schuber and Coca-Cola in the Middle East having collected having provided responses to those questions we're now also enabling ongoing engagement of workers both pre-departure and also post arrival on our ongoing basis so if a worker has responded a specific way to a specific question well of course they have the the ability to remain anonymous if they wish but then if they don't the employer has the ability or the brand has the ability to follow up and request further information or evidentiary documentation or just declare trial responses so this data collection part in addition to the document handling is proving very combating and very powerful in combating potential cases of forced labor or certainly increasing education just awareness of of where operational efficiencies might benefit from a greater level of transparency if we also look at the projects that we have with Utah and IOM and Mia I'm going to raise your Crest acronym and give you IRSAFA which is international recruitment system self-assessment for ethical recruitment we spent whole afternoon coming up with that looking to promote ethical standards amongst recruitment agencies globally in line with the IRS principles of course as Schubert has mentioned is not only the work that we do with corporates but also being able to engage with recruitment agents who have demonstrated their adherence to principles like these and the platform in and of itself is looking to do three things which is allow or enable ongoing engagement with recruitment agents post training and write up to certification so we're able to understand those areas where they need to they need to focus on able to identify ability to identify areas where IOM can lean in for capacity building either on an agency level or on a principal level and then thirdly provide data around recruitment agencies that IOM can use for policy advocacy once ultimately again it's around collecting that information surfacing that information sharing it and publishing it in an appropriate way but also gain transparency in time efficiency and the way that the process is happening. Thank you Mark. I get really excited when I think about the potential for tech I also get a little bit nervous because I think there are some scary bits in terms of you know concerns about data protection and accessibility but but it sounds like that the processes that go into developing these tools are highly considerate of that now I'm happy to say that that we we have time to sort of open up our discussion a little bit more and it looks like oh we do have a question so one question is specifically for Shuba and Mark and the question is how has the collaboration been received and supported by the suppliers and the recruiters in the supply chain so have you are there any lessons learned that could be shared and it would be really helpful to all of us. Yeah so thank you for your question and for the interest in in the work that we are doing as I explained that this you know this what we did was the phase one of the pilot which was basically in our bottling plant in the Middle East we had we were planning to do phase two which is which you know involved getting the you know recruitment agency on board and the workers in the country of origin we couldn't do that as yet we had to pause because of the you know the the pandemic so we haven't yet at this stage taken this pilot to our you know the suppliers and others we wanted to first get just out an end to end model and then you know understand what's going well what can be better and then once we have that model then we wanted to take it to scale which at that point mean that we take it to our other bottlers and to our suppliers so I mean please watch watch the space hopefully we will be able to share some good learnings you know as and when we start this work. We will Mark do you have anything to add from other experiences with adoption from supplier and recruitment partners using new tech solutions. So yes I think certainly when we've learned the hard way that when we introduce these types of projects we we we play down the new tech solution part and it's our learnings our first project I think we've done quite well in identifying how this might be useful for my work and I think we had done quite well in identifying how this might be useful to the head of sustainability in a large corporate brand. I think we have learned over time that key demographic of the operations manager the HR manager the factory manager how this may be useful for them and it's typically around efficiency gains on what might or might not be a paper-based process and how this might mean that they can go home an hour earlier rather than an hour later so we go back to the original pointers looking to solve generally for two things how does this make my life easier or how does this make my life safer and hopefully both and and I think positioning it that way has generally been fairly well received in the projects that we've worked on. Great thank you.  Well yes just to say that it was about just about 12 days ago we launched an urgent appeal this was launched together with migrant forum in Asia Lawyers Beyond Borders South Asian Trade Union Council Solidarity Center and the Cross Regional Center for Migrants and Reputies. Five organizations came together to launch this because as migrant forum Asia because of the COVID we were receiving a lot of information about workers being laid off and being repatriated and this was and swings between right to return where workers wanting to come back home to deportations of undocumented migrant workers and repatriations of the workers who had lost their jobs and also we were looking at this big flow of workers coming back but in the process many of them complaining of not getting their wages not getting the end-of-service benefits not getting their dues that were due to them and then we started looking at numbers in terms of the repatriation that are happening for example the government of India and the UAE when it started a registration process for all those who wanted to be repatriated 200,000 people signed up on the first day itself kind of thing system practically crashed of course this means not all of them are workers some of them are family members some of them are tourists who were stranded and things like that but still it's a large number of workers within that group we are easily looking at something like a million plus migrant workers from Malaysia to the Gulf who will be repatriated in the next few months that process has begun you know and a large number of these workers are complaining about not getting their wages and not only businesses have taken advantage in some cases of the COVID where they have not been paying workers for months before the COVID and now because of the COVID and the loss of business and things like that are making this as an excuse of sending back workers home kind of thing and the thing is governments will give them a helpline banks will give them helpline and they will start from scratch again we wanted to raise this issue because we believe that the the enormity of the scale of the wage theft in the time of COVID is so high and that's why the urgent appeal calls for an international justice mechanism largely because the existing justice mechanisms the remedy mechanisms that were there in countries of origin in normal times could not cope with the workload and that with the cases that they were getting you know and that was and they were hugely inefficient countries have tried like for example Qatar tried an expedited board procedure UAE tried a mobile kind of clinic in Abu Dhabi kind of mobile code kind of thing in Abu Dhabi this was all before the COVID but a large number of them were not able to address this the volume of cases they get in the normal time and now with with COVID and the repatriations this has grown exponentially and that's why the call has been to look into this to look into the wage theft just because I know the world bank said 20% drop in remittances and and that's big that's more than you know 400 450 million kind of thing but when you look at it it's not only the it's not only the drop in remittances it's this what is owed to workers the potential remittances that could have been a helpline in this time have now been cut off kind of and this is this this is the seriousness of the gravity of the crime kind of thing and that's why we've called and it has gained traction now there are a huge number of international organizations that have endorsed the call international trade union congress has endorsed the call business and human rights center has endorsed call Ecuador the global unions federations PWI and public services international human rights watch a number of you had dialogue and thankfully with IOM as well with ILO with the world bank to see how they could come in we are talking to countries of origin to see how they will take this up and that's and that's the and that's the sad part about it is is that in in this of it has affected everyone yes but to look at the disproportionate vulnerability of migrant workers in this who have always been victims of wage theft how that has grown exponentially I will grow exponentially because of these repatriations in huge numbers the irony of it all is countries of origin who are asking migrant workers to register for repatriation flights are not collecting data on whether you have lost your job whether you have paid your wages whether you have been given your dues they are not even asking that on the forms these forms are online you can check it out on their website embassy website they are online they're not even asking that countries of destination are not doing the due diligence to say okay we are going back do you have any grievances do you have any claims do you have unpaid wages to collect so none of this is being done you know and it's a whole almost like a scam of just sending workers back and that also workers having to pay for their flights kind of thing who have not been paid wages are now being asked to pay for their flights in they are also being asked to pay for the testing in some cases the country like Nepal is asking for its workers to pay for the testing before they come back to Nepal how are workers going to pay for the testing when they haven't paid for their wages you can pay their wages so the situation at this point in terms of vulnerability and desperation is high among workers who are and of course within this situation and this is where forced labor of things will come in is that many workers will also stay back even if they have lost their jobs and not been paid just because because what is the option coming back home you know so they will stay back because some countries have extended the visa limits kind of thing the expiry limits and also some have said they're going to stay back and see if they can get another job or they can get alternative employment or employer and things like that so it's there's a lot of issues within this kind of urgent to feel that we have raised and we are asking for both countries of destination and countries of origin not to let this pass by because this this is not the legacy we want of the covid and how the issues of migrant workers were addressed in a pandemic that in this time you had the highest exponential increase in terms of wage theft in in terms of just the amount of money that is that that will not be paid but just that is due to work thanks now thank you William for raising this really important issue there's a clarifying question for you of the expected returns in the coming months is there a sense already if these are mostly returns of migrant workers whose contracts were completed and not renewed or are they terminations of ongoing employment contracts is there any available data or a sense of this look the data process has only we've only just begun collecting we are only as i'm a collecting cases of workers who have lost their jobs and that already is a high number you know so there are i'm sure countries of origin must be collecting other kind of data with regard to other situations of migrant workers but this already is high the number of people who have lost their jobs and it's not only that it's like for example malaysia recently announced that no more hiring of foreign workers in the wholesale sector so in the fish market and things like that but these were workers who already had jobs and you make an announcement that no more hiring within so all the workers who were in that sector suddenly lost their jobs and these were documented workers you know so it's like workers it's this whole challenge that migrant workers today have and we will see we've only begun to see the i think this whole repatriation process is going to continue for months into up to the end of the year we've only begun to see the first trickles and so far it's already close to a hundred thousand that have come across come back but these numbers are definitely going to going to increase as the repatriation flights become more frequent and as regular flying as as airlines open regular corridors no i think you're absolutely right there's another clarifying question from you william the question is is migrant forum in asia getting reports of reverse remittant flows from communities of origin back to family overseas due to them being stranded or stuck without employment we are we are a lot of our workers a lot of our workers are based in the countries of origin a lot of our members have said about our workers asking for their families money for existence lively and you know just just food and that kind of support asking for testing asking for for the flight to come back home and things like that as mfa only yesterday we made a commitment because workers cannot cannot pay for the testing even before they have before they board the flight and it is compulsory that they should be tested before they vote for the flight so we try to see if we could raise the resources for workers who are in that desperate situation who want to come back home because there's no no no chance of them continuing in the country of destination but who wants the resources just to do that flyer just to do that test to the covid test kind of thing so there is there is a call from workers and we are now trying to raise the resources for that reverse remittances to send to workers who are in that desperate situation a lot of our members during the covid we're already involved in this kind of campaigning kind of thing so it's it's it's it's very much the case it's very much okay thank you um uh i'm noticing the time and so i think i'd like to bring this sort of to the the last section of our discussion today which is where i i would like to ask each of our speakers to sort of what's one key takeaway you would like for for viewers of this session to take away or what's one recommendation to business for how they can strengthen their efforts to be responsible moving forward and and and will you might actually start with you in case there's in case you haven't asked for business related to your current campaign or or anything else i think maya wow one is with regard to the current campaign i think it would be good to see how the business sector endorses the campaign sees this as a legitimate urgent appeal to endorse it would be great like how we are said to look at the supply chains and show many of these companies that are now firing workers would somewhere fall within second tire third tire supply chains it would be important to look at that it would be important to look at subsidiary companies that come up and hire migrant workers that survive around primary companies kind of thing you know like small small and medium businesses that that's set up next to a factory because that factory is there and because they target the the migrant worker population within that factory so i think our business is to come out and see that that that environment for protection of migrant workers for safe working conditions of migrant workers i think this is going to be important the last thing i would like to say is our businesses and this singapore has brought out very clearly in the time of covid it's not only about working conditions singapore was smooth sailing that it had addressed it's a covid cases kind of thing till suddenly they discovered clusters in the accommodations of migrant workers and then they recognize that it's impossible to to do social distancing and the measures that needed for protection against against the virus kind of thing for migrant workers just because they are accommodations would not allow that so it's more than just working spaces it's about even living conditions for migrant workers and businesses even the supply chains have to take accountability for that thank you thank you william for making these really important recommendations and concrete things that business can do i'm going to disrupt the order and go over to mark what would you like your final words to be can't hear you mark thank you dar i think i'm particularly excited about the work that shipper has mentioned earlier on on the end and um transparently of a migrant workers journey the work we've done so far has been either in country of origin or in country of destination without linkage between the two and i think this year once we can all get on things again we look forward to joining up those two and providing that transparency and looking at tools like online training for skills and certificate issuance and checklist for items required as working overseas prior to departure along with things like peer to peer verification of documents among trusted social circle members and creating nonsensitive public records of a person's work history that can be used later in the other opportunities and the work they were doing around those types of features and functions in country of origin and then connecting it through all the way to a factory in the middle east or somewhere in southeast asia where we're doing that fairly rapid social governance data collection around those indicators that i mentioned earlier and the contract verification and fees evidentiary documentation salary receipts and so on and so forth um so working with partners like like shipper and co gulla to join those two ends up and get transparency all the way from from a broker and a township and and more educational initiatives all the way through to the government data governance collection process in um in a factory and of course work agreements is linked to that entire journey excellent i'm glad you got that i'm in a very important point in uh shuba shuba do you have any final remarks uh so uh basically i would like to stress on the importance of use of technology as you know for businesses for due diligence process because i think due diligence is extremely important and one has to constantly keep doing it uh i think the cobit and you know what the world presents uh going forward shows that you know we need to have basket of tools uh one of which is you know using of technology but technology alone can't be a solution right i mean that's only a means uh to be to the end and so uh i would like to i i think once again reiterate what came out earlier the need for you know partnerships for collaborative action to really make it something which is scalable and sustainable and if you look at the ethical recruitment agencies we need to make their business viable right if there is just one or two who are looking at ethical recruitment it's not going to be viable and it's it's going to so it's important for like-minded businesses to come together to build density so that you know the whole recruitment process is also viable for them so we need to look at this whole thing holistically uh really to be able to move the needle thank you shuba i couldn't agree more uh mia final words on behalf of iom so as i was preparing for this uh this session i remember i heard a quote i think it was from a play i didn't read the play but i think it's about workers and migration that said we asked for workers and we got people instead and i thought that really summed up a minor worker situation quite well you know maybe because we see migrant workers only as um imported labor and not as human beings that we unconsciously or consciously we let their very fundamental rights and freedom be ignored and neglected and that we somehow accepted that it's okay so you know how we define an issue and the value we place on it determines how we address it so maybe we should start with recognizing what we're really talking about here this pandemic has seems to have humanized economy that you know behind the food we take uh the products we consume you know the service we use there are people and it's the people who run this economy and run this society so i would say if there is one takeaway so at least let's commit to making sure that no one pays for their income and at least you know we could commit to ethical and responsive recruitment for a start but since i'm the last person if i may make one more right because it kind of reminded me when william was talking about this is the situations that migrant workers were in because migrant workers experience is very complex it requires it it involves multiple states you know multiple stakeholders and people that no one uh take responsibility and say you know it's the company or it's the post country or it's the sending country but we all have a role and we must play our role and we must do it in collaboration and partnership to make the real job i wanted to add that thank you i can't think of better words to go out on so thank you so much everyone for your incredible contributions to this really important discussion and thank you for your ongoing efforts to promote the rights of migrant workers um so yes thank you again everyone thanks to thank you for going today thank you so much and stay safe take care thank you all