So, next we have security champions if you haven't heard of it. You will soon. Anne-Marie Fred is going to be talking about that, so you'll get to see why it's important. All right, thank you. Is my mic on? Yeah, there we go. All right, thanks everybody for coming to this talk today. My name is Anne-Marie Fred. I'm a senior principal software engineer at Red Hat. And the talk is about security champions, what they are, why you need them, and how to get a program started. Little bit about myself first. So I was a full-time software developer for more than 20 years, of which the last 10 years or so was in a DevOps environment. I was a DevOps days conference co-organizer in Raleigh, North Carolina, for three years. I'm currently also active in the Linux Foundation and CD Foundation and a couple of their open source projects. I was an HR manager for three years and then went back to being an individual contributor. For the last four years, I've been acting as a security focal for my organizations. Most of my career was at IBM and then last year I moved to Red Hat. Quick disclaimer, my experience is not the official position of either of those companies. So according to former FBI director Robert Mueller, there's only two types of companies. Those that have been hacked and those that will be. In fact, in 2020, Sonatype did this DevSecOps community survey and they found that in just the previous 12 months, 24% of the respondents said that their company either had been hacked or they suspected that they had been successfully breached, in fact. Most of those breaches target the data that your company has. And data breaches can be amazingly expensive. GDPR and other privacy regulations hold companies liable for those breaches. And it's not just the fines that you get from the regulators that are expensive, but also the cost of repairing the damage that was done. And ignorance of a vulnerability or of a breach in progress is not a defense from your liability. This can cause major damage to a company's reputation. If you think about high profile breaches at places like Facebook, Equifax, LinkedIn, Anthem, how many of you were affected by at least one of those breaches? Yeah. How many were affected by most of them? So according to IBM's 2021 cost of a data breach report, the average cost of repairing one of these is $4.24 million. In 2021, there were over 18,000 CVE disclosures. How many is that per day? I don't know. How many do the math? And also last year, there were at least 66 zero-day vulnerabilities reported. So a couple times per week we're having to deal with this now. So what does this all mean if you're using open source software? Well, of course, open source accelerates your development. And most people are using it. But it does bring with it a host of publicly disclosed known vulnerabilities. The good news is that security researchers are out there using automated scanning and detection tools to scan open source projects and find vulnerabilities and then report them to the owners. So it's happening faster and in a greater volume than ever before. The bad news is that bad actors have access to the exact same tools. And they may not tell you about the vulnerabilities that they find. In fact, in the white source, state of open source vulnerabilities report from last year, there were 50% more vulnerabilities in 2020 versus 2019. And we see this trend continuing. Here's some more bad news. According to Derek Weeks, the time between a vulnerability being announced and the exploits appearing in the wild used to be 45 days. That is compressed by 93% over the last decade to three days. There's just no time.  What does that mean? So usually as a cloud native organization, that means that you're going to very quickly get your new APIs, websites, whatever, out onto the internet and accessible. That means you need to secure it from day one. So when I was looking at our WAF traffic last year and IBM's website, we would see people running scanning tools like security testing tools like Burp Suite against our website. People who are not us every single week. And a big part of knowing how to secure your APIs and your websites is understanding how to scan your software using static testing, dynamic testing, and then how to interpret the results and actually fix the problems. For example, cross-site scripting vulnerabilities are very easy to detect. You can scan your site or your APIs and see them. They're also very easy to fix, but only if you know what to do about it. And CI CD is another aspect of cloud native, of course. Now the good news is that we don't have so much of a bottleneck at the release process. It gets quite possible for us to fix software and deploy the fix within a day or a couple hours even. But now we've just moved the bottleneck to the development team. So it's a race. The only way to beat the bad actors here is that we need continuous security. Here's more bad news, though. So according to Toby Irvine's research and my own personal experience in talking around, this also holds, for every 100 developers, there's only one professional cybersecurity person here, like somebody working in it full-time. That means that cybersecurity professionals are a scarce resource. And that means that security often gets neglected in our transformations. Security is still very often treated as a last-minute gate. So a month or two before people try to release new software into production, they'll do a quick threat modeling exercise, they'll run some manual penetration testing, they'll fix vulnerabilities for a couple of weeks, but maybe they won't have time to fix all of them. And then since there's already a committed date to ship it, they ship it, right? The fact of the matter is a tiny cybersecurity team just can't find and fix vulnerabilities within three days without a lot of help. So if we want to move faster while being more secure, we have to up our game. And how do we do that? We have to make our technical teams more self-sufficient with respect to their own cybersecurity. We need many more application security subject matter experts. We need to scale up from about 1% to about 10% of our technical population. And we need more people who are qualified to dig into the details of security reports and security tool findings. Now, it's always hard to have any sort of change, so I'm going to talk about some things that motivated my teams recently. At IBM Digital in 2019, we did internal dev ops surveys across our teams, and we identified security work as one of the top three pain points for our developers in an area where they were asking for help. At Red Hat, we just went through restructuring our product security programs in response to the May 2021 executive order on improving the nation's cybersecurity. Red Hat's an important part of the supply chain for a lot of companies, so we need to make sure that our security practices are really, like, industry leading in state-of-the-art. And for a lot of companies, a big motivator was the Log4J, Log4Shell vulnerability at the end of 2021, and the pain of dealing with that. Now, Log4J is a typical example of a software package in open source. It's very common. It's used in most Java code, and it's a widely trusted software library. People had no reason to believe it would be a problem. It's used by hundreds of millions of devices. In 60% of the Java projects, it's used indirectly, so if you look at the dependencies of your own software, you won't see Log4J listed. But if you look at the dependencies of your dependencies, that's where you find it. It makes it a little bit harder to find. You need tools or software analysis to help you find it. And this vulnerability allows arbitrary code execution, which is the holy grail of exploits, and it can be exploited over the Internet without authentication. In fact, within days of this vulnerability being published, thousands of companies had been attacked. Within a week, it was tens of thousands. So with all this, why do we need security champions in particular? Like I said before, only one cybersecurity professional to every 100 developers is not enough. They're spread too thin. And furthermore, developers, the people closest to the code, are the ones who are best equipped to keep their own code secure, but they need some basic application security training to do that. Security champions is also an excellent way to promote a DevSecOps culture where developers have control and responsibility for their own application security. So what do I mean when I say security champions? Well, to me, it's when you have one management-designated person per small team or squad. And this should be at least one-tenth of your development population. In that, I'm including developers, architects, testers, SREs, et cetera. And they should have about 10 or 15 hours of application security training, which is enough to be a local subject matter expert for their own team. A couple of terms I use, and everybody uses different terms, this is how I define them. Security focal, somebody more like myself. So it's maybe a 50 up to 100% time commitment, advising across five to 15, maybe a couple dozen teams or squads, and security focals are going to work closely with the other security focals as well as the cybersecurity organization for your company, and they're working across a division or business unit. And they're the primary point of contact with corporate cybersecurity experts, and they're responsible to ensure that the security champions are reacting quickly and reporting back status on urgent and important security work. Security champions, on the other hand, is more like a 25% time commitment. So in some weeks, like when threat modeling is happening or doing penetration testing or maybe audits, it can be a full-time job. But in other weeks, it might only be an hour or two. And they only need to advise their own small team or squad. They're going to work closely with the other cybersecurity champions in their own organization and with their own security focal, and they're responsible for monitoring communications from their security focal, getting the work done within their own team and then reporting back. So there's a playbook for how you can get this set up. We've done it at a few companies now. If you want to start your own security champions program, first you're going to need a small working group. Just a few people's enough, three, five people, you usually just go out and ask for volunteers. Who wants to help us start this up? You need to create and publish a program description explaining what you're doing and why and what the expectations are. And then you're going to take that program description and shop it around to your management team, an executive team, to get their buy-in. Because you're asking them to commit resources in terms of time and money. Then you're going to choose a training program, which, depending on what you have available, might require some time to go actually watch some training modules and see what you like. You're going to choose a training program, you're going to pay for it and set a due date for when you want your champions to have that done. Then you're also going to ask your managers to appoint the designated security champion from each of the small teams or squads, and you want to keep a list of that. Your working group will set up the communications channels that you need and then kick it off. So I mentioned that you need a program description. Actually in the backup slides I have more details about what I put in it, but some highlights that I wanted to call out. Of course you're going to want to have introductory information, what you're doing and why. It's important to lay out the expectations for the security champions and their teams in terms of time commitment, the training that you're expecting them to complete, the communications that you want to have in place, and everybody's responsibilities. Do this in advance so the managers know what they're signing people up for. I like to call out that these are highly valued subject matter experts. This is really good on a resume, so go ahead and call that out. It's also not necessarily the technical lead or the most senior person on the team. Honestly, technical leads get stuck in a lot of meetings. They might not want this role, but if you can find somebody else like a more junior developer who's really excited to learn more about security, that can be a great person as well. And you have to call out, these are not the only team members who are going to be responsible for security work. A lot of the work of security can be tedious and time consuming and you need to make sure that that's going to be shared across the entire team. Here's some things to think about when choosing your training plan. Like I said before, we're going for maybe 10 or 15 hours. And I like to give people, if I'm doing a 10-hour training program, I'll give them 10 weeks to complete it. So if they want to do an hour a week, that's fine. Or if they want to cram it all into a couple of Fridays, also fine. Cybersecurity basics is something that hopefully everybody in the company is getting, and that's an hour or two on things like how to recognize phishing attempts, how to secure your passwords, how and when to report a security incident. Then security and privacy for developers is going to be three or four hours that hopefully all technical people in the company are taking. This is things like how to validate your input and why. How to escape your output correctly. How to handle personal and private and confidential data. Your companies own cybersecurity standards and processes and people and who to reach out to with questions and how they should report software risk or vulnerability if they find one. Then what we're adding on top of that is maybe three to five hours about security and privacy by design practices. Things like applications that are secure by default and how to properly configure your applications. Security in your CI CD pipelines. And how to run code reviews with a security mindset. Importantly, we also want to make sure that we're covering the OWASP top 10 or SAN's top 25. The most common vulnerabilities in software. And yeah, four to five hours, this is probably good. This is teaching the developers how to recognize and find and fix those vulnerabilities. I also like to include an hour or two of the basics of threat modeling. Like why it's done, what you're hoping to do, how you should prepare for it, what kind of architecture diagrams you need in advance, what kind of documents you're going to produce. This is not enough for them to be like great leaders of threat modeling exercises, but it's enough for them to be a lot of help to a security architect who comes in and runs those threat modeling exercises with them. And it should be enough actually for them to keep the threat models up to date over time as the application changes. And I have some examples of training plans that I like in the backup slides, so I'll put them up at the end of the talk. As a nice side effect, according to Sonotype, in their 2020 DevSecOps Community Survey, developers who receive training on how to code securely are five times more likely to enjoy their work. Awesome. It's also important to have an interlock meeting, and we do this in the context of a secure engineering guild. So I say that attendance is expected for the security focals and security champions. If they can't make it live, then I want them to watch the recording. We do want to make sure that we have a recording or at least a really good agenda with detailed minutes and notes. Some topics that we've covered in the recent past are things like checking on status of time-sensitive work. Any new corporate initiatives or security alerts that we want people to be aware of that week. Security tools and tool adoption details. So a lot of these security tools that you get integrated into your pipelines, you may find that there's tips and tricks that only apply to your own organization, right? Like where do I get the value for this variable? Or how do I sign up for this software in my org? So we're sharing that information with each other. We also do pair programming. Just somebody who's figured it out will sit with somebody else who is trying to do it at the time. We talk about penetration testing and remediation when that's going on. It's also fun to include security in the news. A couple of recent articles. And as time permits, five or ten minutes of education on a topic that's relevant that week. So for example, at Red Hat, a lot of people are going through security assessments right now. So one of our upcoming topics is just going to be a walkthrough of an assessment where people can ask their own questions about it. A little more about other communications channels that are helpful. My favorite is actually instant messaging like Slack. It's great for real-time conversations. And if I have a private channel with just the security champions in it, I don't have to worry about doing the at channel if I need to just ping everybody really quickly. We also have like email lists for security champions and focals and their managers. And so for bug tracking, you need a system set up to handle security bugs. They might require embargoes and they definitely require auditability. And then just your normal work tracking system for your squads just to make sure that the time sensitive work gets done. Like, okay, let's make sure we all get our security assessments done on time. There are a lot without challenges. One that I've run into a lot is dealing with global teams. So how many people in here have globally distributed development teams across multiple time zones? Yeah, like more than half. As you know, finding a time for any kind of group meeting is difficult. And everyone tries to schedule their recurring meetings during the exact same time slot. It's a four to five year time first thing in the morning in North America, right? So my recommendation is to either choose a meeting time that works for your most engaged people who are actually showing up, or have two meeting times about 12 hours apart. Either one can work. I also recommend encouraging and supporting asynchronous communication. So you've got instant messaging, you've got your shared documents, et cetera. Another one that I ran into at Red Hat recently was the training program funding. So we chose one that cost about $250 per user, which is pretty good. And by the time we got the budget approval, we only had three months left on the contract before it ran out, so they weren't taking the users. And we had to wait for the security team to negotiate a contract for the next year. So my recommendation is to go ahead and choose the online training program and request the funding early, because that could become like the long pull. It could take a while. Also, if you already have a good training program available to you, just start with that. So at IBM, I was lucky. We had a really good internal learning system. And all we had to do was find the security modules that we liked and evaluate them. You know, we shared, each person watched a couple of hours and strung them together into a training plan, and we didn't have to pay for anything. Another thing I ran into, how many people here have compliance fatigue?  Yeah. Our developers at IBM were already spending up to about 25% of their time on things like data subject requests, privacy and security reviews, internal audits, patching software every week. And to them, this felt like just more compliance work piling on top. And too much tedious work like this leads to a type of burnout. People really get sick of it. Frankly, it's not actually more work overall, but it is kind of concentrating more of it in one person in the team. And one of the goals we chose to address this for the secure engineering guild was to automate as much of the toil as possible.  And again, programming with each other to put these things into practice. And we also partnered with our CSO organization to pilot new tools that they were considering buying. That way we made sure that the tools that were available to us were the ones that were going to work well for us. So what do we get for all this work? So 12 months after starting the program at IBM Digital, we did in fact have 1% of our developers who were subject matter experts. So they completed their training programs, and they stuck with it as security champions. We were able to handle critical alerts, which we called CSO overrides, often within one to three days. And by handled, I mean, that's from the time that the vulnerability was reported. The cybersecurity org handed out to the focals. The focals handed out to the champions. The champions evaluated their software. They saw if they had the vulnerability. They reported back to cybersecurity if needed. They fixed the problem if there was a patch available. And they put it in production. Within one to three days. Importantly to me as a focal, I knew that no teams were falling through the cracks. So we were responsible for about 130 applications in my group. And I knew that by talking to my dozen or so security champions, those were all going to get covered. I just needed to hear back from those dozen people. We also saw far fewer of our security reports, whether they were from pen testing or security tools or from Hacker One that were marked as false alert or could not reproduce. So false alert or could not reproduce is often developer code for I don't know what this is. And by giving people that extra education, they actually recognize what the vulnerability is and they have a path to figure out how to fix it. In fact, about halfway through that year, our security team said that that was no longer a valid answer and you were going to have to provide some sort of fix or mitigation for everything. We also uncovered new vulnerabilities. So as our developers were doing the training, they were thinking in the back of their heads, oh, I might want to look in my own software for that particular vulnerability. And they would come back to the guild meetings and tell us, hey, you know, I found this vulnerability in my software. Maybe you should check in yours as well. And we saw a broader adoption of threat modeling. So we were used to also doing threat models right before pen testing or right before shipping a product. And with this program, people took their threat modeling training and they're like, oh, this sounds cool. And they reached out to our security architects and they asked to do them early. And most importantly to me, we had people who were thinking about security every week. So a few key takeaways. If you're interested, know that a security champions program is forward and repeatable, you can do it. But you're going to need management support. You're going to need a few people, handful, one to three months to get the program started. You'll need that funding for the online training. You need to identify one security champion per team. And you're going to need one or two secure engineering guild leads per org. And let's work together. So I would love to talk to you one on one after this. Have you tried something similar? What worked? What didn't work? What did you learn that might help others in the future? So thank you very much. You can reach out to me on Twitter or LinkedIn.


live. This is Think Tech. I'm Jay Fidel. That's Tom Yamachika, president of the Tax Foundation of Hawaii. And today we're talking about we're taking a look at Honolulu City Council, Bill 80, which is really remarkable. Hi, Tom. All right, Jay. Thanks for having me on the show. Absolutely. So, you know, the city council, you know, has a certain cloud. Sometimes it goes veers off course a little bit. Bill 80 is probably a good example of that. It has to do with, gee whiz, what, hotels, I suppose, and tourism. Can you talk about the provisions in Bill 80, which is pending in the city council right now? Sure. As you know, here in the city and county of Honolulu people are out of work for the most part, especially in the hospitality industry. But what Bill 80 says is really kind of remarkable. One of its first provisions says, and I quote, a hotel employee shall recall to active employment the same number of employees in substantially the same classifications as the hotel employer's active workforce on March 1, 2020, adjusted by the ratio of the occupancy that the hotel bears to 100%. So if 50% occupancy, you got to bring back 50% of your workers, at least a hotel employer must clean and sanitize every occupied guest room every day and must employ a number of housekeeping employees to ensure that this standard is met. So whether or not you're bringing on 50% of your people because of 50% of occupancy, you need to have enough employees to clean every occupied guest room every day. Well, that's pretty interesting. Where exactly do they get off? Well, and that's I think the $100,000 question here, does government have power to in fact do this? What the Bill says, obviously assuming they do have enough power and that the way that it would be enforced is by private individuals who haven't been recalled, can sue. And if they win, they get to have the hotel pay the returning. So it's encouraging litigation, kind of putting a blunt instrument over the head of the hotel employer. And it's being pushed very, very hard by the hotel employee's union on Local 5. So that's where it's coming from. But you know, this goes to the whole question of legislators, not only the city council, but the state legislature, introducing bills that are absolutely useless and badly drafted and not likely to do anything for anybody. Well, we can cover that in substance, but let's assume for a moment this bill has no redeeming qualities. How in the world did it get to be pending in the city council? Who introduced it? What kind of process have we got that this kind of thing could waste our time? Well, apparently the union folks came to the people in the relevant council district, which is which is Tommy Waters district. He introduced the bill by request, which is what people do if constituents come to you and say, I want this introduced. He's not saying he agrees with it. He just did it because he a constituent requested that he do it. That's absolutely right. You know, that happens in our state legislature as well. Happens all the time. Matter of fact, all of the government introduced bills are introduced by request. They come at the governor's request and the speaker of the House and the president of the Senate introduced those bills by request. So it doesn't mean they agree with them, but they have been requested to do so by, in this case, the governor. Other kinds of groups, profit, non-profit, government and so forth, they come to the legislature or the city council as the case may be and they request that introduced that bills be introduced and that happens all the time. It's deeply ingrained. Is it deeply ingrained in other states as well, other cities, or do we have a special vulnerability to this kind of request? No, I don't think that part is atypical at all. But I think the thing that is atypical is we have a bargaining table. There's labor, there's management, and they're supposed to bargain over the terms of working conditions. Okay. It seems like this is a case where the labor side is taking another crack at this instead of, or perhaps in addition to trying to negotiate with management, and they're going to government and saying, government, please get involved, mandate this. Yeah, I understand completely. And, you know, Local Five has been on ThinkTech several times in COVID in these difficult times, and the message pretty much has been the same each time that they go to the hotel seeking some kind of relief, some kind of cooperation, collaborations, joint addressing these problems that come out of COVID, and the hotels turn their backs on them. And it's been consistent throughout COVID, and they can't get the first base. And they're very frustrated because their members are in deep financial trouble. And they, you know, don't have a bottomless bit of money, I'm not sure they have anything left to help their members out. So they're in duress. So I can understand their frustration, and if not desperation, about going to the legislature for, or rather the city council for some kind of sort. What bothers me though is this bill, you know, as you say, maybe a negotiating tactic, you know, to get the attention of the hotels, so to speak. But gee whiz, I mean, I don't think the legislature is an appropriate place for that, do you? If you were, if you were Tommy Waters, and somebody came to you with a bill like this, it's really special. When we'll go into that. But would you, would you introduce that bill on request?  I would say you'll have to find someone else. I'm not going to introduce that bill. Sorry. What would you say? You know, if the bill looks like it has at least a little bit of merit, I would probably grit my teeth and introduce it. But but I tell them, look, you know, I'm not promising to support it. But, you know, you're my constituent. Well, on that point, would you go back to him and say, look, look, guys, I understand your your frustration. And I want to help you, but this bill isn't going to help you. And again, we'll talk about that. So let me make some suggestions for you about how you could make this bill work. Wouldn't it be a better approach? Yeah, I think so, except that I'd lose the next election. Well, yeah, but so what, you know, we have too many career politicians who run for office their whole lives. And they, you know, sorry, they do not learn from term to term. Okay, anyway, so let's let's talk about the, you know, the efficacy of the bill itself. This bill sounds like it's aspirational, it's like wishful thinking. It's like asking God to come down from heaven, and make and make my adversary, you know, do whatever I dream and hope of. These things are undoable and unenforceable, aren't they? Well, that's that's, I think, a very good question. Now, and let me let me kind of tell you the status of where this bill is. Because that is, I think, very much in line with the question that you just asked. And that is, as of I think a couple of days ago, it was reported that the, the acting council chair had some misgivings about the bill because the city attorneys had come to her and said, you know, we've got concerns. Okay, so, although the bill was scheduled to be heard by the full council, and the normal date will be today. Okay, it was taken off today's calendar and set in the council chair said, okay, well, we're going to be holding this for a little while, until we look at the legalities. And in the meantime, let's look at this resolution that, you know, may help with the same, the same exact problem. And they're going to be talking about the resolution. Okay, but the bill isn't dead. Okay, and, and in a Star Advertiser article a couple of days ago, one of the council members made it very clear that that if negotiations broke down, he would do his utmost to introduce or to get the bill back on track later on this month. If it passes as a resolution, I mean, that'll take the steam out of the bill on it. I mean, whether there's lobbying or political pressure behind it or not, that it'll sort of diffuse the situation. Yeah, yeah. So that's, that's kind of, I think that the path that, you know, people are going down the hotel industry is very, very, is very much against the bill. And they welcomed the chance to have it kind of sidetracked into a resolution. The union is very unhappy.  You know, take your, take your choice. Gee, there's so many things flow out of this, but a digressionary point. And this does have to do with tax. For several years, Bill has been batting around the legislature that would impose state income tax on, on REIT income in Hawaii. And I, what was the disposition of that most recently? Did it pass? Did it ever pass? Or it was, it was an attempt for years, and it never passed. But did it ever pass? Well, it passed, I think, a couple of years ago, and it got vetoed. Okay. A lot of politics involved. Yeah. It was reintroduced this in the 2020 session. But, but then COVID hit and pretty much nothing passed. Yeah, yeah. And the REIT bill was one of those. Well, it goes to the question of this time. I mean, the union and others in this community feel that the hotels, especially the international hotels, which although maybe they're not functioning so well here, are still functioning in other places and are bottomless pits of investor money. They, they may not have bellied up to an obligate sort of a moral obligation they have to Hawaii. What happens is they offer these what we call union jobs, which are in large part your service jobs in the hotels. And, and that's what they're contributing and they pay the TAT and real property tax, which I think they argue about a lot. Bottom line is people question, I think legitimately, whether they're paying their freight to the community, they resist the REIT, the REIT tax. And although they, you know, they do some things through the Hotel Tourism Lodging Association. I, there are people who question whether they do enough to pay back, if you will, to the community so that you have a lot of people in this community don't like them much, because they think they spirit away all the profit and are not invested in Hawaii. What do you think? Well, I mean, that's why you have, that's why you have unions. Unions are supposed to be a more organized large employers.  Now, and that, that I think is at least one of the key reasons why I think that this legislation is questionable. And the reason is we have federal labor laws in place that are supposed to be kind of the exclusive means that labor management are supposed to deal with it, with each other. It's called the National Labor Relations Act. And one thing that the Act does is it basically displaces any state, local, or any other laws that would get in the way of the balance that the National Labor Relations Act is trying to construct. That's called preemption. Preemption is a legal term, but the effect is that state laws or local laws that get in the way are basically involved. Okay, do we have this kind of situation quite possibly? Because really, what we've got going on is issues which I think should be bargained between the union management. And I don't think either side is entitled to go to government and get a third bite at the apple, or a second bite at the apple. But that's what that's what happens. That's what appears to be happening. Yeah, where legislators are vulnerable to unions knocking on their door and asking them for extraordinary relief. I mean, we we have very powerful unions in the state. And that's been the case a long time. But my question is, gee whiz, if it sounds very, sounds very workable, very appropriate to have this resolved as a as a labor bargaining issue under the National Labor Relations Act or otherwise.  What can the union do? There's the National Labor Relations Act force negotiation, this force them to negotiate with the union? Or is this COVID time so special that the National Labor Relations Act doesn't help? Well, what's supposed to happen in the in the labor management situation is that a labor management is supposed to bargain in good faith. There is a duty under the law for both sides to bargain in good faith. And if they can't get to a resolution, then management can lock out for the union can strike. And that's pretty much how things are traditionally resolved. Yeah, except that you got you got to start there's a duty of good faith bargaining, you have to open the door and sit at the table, and at least have a conversation. I don't think that's happened here. Okay, well, that's, that's I think something that the, you know, the NLRB or, you know, whichever federal agency or even even the state Labor Relations Agency can help with. The state also has labor laws in addition to the federal labor laws. And those can be called upon to help, you know, at least have the two sides listen to each other. Well, okay, so I put you at the table, Tom. I mean, isn't this a very difficult situation because we have COVID. And these hotels are losing at least arguably, who knows for sure, but they're losing tons of money. And the international ones arguably are also losing tons of money, they can make an argument to that effect because tourism is down worldwide. And whether they have money in the bank or not, it's not the question. But, you know, currently, they're losing money. The union guys are in dire straits. How do you resolve this problem? And of course, Congress is ineffectual. There's you know, there's no cares to, although McConnell say yesterday, every one in Kentucky became magnanimous and said he felt there was going to be a cares to coming soon. But you know, who's to say, we're going to be tied up in the post election process for a while that that's what the big distraction is going to be. And it's not going to be cares to. So assuming all of that, you have arguably dire straits on both sides of the equation. What kind of bill what kind of negotiation? What kind of result can possibly solve the problems that are raised in this bill 80? Well, you know, what what bill 80 doesn't do and what labor management negotiations can't do is create money out of nowhere. There you go. You know, if there are going to be funds to support unionized labor, they got to come from somewhere. And, you know, the the employers can certainly, you know, lay bare their books and their bank accounts and say, look, guys, there's nothing here. You know, tourism in Hawaii has taken a hit by over 90%. What do you expect?  And then, you know, the discussion will go back and forth. That's like, it's a moral question. But as you said, and I think it's really the takeaway from all of this, you can't create the money. And to solve this problem, money has to come from somewhere. And I would I would add that you're talking about a principle that exists starkly here in Hawaii, but to some degree, everywhere in the country, maybe you could say everywhere in the world, that there are dire things happening because of COVID. The economies of so many places are folding up, getting worse all the time, unemployment and what have you. Yeah, now, one very interesting thing about Bill 80, one very interesting thing about Bill 80, if you look at it, is the enforcement doesn't fall upon government. And we talked about that the government, government's kind of going to sit aside and let the private parties go file lawsuits and enforce this by themselves. So not even Bill 80 is saying that, you know, government has resources to put into this thing, which would which would ordinarily happen, right? I mean, you enact laws, somebody violates laws and somebody from from government law enforcement taps you on the shoulder and says, we got to comply with this law. That's that's not how this ordinance or potential ordinance is constructed. It's very strange. But I think it's, you know, part of the recognition that there's no money anywhere. Yeah, a point on that, by the way, is so you have this vague, if not unenforceably vague law, if this ever passed. Okay, and then you have the bar, the plaintiff's bar would go after the hotels and say, you didn't you didn't perform under the law. And, and then of course, the, the, the, the somebody in that case would ask for a jury trial on whether anybody performed. The judge would have a terrible time with instructions because the law is so vague. But assuming it got to the jury, then, then a local jury would probably favor the union and go after the hotels. That's terrifying. That you could put this in front of a jury on whether damages or my God, in chunk of relief. No, the in chunk of relief would be the judge only. But what I'm saying is this would be a mess in court. And I think a lot of lawyers would take these cases because they may not have other work. And they may want to ride in on the wave of antipathy to the hotel industry. And so you have, it's an enforcement technique that's kind of clever. But it's it does violence. What do you think? You know, it's very scary. And I think you're correct. And that's that's how the bill was designed. So that you would have, you know, private lawyers, going in front of, you know, local juries who may be, you know, sympathetic to the to the local people who are getting, getting decimated. Yeah, even though the hotel is getting decimated, too.  I think, you know, the problem is that our economy is deflating. It's, it's, it's dissolving. COVID is going to go on for a long time, probably a year. The spikes are extraordinary. There was a chart in this morning's time showing how many people catch it in a given day, 109,000 people get the disease every day in this country, 109,000 people every day. It's really going crazy.  And by the end of the year, we'll have some extraordinary figures.  And so, you know, the, the, the terror aspect of that is, is going to be huge, even if it's not now. And the economy is going to be affected. And the economy is, is, is going to take a big hit for a long time. And we're not going to have as good an economy. Our quality of life, all of us will be affected. This country is on the decline right now. Aside from all the other issues that Trump has, has generated, you know, the economy is huge. And what does that mean? It's, it's that, you know, the, the, in this case, the local five suffering, there'll be a lot of other suffering going on, economic suffering going on. And we're all going to have to get used to the fact that we, we don't have the economy we had, and we can't get back to it. This is going to affect everything, don't you think? Yeah, no, I think in, in addition to the fundamental truth that, you know, we're not creating money. The other fundamental truth is that there's plenty of pain to go around. I think we'll have to realize that in the world. Here is special. Yeah. You know, in the hospitality industry, it's been particularly cute. Yeah. So what's going to happen? I mean, it seems to me that this is only one, one shot across the bow sort of thing. So we have this Bill 80. But there'll be other things too. I mean, when people are desperate, they do other things too. Can we expect this in the legislature in January? Well, I think what we have here is I think more symptomatic of the problem that we're a one, we're a one horse economy, we've got tourism, and that's pretty much it. And that's why we're that that's why we have, I think, so much more pain in the hotel industry, that it affects, you know, many, many more people than it would anywhere else. So I hope that when our new legislature gets back in session, gets back to work, they really take some serious steps to help diversify our economy. So it would at least blunt the pain that, you know, that happens when tourism gets hit hard. Well, you know, lately, we've been having a fair amount of interest on think tech about an issue that was in, you know, regular and hot discussion back in the early years of the century about the persification of the economy. And there were a lot of people, you know, the young people in tech and entrepreneurship, a growing body, composed of people who had been in Silicon Valley in the nineties and maybe made some money or at least got excited about things and came back and tried to make a go of it here. Didn't work. An act 221 was bashed by little lingual and that went away and we don't have, we only have radio activity about that. We don't have a significant fund. We don't have significant incentives. Even the Minoa Innovation Center has been turned turned over from the Hawaii Development Corporation, High Tech Development Corporation to the university where it is now a sort of a mixed bag. There's not a lot of focus on diversification and diversification to technology. And furthermore, and if you have ideas about this, the world is waiting for you Tom, how do you do incentivization without spending any money? If we have no money to spend, how are we going to incentivize diversification and thus alleviate the pain of having a mono economy and tourism that doesn't work? Well, I think we can ask ourselves how much interference that our government is currently exerting in the industry, like with employee mandates, payroll taxes, things like that. Maybe lessening those burdens would be a means of giving incentives to work. But incentives always cost money. If you say we'll give you a tax holiday, we're going to give you tax credit. Those are, you know, customary incentives in a lot of states and communities have built tech industries by doing that. And movie industries I should add. But if this still costs money, it comes out of the till. Is the legislature going to be willing to do that? They have not been for 20 years. And furthermore, you know, the only way to do it is to have a champion in there who will advocate for tech and the arts, I guess. If I were in the legislature or you, I might be, you know, supportive of that. But I'm not sure there's anybody that comes to mind who is. Right.  And there's really isn't a whole lot can be done. Yes. So from a fiscal policy point of view, assuming, you know, there are a lot of people talking the talk about how we have to reconsider diversification, which John Burns talked about and every governor has talked about, but it has never worked. The closest came, it was Act 221 under Ben Kaitano. But since then, you know, it's been clear that this is not what Hawaii wants to do.  The natural object of that is technology without success for years and years. So the question is, this is my ghost of Christmas future question. We aren't, we do not have the political will even in crisis to diversify. And at the same time, we're not going to be able to reopen the economy. It's going to get worse. There was a thing in, where was it, the civil beat this morning? Or maybe, no, the advertiser this morning about how we're not, we're probably not going to get to phase three reopening. Because of the increases in cases. So with all of that, the economy is going to be in worse and worse shape. What can the legislature do? Very good question. We're going to be, I think, seeing a lot of the discussions that take place once the legislature starts up. And then we can, you know, once that happens, we can have some more discussion and see what is actually happening. What about a tax increase? What about a rock'em sock'em real property tax increase? What about a tax increase on the, on the gross exercise? What about an income tax increase? Those things in, in the wings, assuming the government simply doesn't have enough money to operate and it must operate, and the federal government isn't doing anything. Isn't that in the wings? I'm sure all of those proposals will be in play. So there'll be discussions. We just have to keep vigilant and keep everybody in front but what's going on and if, if you don't think that's the right direction to go in, you need to make your voice heard, talk to your legislator, make sure that the people that are in the, in the seats of power have your interest. Okay, it's time to have smart policy here. We can do it with smart policy. And you and I will have to cover it going forward because it won't, it will have to be nuanced and it'll have to look around the corner, look into the future. Yeah, thank you, Tom. Tom Yamachika, Tax Foundation of Hawaii. It's not an easy question, but Tom can always answer. Thank you so much, Tom. Thanks for your confidence, Jane. Thank you for letting me in this show.


Okay. Good evening. I'd like to call the Monday, July 18th, 2022, regularly scheduled row and select board meeting to order. I'm Brad Town with us tonight is on my left is Flo Smith and Dave Sawyer. On my right is Joe Staub and on Zoom is Carl Park. With us also is Vince Connie, town administrator and Diane Isabel, town treasurer. Editions are changes to the agenda. Yes, there's one change. I inadvertently forgot to delete the approval of minutes for the previous meetings. Those minutes are already approved. There are no new minutes ready for approval for this meeting. So that will be removed from the agenda. Okay. Anything else? Not update? I mean a public comment hearing none. Update on board up to the board on the town clerk and assistant town clerk positions. Yeah, very quickly. We have two residents that have applied for the town clerk's position. One was interviewed by the staff today with the very positive feedback from the staff on that interview. The second one was scheduled, but had an out of town situation that had to reschedule. They will be interviewed tomorrow. The thoughts are put out to the board are that based on the second interview and how that goes. If one of those two candidates seems qualified in a good selection, let's say, the staff and I will make that decision. I would propose calling a special meeting Thursday to make the appointment, pending the candidates availability to start. Board agrees. Anything else for Vince on this? Okay, update highway crew position? No, we made an offer last Friday that was accepted. The individual will be starting on August 1st for that to fill that. So the highway will be fully staffed as of August 1st. Okay. Final approval of a new town office cleaning contract. Yes, the way that seems like months ago. It wasn't quite that long ago. I was asked to check on the ability of them to be bonded. They've gone through that process. The owner will be the one right now that did pass the background investigation for the bonding. It is is bonded. I think she's been fingerprinted and completed that with the with the police. So we've actually had a trial run with them in here as well. They've done a great job. I think the staff is quite happy with the how they perform. So we're ready to move forward officially and make it official. I do have that in there for our motion on the cost and all that from the original vid documents. So I think I think from that perspective we're we're pretty good shape. You can't emotion. Don't move. Some money. That's what he's looking for. No, we voted on that before didn't I make a motion to accept lamb code clean services LLC. Proposed total for the first year is $14,040. I second that motion. In your discussion. All those in favor. Motion carries approval wholesome payment to axon for police from the ARPA funds. Again, you've got some information in your packet. Work with axon for the body cameras and it's a total cost of $17,406 $825 and 90 cents for those. And he's been corresponding with the passive to the LCT and they lump sum payment they would reimburse almost half $8351 and 55 cents of that $17,000 total. If they pay an installments, there's some risk there because from year to year their grants change. So he would only get a portion this year of I think it's around $2,000 or no $1,670 instead of the full $8,000 if you base it in installments and that difference would be at risk over the installment payments whether or not they offer the grant, how much they offer and so on. I guess so recommendation is obviously pay it full out of the ARPA funds and get that bigger reimbursement guaranteed up front. I have two questions. Chief, I wondered when it says this would also allow you to rework the grant application to include an ergonomic standup desk, which you should be able to purchase for under a thousand. Does the full cost include that now? Are you interested in that or no? I've been looking at a setup like that for Bonnie and so I originally had included like an entire package with this three year installment ergonomic desk. So he said send it back to me every work that he said he does. The money they're offering separate costs a separate check for that desk. And if we went with the route where you would be reimbursed to 8,351, 55, did they give you a timeframe when you would receive the reimbursement approach? I don't know. I mean, we're already kind of able to prove. So I was pleased to hear you were tentatively. Last year, I think when they helped us out with body armor, it was several times before they got the money. Normally the way that works is that once I pay for improved it through the cancel check, they process it and they, you know, they keep me involved and move at that point. And that's usually by a month to six weeks. Excellent. Very good. And we've been doing this for years. So as a total on a 60 month thing, 17,825, 90, you said with the reimbursement the total is 17,000 before the reimbursement. Before the reimbursement. Correct. And the reimbursement is 83,551, 55 of the 17,825, 90. I make the motion to approve the one time payment of 17,825 dollars and 90 cents with the understanding of a reimbursement up to 8,351 dollars and 55 cents. Second. Any further discussion? Yeah, I was originally going to let Mr. County just provide that information because it's pretty straightforward. But we've had some good news over the last week. And I just wanted to share that with the board. We had two officers graduate from the full-time academy on paper. We're a full staff, which is great because that's not really heard of most of the state. So we're moving in the direction where all our officers will be level three certified, which is a huge shift from last year at this time. So we're in a good place. We'll have an officer be at the academy. So that's going to be a draw on the shift a little bit. We have an officer going out with an injury surgery. So again, we're going to be kind of stretching ourselves in, but we're in the right direction. And I think six months from now, we're going to be in a really, really good place. I'm proud of our guys. I was impressed to see your post on social media. Well done and definitely good. Congratulations. Any other comments? Hearing none. Those in favor? Aye. Aye. Motion carries. OK, approval licenses, permits, vouchers and applications. I make the motion to approve payroll warrant 23 dash O2 for payroll from July 3rd, 2022 to July 16th, 2022 to be paid on July 20th of this year in the amount of forty six thousand one hundred sixty five dollars and seventy three cents also payable warrant twenty three G02 with checks twenty two one thirty nine to twenty two one seventy two for payables in the amount of thirty three thousand sixty three dollars and eight cents. Second. Any further discussion? All those in favor? Motion carries. Round table. No, not tonight. Thank you, Dave. I just over that last meeting on the partridge firm thing. I did a little bit more looking into that. I don't know if it's coming back up on the agenda, but, you know, we were asked to take the roads over up there, which we did because they were built town specs and looking into that and thinking about it. I don't understand how we how we become a partner in this rain or how to run off thing. I think that's something that I don't know how much where we're looking into it on. But I think legally. I don't think we're responsible to join them in that project. I think that we need to find out to our attorney that's part of what I've got to work on is getting in touch with the guy from the EC that made that statement. Not too far to try and understand, get an understanding to bring back to the board of where that comes from, from that. And why? Yeah, because I pulled up all the stuff when they were making references of Weston's mobile home co-op joined in with the town, too. And I went to all that paperwork and I think that's. We definitely need more because you'd have three acres of impervious. Yes, there's a bunch of them throughout the state that they pinpointed, but, you know, we took the roads on through that HOA to help, to, you know, because they were designed to think that I don't see how that puts us in a position that we need to join in. You know, once we took those paved roads over, yeah, but there's over 300, three acres of previous service without the roads, all the roof surfaces, rideways, stuff like that. So in the old state? No, no, Joe. Yeah, it's a couple of things. Few of us have discussed the dry hydrant and the Marrow Lake Road that has been inoperable since the Culver replacement several years ago. And thinking that maybe the fire department, we have parts that could help, you know, fix that. I was hoping that maybe the town would be willing to donate the equipment and maybe a equipment operator to do the install. And we can, the fire department would give labor and materials. I don't know if that's that's something you're going to want to just look into. Or probably they can see what the what's the Are you digging in the water? If there may be some work within the water, but my understanding in this, this is where I'm going to rely on maybe the town. And that would be Nick Arabachev also who does all the grants that we've used for the dry hydrants. I believe there is no permitting required for repair. But that's something we would have to have some sort of conversation with. Also, Mom Piliar, I'm sure I'm just offering right now material and labor. You have to look into the whole of Jaren Borg and see what it is, take all it is. But second, several years back, we started the conversation of the fire department has outsourced their accounting. And we currently are with batch elders were on the second second contract with batch elders. And that costs the department plus the community quite a bit of money upwards of nine over nine hundred dollars a month for these services. I was kind of wondering if with the hiring of the assistant treasure and unknown how we're going to pay those hourly rate or the salary on that, I can see the fire department subsidizing some of those funds in some way. I don't know if that's something that Vincent Dianne would like to talk about. Yeah. See why it couldn't happen, you know, once she's on board. Okay. That's all I have. That sounds like a good move to me too, you know, and fair enough that once she's on board and acclimated, et cetera, I think it could be a real win-win. Right. And plus it's a small piece of accounting that gets really good. Obviously I'd be overseeing it, but it's something that she could more easily do and learn. Thank you, Diane. Anything, Vince? I might have one little thing for the board to discuss with the town potential of a new town clerk going through the interview process. And I touched on this a little bit today. Expectations, right, from the board and from the town. I've got three of them listed that I want to make sure the board is okay with, or if they have anything else, they want to make sure that we, the staff, cover during the interview process, right? As we told the candidate today, one of the whole staff there so she can see what she's getting into and ask questions and hear her tour. So she would fully understand and we could fully understand her. So she comes into a wide open and understanding everything, right? But three of the key ones that I think are the office should be open five days a week, 40 hours a week for access, right? I think that's a given that's been going on in discussions for a long time. So we want to be clear. Now, what does that mean and look like? As we told the clerk today, it's really up to their discretion, or whether it's her, whether it's an assistant, how they want to achieve that. It can be flexible, but the bottom line is we need to have that. People need to have access for five days a week, 40 hours during that. So that was one. The other thing that I think I'm going to be looking for as well with the staff is regular communication and participation staff meetings. I haven't done any in a while for a number of reasons. But my intent is to start those up at least monthly to have a full with the chief and everyone that full staff meeting, what's going on, you know, anybody in trouble, can we help? And here's where we are with things and so on, just to keep the communication paths open and everybody working together. So that was another one. And then the willingness to work with the staff overall, right, on the modernization that we've already started doing with the equipment, with digitization of records specifically as well, to get that moving forward and get them on board. But again, I want to put that out to the board. You probably all have some thoughts and ideas on what your expectations of that office is too. I just want to make sure that we cover that right up front with everybody. So there's no surprises. Anything else? Oh, that's it for me. No executive session. No executive session. No executive session does. Can I change the motion to adjourn? There's just one thing I'd like to add. I wondered if you could discuss when I brought up to you that I was contacted by a resident on Chandler Road about the Lovers Lane Bridge and how you're handling that and the follow-up. I have followed up with the resident, but I just wondered if you could speak to that a little. I got an email from someone over there as well. And basically it's almost a canned response at this point. From the town's perspective, we've done pretty much all the weekend. I'm following up on a monthly basis with the Regional Planning Commission to follow up with the state to see where they are. It's on their priority list to be done, but there's no commitment date or time for it to be done. And that's the best information that I can get that I have right now that I'm sharing with people asked. We're hoping this year, but again, we're mid-July. It's not on any schedules, confirmed on any schedules as of yet, but we're still hoping. Very well. Thank you very much. Good. One more thing now that you're saying that. What's the deal with this Muzzy Road sign which just keeps coming up and seeing it? Okay, three out of the last five years, the sign's been stolen. It's an ongoing or three out of the last four, something like that. They've driven over the post to knock it down and taken the sign. They've cut the post to take the sign and they've taken the sign. Tim thinks this one, we probably helped make it easy because it was done during the winter. They don't normally, but they did plow snow up close to the sign so it was easy to walk up and steal it. But for some reason, people like that Muzzy Road sign. This will be the fourth one of the term that I think since I've been in here that we've replaced. He's going to order one. They're not 35 bucks a pot. He's going to order another one. We did check with Fast and All. Brad had made a suggestion about some security type hardware. They don't really have much to offer. And the fact of the matter, like Tim said was if they want it, they're going to take a saw as I'll cut the post again and take it anyway. Then we'll replace the post and a sign, rather than just the sign. How about a name change to the road? Just saying. Motion to adjourn. I make the motion to adjourn tonight. It's a regularly scheduled meeting. Second. Any discussion? All those in favor? We're adjourned.


Tom here from Lawrence Systems and we're going to talk about the Unify Protect Viewport PoE, or as we call it, Magic Video Tube for the Unify Protect. We'll get into that in a minute. But first, if you'd like to learn more about me or my company, head over to LawrenceSystems.com. If you'd like to hire short projectors, a hires button right at the top. If you want to support this channel in other ways, there's affiliate links down below to get you deals and discounts on products and services we talk about on this channel, including a link to our Patreon if you'd like to become a Patreon supporter. We also have a swag store where you can get shirts and other items that are for sale and that changes from time to time what's available and what's not. So go ahead and check that out frequently. And finally are forums. If you'd like to have a more in-depth discussion about this video, suggestions for new videos or just reach out, say hi and talk tech, our forums are a great place for that. All right, now back to the content. So Unify sent this output to us for review, maybe a little over a week ago and right away we started plugging in and using it. And it's a couple of my videos I've done since I used it. You may have noticed in the back we have the camera showing behind me because, well, our kitchen's on the other side of this camera and we liked using it to watch it work and see who's coming in the front door if we're all here eating. Anyways, in that week we've had no problems with it all. It actually works quite well. When we first set it up, adopted it, plugged it in and it did reboot once, which is because it auto updates without asking, which is actually good because if the target is to send this to people who just want to use the system like the Unify Protect is, kind of a basic system, it does have a place in the market I think for people who want a very automated system that is auto updates the cameras, auto updates the software, auto updates the accessories such as this that come on there and that's what it seems to do. Now a couple little background pieces. We do like the Unify Protect system for small cameras. That's what we're using this on is our Unify Protect with a handful of cameras and it is a Cloud Key Gen 2 with an SSD. So we've been using that and doing some long-term testing and I'm going to work on a separate review for Unify Protect, but we found it actually be very reliable, very solid and intuitive to use. Back to this, this is a piece that I would have said prior to knowing about this product coming out that this was a big missing component because a lot of people want to have some type of persistent display like a TV and have the views set to go on here. Now this is being done after Chris from Cross Talk did his video so this is May of 2020. I'll leave a link to Chris's video as well and I'm still seeing the same things that Chris seen. One, let's get these problems out of the way. They're not really a game stopper here but at least there's something I want to make sure people are aware of. One, I don't see any way to control this on the app on my phone. Two, the issue is if you have a full screen view or even a window view and you want to set it to either rotate based on time or motion that works perfectly fine on the computer in Protect but does not go over to this device. Those are something that are probably easily fixed with an update but I will admit I've experienced exactly the same things as Chris.  I just want to make sure it hasn't been anything you figured out beyond that and so far as of right now it just needs to be a minor issue. Minor issue easily fixed with software. Now let's look at the device itself. In the box of course you get this you get the little holder to mount it onto the wall or to a TV. You get a couple screws. Now by the way because there's an end the way the ends are it doesn't matter it can go in either way whichever is more convenient to have the HDMI at the top or the bottom or the secondary network port which by the way it's right here's the HDMI and there's a secondary network port and on this end we have the standard PoE and it's only PoE there's no plug or anything you're going to have to either use an injector or a PoE switch and it's hard to see right here but I can show how it works. There's a little blinking light that you can't see when it's off but it it's blinking white is booting which takes about 35 seconds to boot. Solid blue means it's adopted and working and white solid means we're ready to be adopted. The adoption process is really easy in there. Then we got a couple screws in here we got a couple VESA mount screws if you want to mount it to like the back of a TV and one of the VESA slots that's kind of nice that they included that on there and these have the recessed so when you're doing that things still fit in there without getting caught so I'm glad they included those screws and two almost what feels like oversized wall anchors they really gave you some heavy-duty wall anchors on there. There's also a little sticky back so you can sticky back this. I'm probably I'm guessing so you can sticky back it to a TV so it's not plastic on plastic. I don't know it didn't feel that sticky. I was a little bit less clear on that particular application of it and it kind of looks like a little pack of gum which was the card which has a link on there in a QR code you can scan which will take you to this link right here. So just shows the package contents and the same things I shown. Oh there is a reset button on there and an HDMI cable was included and it just shows you how to mount it and then there's that optional sticky mount for sticking it to the back of a TV with the surface mount. I don't know maybe it will hold I didn't really test it. It feels sticky enough like I said it's not a part I tested. Anyways back to the review here so what we're going to do now is going to plug it in and show you how it looks like. I'm going to use the TV behind me that's actually where we usually have this plugged in plug in the provided HDMI cable that they gave me here and plug in the PoE and boot it up. So you can see the fancy Unify logo and then the kind of cool screen it has in the back there. Like I said the boot up time should probably right around oh I don't know 35 40 seconds it's relatively fast which is nice so if you have to you know restart it or anything like that and when it did the update that was relatively fast as well. Now as far as uses well this is kind of simple first you find it you adopt it put it on the same network as your Unify cloud key then we called it managing video too but you know obviously usv ufp viewport and right here under the about of it is uh all the options so if we switch to all cameras you can see it very quickly switching behind me matter of fact I'll show that again I'll click on one and say from the time you click there's just like I don't know like three second delay maybe before it switches views you hear the click of the mouse and you can see it changes really quick so pretty simple there now how do you set these views really easy so you go over here to your live view and we have this view we have the one I titled youtube demo where I grab a handful of cameras any view you create an edit here and protect shows up as available under the about other device really simple now the problem I mentioned before was a magic video tube rotating so this is a rotating one so we'll set the view and show you if you drag multiple cameras to a view you can choose either a motion or time and I have it set to time so every five seconds it should save the it'll change this view so if we wait five seconds you'll watch it go to another section and now we switched out there but let's go back over here and magic video tube and we'll choose the rotating one you can see behind me is showing the front counter and we switch over here to watching the live view and we'll switch to the same one over here so rotating so we're on the front counter here front counter in the back and this one switches that one just stays in front counter it keeps playing it keeps loading it doesn't stop now we're seeing an outback view and I'm not sure why it doesn't do that let's see that is the kind of mystery other than that the multi-camera views and things like that work fine so if we were to go to like this view here with a four-camera view and even if you try to rotate one of these in a four-camera view or like this youtube demo view here where we have a we don't have a bit of a handful of cameras on the protect that we've been testing with we'll go back over here to the devices it does the multi views perfectly fine it just doesn't rotate any of them so really minor in terms of that so go switch it there actually which one was it oh youtube demo choose that one and you can see the multi-camera view behind me so it'll split it all up so really this is just a dead simple device kind of magical but that's in a way what you want for clients you want to have a device that you can plug in let it go adopt it it updates you don't have to really manage it now this is one of the places we think the unify protect system is really good at if you have just a handful of cameras and as i mentioned we have a cloud key gen two and we have i think four cameras on it it seems to hold up quite well one of those cameras is one of the 4k and that's why we put an ssd in there i've commented before when i did my review that if you want reasonably fast video playback and retrieval uh having an ssd makes a pretty big difference it seems like in the cloud key in terms of that we haven't tested it again lately when i finished my final review of the or longer term review of the cloud key plus running protect on there i i mean maybe i'll try another hard drive again but it seems to be working with the ssd pretty well overall i do like to protect system i think this is a welcome addition to it i know people you know they always want to have something displayed on there and there are other camera systems that offer like you know add-on boxes like commercial type nvr systems that have add-on systems to do this and are generally kind of expensive this as an msrp of 199 would i like to see the price point lower yeah i i don't know if they can do that it is a 4k device it does do up to 4k output i've only tested at 1080 but it's back to do 4k at 30 frames a second so maybe they can get the price point lower but i'll admit compared to some of the other nvr options out there that have like an external device this is still um you know within reasonable price because this is about half the price of some of the other ones i've seen the last thing i'm going to comment on you know my overall feelings on the unified protect system is please don't i did say for smaller camera systems i mean at some point the system does choke a little with a lot of cameras on there so my endorsement here is of the device and of this as a kit for maybe a business that says i'm i need five cameras or four cameras i don't need 50 and i don't plan to expand to 50 cameras it seems like a good fit so it's a welcome addition to the kit and it's way easier than trying to roll your own idea and i i'm aware of all the projects of doing things like having a raspberry pi to monitor it but that always comes with a lot more challenges um and to me for 199 versus even spending only half the price of something else but then you have to help manage it if you're a hobby is great but if it's something you want to put in the client who says hey i got four cameras i need four cameras displayed on this tv and uh this person's office then that's going to be a turnkey easy solution with this and i think that works we have a few pizza places and a few other small places using a protect and they like it it just works you know and they aren't going to get a bigger building so it fits their need and therefore this is like easy intuitive use and by the way the app for protect is so pretty nice so my thoughts on it i give it a thumbs up i think it's a nice product and thank you unify for sending us one for review we're actually gonna keep reviewing it right here like we are and use it because it's actually really convenient thanks and thank you for making it to the end of the video if you like this video please give it a thumbs up if you like to see more content from the channel hit the subscribe button and hit the bell icon if you like youtube to notify you when new videos come out if you'd like to hire us head over to laurancesystems.com fill out our contact page and let us know what we can help you with and what projects you'd like us to work together on if you want to carry on the discussion head over to forums.laurancesystems.com where we can carry on the discussion about this video other videos or other tech topics in general even suggestions for new videos they're accepted right there on our forums which are free also if you'd like to help the channel in other ways head over to our affiliate page we have a lot of great tech offers for you and once again thanks for watching and see you next time