it's not a lot lost but i would encourage you to start with the city council chamber and get that set up i did mention last time you need to think about ventilation in any space even the large space you need to think about heat recovery ventilation because it's the the the aerosol uh partners of a protected particles of a protection potentially infected person that is going to be the hazard and the energy grant that we talked about or that was available or made a presentation and or other state funding you could exhaust the city council chamber effectively through the side windows and recover the heat from the outgoing uh but that needs to be planned and engineered quicker but i would suggest that you proceed but also because you're talking about moving the pocket park you're talking about bathrooms you're talking about winter and camping areas there's a disenfranchised population here that is routinely ignored that they need a place to come in and make themselves heard i've been talking to them but they don't feel like they have a voice they don't have phones they don't have installed on laptops so if they if you really want to take some of these issues seriously and hear from the affected people you need to make a place where they can participate so uh those are some ideas i would not wait i would move forward with the city council i bought uh the work that was done on thinking about that get started on the ventilation issue and then maybe as a phase two if you over crowd the city council chamber which is i believe is unlikely uh then you could move upstairs into a bigger room i'll leave it there thanks thank you uh jack would it be uh an appropriate time to uh make a motion uh and i'll make the motion i'll see if there's a second i move that we direct the city staff to proceed with uh proposal one to as a first step open up the city council chambers for for public participation in our meetings while we're addressing the other issues we need to address i'll second that okay uh any further discussion on the motion go ahead dana what we meant by one and two i think it was just on proposal one to do something the two was like to not the number two okay proposal one is is in person meeting space made available for the public in county i understood the one i just didn't understand the to thank you feel yeah um jack did you have something else you want to add to that well yeah i also agree with dan that i'd like to see us explore if we can set up council ma'am meetings for in-person meetings in the auditorium space we can space it out so we can be all be six feet apart um that's that takes some more doing but uh so that's not part of my motion except that i think that you know the staff are probably getting the sense that at least some of us are interested in exploring that that seems fair and i um you know i we're gonna vote on this motion but um i think another part of this is considering whether or not we move forward with plexiglass so that we have it if we need it unless unless you don't need a motion around that um we'll look into it um i would say it requires upfront capital it's a reimbursement grant only so we'll we will just look into that as an option okay seriously and then we will also look about how we can configure upstairs if that's an option okay uh donna well when you're indoors the ventilation is as important as the six feet apart so i would like for the staff to look at what kind of ventilation improvements would be needed whether it's in the lower council chambers or upstairs in the auditorium even though it's big it's still not well ventilated they sealed all those windows for winter savings um so i i you know i have lots of anxiety about going inside in the fall the winter i think that it's wonderful that people are having sports and we're not having the bars open but to me that just means a likelihood of another breakout so i'm sort of in a wait and watch mode but i'm concerned about the ventilation so if you check that that'd be good if i might add to that i mean this might be inherent in your request donna but um i think if it is separate is the filtration um being sure that the filtration is you know what senior center about a few standalone um filtration systems so we do have a price that we can look at for that as well um so we will look into that as well okay great okay well there's a motion on the table um any further discussion this is about opening council chambers up to the public oh i oh yes dan sorry just one clarification i mean i i guess in looking at the space i i wouldn't and i wouldn't understand this motion have to be changed for that but i would i would assume that there would be an ability to to look beyond i mean i suggested the upstairs but you know there's a number of large public spaces in town there's the auditorium at the basement of the pavilion whether or not the state would ever let us in there is a is another question but um you know there are various churches and um you know there's city center itself and the question you know i think we have to think outside of the box on some of this stuff and if it was available or applicable um but i would understand that that that would be part of what the staff wouldn't necessarily need a motion but can simply look into some of those ideas as well i'll look into it um heather did you you turned your camera on would you like to say something yes sorry i got lost a little bit so the meetings would still be available for the public through zoom too yes and as under the staff's proposal the council members would still at this point be participating by zoom and the it's a proposal to open up council chambers so people who want to come in in person to be to speak to the council but don't have the ability to log on themselves would have that as a way to address the council um donna i saw you had a hand well just to follow up dan's proceeding to look elsewhere i wouldn't want the staff to consider it and give us an idea what is the inconvenience of us not being in that building staff goes to their offices or waits in their offices or copies things i just would want a mindset of how inconvenient to have council meetings outside of the building would be for staff if you just have that in your mindset thank you i also assume that other places would require a rental fee yeah sorry go ahead yeah no i mean i i think that's all fitting into the the feasibility is just you know because we're looking at these two different options i wouldn't want you know because i you know just if there was a facility that said sure you're welcome to use it and it did fit our needs well i wouldn't want to avoid have looked so narrowly that we missed looking at that other available space but all of these none of these are perfect it would be great to go turn back the clock to january and go back to council chambers and also around in each whizzlers but you know that's not where we're at right now i should probably throw away the twizzlers that are in that please don't get any twizzlers who pass those around i did i didn't pass them around but chocolate last forever yeah okay uh all right so there's a motion at a second need for the discussion okay i'll in favor of tuesday i hi hi okay and opposed okay and uh so the last item for a regular business is uh oh yes before we get off the covid report and covid topic um i i heard the assistant city manager say that there's uh there's funding available to municipalities to make covid related um expenditures of various kinds and that gets me that i immediately thought of whether you know we've been hearing suggestions for even at night opening up the uh downstairs bathroom rooms for people to come in and use them and i think that that's been the reaction has been that that seems to be impractical because and probably because of security and needs to isolate the bathrooms and and the stairwell and vestibule from the rest of the building and so i just wonder is it possible to look at what physical changes would be needed and whether that's something that uh we could get reimbursed from the federal uh covered covid relief funds to do well i will say that um one thank you that proposal is going to be on my next uh the october 14th agenda regarding the the bathroom update we are looking into that how much that would cost i would need to do more research if that was a refundable cost they aren't necessarily doing tangentially related costs we could loosely say that because some other bathrooms have been closed we need more bathroom facilities but i'm not sure if that would be something that they would reimburse and we might be on the hook for the funding so i would need to look into that and ask um our uh some of our agencies that have been helping us with this is funding um these grants to ask that they think that's something that would go through so i'm not sure and we will look into it oh man we're just in sync aren't we okay nice to be all right um okay so the last item is looking at the calendar for uh the next couple of months as some of the days fall on uh holidays so i don't think we need to change anything in october is that yeah we would we make a very impassioned request that we don't change the october 14 day we just have a lot of things already teed up for that um you know after that we've got more flexibility but i'd love to keep the 14th i think the key i think so there's there's three dates that are really problematic uh specifically problematic one is november 11 which is the would normally be our first uh november meeting and that falls on veterans day we always have a meeting right around them but it's either the day before but this you know it actually falls on the holiday and we could still mean if we wanted but you know there's that the second november meeting is would be the 25th which is the night before thanksgiving and that's that's been an annual conflict that comes up because we meet the fourth week and that's always it's typically we've just moved that to the third week um you know i think way back we sometimes would move it from wednesday to monday but the last several years we've just met what would be the 18th this year but as jack correctly pointed out not only is the 11th a holiday but then that's two weeks in a row and then we have a similar issue the fourth week of december where we would be scheduled to meet the 23rd which is festivus but um technically isn't conflicted the christmas holiday but it certainly is close enough i think for a lot of people certainly members of the public and others that might be traveling or whatever uh and again we have in the years past moved that meeting as well to the week before so that would be the 16th um and i just say you know once we're getting to december particularly this year um you know we may need you know budget may be a lot more complex this year than it's been in prior years so we may need to meet weekly anyway or have an extra meeting in there i hope not but i think that's probably the reality um so you know i i don't know but those are the so the december 23rd november 25th and november 11th a very specific conflicts with holidays and how you want to move it after that um i will note that not that this is a big deal for us um but the first of the third weeks are typically the school board weeks so for people who are trying to follow both it seems delcore on the line and others but you know the press and the public that want to participate with both groups that is a conflict so we've we've tried to work around it obviously occasionally it happens and there's that so that's what i have to say you can schedule your meetings when you want we'll be here okay um jack you had a proposal about this um in a previous meeting do you want to talk about um your your thoughts on it i did and my proposal in started out by doing but for one thing uh covering october 2 the theory being that that by starting in october that's the way to keep us two weeks apart for almost all of these meetings um but i hear what the manager said about specifically not screwing up with things screwing things up that we already have uh have scheduled um so i'm happy to have us meet whenever bill thinks we should meet i would propose for just november meeting on the first and third so that we avoid veterans day and the day before thanksgiving and i know that that puts us on the same night as school board but you know that that kind of thing is actually pretty normal for this time of year um so you know it just happens um so that's one part of it and then and actually uh for december um the sixteenth is actually also the sixth day of hanukkah um so either like i i think it would be better if we could um move it to like well i guess my proposal would be that we move it to the second and the ninth um i realize that's two weeks in a row um but that also allows us time like if we decided that we did you know urgently needed to meet um more i because it's a complicated budget that that gives us a little more flexibility with the later part of december potentially um other thoughts i mean and this doesn't have to be what we do that's just um i'll put it out there what do you think that that's fine with me too so before eighteen two and nine in theory we wouldn't meet again from between december nine and january six no way we generate yeah generally well january 13 but technically right but we almost always and if we follow this schedule we will certainly win the budget meetings the beginning of january there it is but we do have possibilities of the 29th and 30th in december if we had to oh during the holiday week yeah i mean if we had to do a special i'm not wanting it i'm just saying if we had a real demand and that's not in anyone's holiday we're traveling this year than in most years i mean that is a good point and so maybe we'll just take stock of the ninth and see where we are and what we need to do um you're right i mean there may be less traveling and we're doing things remotely i mean i go it would be somebody coming in here but i mean for council members even if for most of us even if we were traveling maybe we could still participate it's going to be if we have to meet then it's going to be a heavy lifting meeting i think that's saying it will be a budget meeting there shouldn't be any you know we will be for some little thing it would be important i mean not that they're not all important but are you going to end up adding some extra in january to make us pay for some time off well you know it's not me how fast you get through the budget i as far as i'm concerned if we don't meet till from june december nine to january 13 i'm sure the staff would love it i'll you know if you can all if we can present you a budget on the ninth and you can approve it on the 13th then we're the month in between the yeah good but i i i don't think we'll be able to do that and i don't think we'll really be on target to you know the night that meeting is usually when we present the budget first the second tuesday in december that's usually when we have it ready and i don't think we'll be i i i mean i can talk to kelly but i'll think we'll have it ready for the second especially with the holiday right before that good but there's also another meeting we usually change about the timing with the ballot and that means on thursday so earlier that would be good so this year actually so that's interesting too so that's a good point i'm glad you reminded me of that donna the way the calendar falls this year the deadline for us to have the budget and the ballot is actually thursday january 21 whoa which is the third week because because town meeting this year's like the second or or first the second of march so can you say that again when is it the 40 day deadline yeah for us to have stuff on the ballot is thursday january 21 so that our last meeting january 27 would be too late so we'd have to have our normal thursday night meeting to get all the petitions and all that in you have to be on the 21st so we should put that in our calendars now anyway yes so then we can decide you know maybe we'll skip the last one in january if necessary but we certainly you know okay you wouldn't like a little buffer make it on wednesday the 20th well we could so the problem with that is here's the issue that we run into and again this is all your decision but the debt the same legal deadline for us filing our ballot and finalizing the warning is also the legal deadline for people that are submitting petitions oh right right right yeah so we could meet on wednesday yeah and vote on the warning and vote on that and then have to come back on thursday if petitions are submitted to vote to accept the petition i forgot about those petitions yeah yeah that's the reason we've traditionally moved into thursday so that one time a year so that we can do everything on the same if there's if there are petitions out okay um so we'll put together all that calendar and okay i was just saying i don't think we need a well do we need a motion on that i don't think we do yeah no one's really opposed to that right okay okay great uh all right so that is the end of our regular business so on to council reports dana okay well i just want to brag bill and staff the link that you've put in your manager's report is to mind thank you thank you i have been struggling to find everybody because particularly short of staff some committees are having a hard time posting so if any of the public haven't seen that go to the manager's weekly report and there's this awesome link to all the meetings going on it's terrific i want to thank dan and the council for his appointment to the public safety authority board i want to mention that the park commission did discuss uh the gruden park perhaps finding a place for it in fact the new pump station that was part of what was opened this last week when they opened the extended bike path it could be there a place for parents particularly to sit and wait while their kids are having fun on the pump station so at least they're discussing it and they're going to come back to the city council with an option for us to consider uh also i want to really um pleased to say that the rec department put in an application to renovate the bathrooms at the pool house and i got the pleasure of signing a support letter that they wrote beautifully so let's hope they get the money um and the other thing is i really do think that steve uh whitaker has a point about us getting to the public bathrooms we need to do something and whether that's directing staff committee whatever we need to move that forward the months are coming that are going to be nasty or the now and it's sad watching people hunt for bathrooms thank you okay thank you uh connor not too much um i think at some point i you know especially as bill saying that the ballot has to be ready in january it might be worth a discussion if there are any potential charter changes that we need um to sort of adapt to the new uh pandemic economy i i felt in several cases we were sort of waiting on the state um to make some big decisions here and uh just that maybe we could start putting a list together of things we think would be a comprehensive charter change uh to give us a bit more control i also like the idea um i think we said it a couple meetings ago just acknowledging that the economy is not going to be coming back to normal anytime soon you know like you look at australia they close the borders to 23 i think you know um well what do what should we be taking into consideration as we form the new budget and you know how will that be different than what we've done in the past there because i think business as usual isn't going to get the job done going forward so i think having some of those discussions right now rather than um you know when we need to do it um it would be helpful so that's it for me tonight thanks thank you uh jay yeah i'm going to take a pass on everything thanks all right uh dim thanks um but i want to offer congratulations to john holler who led the uh extended bike path project and i was unable to make it out to the to ribbon cutting but um to migrate disappointment but it i have gone out there and it looks fantastic um i'll echo some of connor's concerns about you know where we go as a as a city this fall and this next year with continuing um issues covid related issues shut down related issues um i think we have to keep close attention as the weather turns and i was reminded this week as the weather turned really cold some of the benefits that we've been enjoying about after our activity outdoor dining are going to start to go away um and then as donna mentioned you know that's when uh we go back inside when outbreaks reemerge but i think we have to be be thoughtful and because i think as a community we're gonna have to really prepare for another onslaught so that i'll leave it there on a happy note um great thanks jack um a couple of things one uh also congratulation to mamma the Montpelier area mountain bike association uh the park's department and everybody who was involved in putting together the uh mountain bike trail project a tremendous amount of fundraising and uh and physical labor went into it it was uh it was great to be at the at the ribbon cutting even though alec could not quite get his son to operate the scissors and cut the ribbon um it was a good effort anyway and i also want to mention for anyone who's uh who's watching that there are um a rearage assistance programs available for uh for people who've had uh income losses due to the coronavirus and i particularly want to mention that the public service department has an a rearage uh for giving the assistance program uh funded out of covid funds to enable people to get their electric bills paid if they're uh if they haven't been able to pay them and that's uh that's a fund that has been really not reached anywhere near the number of people who probably need it and who who could uh benefit from it so public service dot vermont dot gov is where you would go and then there's a bunch of stuff after that but uh i encourage encourage anyone who's had trouble paying their electric bills to uh to contract the public service department they've made it uh quite easy to uh to submit the application and and qualify for funding and uh if you if you've been managing now because there's been a showoff moratorium in place it's it's not going to last forever and you're going to need electricity in this in the winter and that's all i've got thank you lauren uh yeah just a couple of quick things um one i wanted to mention that the um social and economic justice advisory committee has been um holding a couple uh forums trying to educate the public on this process we're undertaking and also doing some fundraising so we can hopefully expand beyond what um we have funded through council on the city budget um so there's an event uh this coming saturday at four p.m. um or you can watch a recording if you just want to learn more about kind of an overview of what the city is undertaking and how you can help so i hope people will check that out um and we've been posting information and thanks to camera and for doing a great job staffing that and helping keep that whole thing moving along um and um this i just wanted to uh throw out there for whoever's watching um curious what's happening with uh our wonderful halloween we normally do as a city i know this is probably more of a popular alive but i just know we have so many creative and um you know interesting folks in the city that could probably think of some really good socially distanced fun and it's usually just such a great event and with the local businesses in downtown so um was just kind of curious or hoping lots of good conversations are happening with you know what what that could look like this year and and is there a component that could also be how do we you know safely patronize local businesses and do do something to support our downtown community so just wanted to raise that as something i'm interested in exploring um and anyway i can help um and the last thing i've talked to a couple business owners especially heading into you know what might be some kind of tourist season with foliage um and one thing that's come up a few times are some business owners just bringing up like trash removal and especially during you know whenever having tourists come wanting our city to be you know the welcoming beautiful um thriving place that it is um and you just really staying on top of that is you know one of the things that they're most concerned about so i would just want to raise that as well thanks all great thank you uh so i also want to add my congratulations to all those who worked on the north branch trails off of coming street uh very exciting to have those open now but i also want to add um my congratulations to the cross remote trail folks because they also had an event this week uh they had a groundbreaking they've raised enough money to start construction of a bridge across the muski uh to this is like the biggest part the biggest uh uh chunk for them uh in getting the the cross remote trail uh going and so it's kind of like they're doing the heaviest lift first and so it's now that this is underway uh it makes the rest of the process um well a lot a lot easier which is great so this bridge is uh sort of off um off of gallison hill more or less uh so um very exciting for them to and for us really to be uh you know embarking on this and be connected uh with a nice bike path uh to parts outside from up here so uh anyway that's it from me uh john john adam are you there kind of sleep no i can you hear me i haven't gone to sleep my zoom isn't coming up it's very sure you can hear me though we knew you oh good yeah where did it go um well anyways um the ballots in the all mail election um went out today and yesterday if uh you registered to vote in this month you probably won't see them going out until next monday but everybody's getting something if you don't see them in you know week week and a half give me a call anybody's listening and there are a number of reasons why you might not have received one all of them very manageable but um so going into with a brief break another round of completely unknown territory and incredibly busy elections so the clerk's office is once again going to be all about elections elections elections but we've got a drop box set set up including a nifty one in the back and um you know i do need to remind people that for any kind of in-person voting you're going to have to sign a little thing that you know either bring in the ballot your center sign something that indicates you're not trying to vote twice not that you could do that in our system but you know we we expect you to sign the thing anyways um and that in-person voting then you know the office is only open tuesdays and thursdays but yeah so we've got a huge amount of volunteer needs a huge amount unprecedented and i have never seen people are like falling out of the woodworks to volunteer on this it's extraordinary i haven't even had to put the squeeze on people or send out the the annoying emails and we're already almost all staffed up not just on election day but through you know the beginning of october all through so um still some out there so y'all still get hassled but um yeah it's a weird time but kind of looking good that's what i'm doing tomorrow but um but for the public for you mentioned people are coming into the clerks office to vote just so that i'm clear and the public that would mean bringing in the ballot they were male to hand it in well i mean we won't stop you from voting if you don't if you don't have the ballot with you that you were sent then you will be asked to sign a legal affidavits saying i'm coming in without my ballot you sent me i am going to destroy that ballot and as i say the system does not allow you to vote more than once um if we punch in one ballot for somebody they can't send in the other ballot it will uh it will not get counted and in fact they could get in a little trouble if someone's looking too closely but if you don't have the ballot with you or you don't bring it no we will not stop you from voting in the office okay that's good to know thank you uh bill go ahead uh just a couple of things um for the 28th meeting we are going to be we at least technically had scheduled to talk about our legislative priorities so i'm thinking our legislative committee we may want to pull together a session in advance of that just to at least have a draft of something for the council to talk about you may recall what we said we would do was the council would talk about some priorities and come up with a preliminary list invite the legislators in you know in november and then you know hear from them about what's doable what isn't their feedback on our list and then adopt a formal sort of here's our legislative agenda after that meeting so anyway just heads up we'll have to get in touch I don't think so and those of you on that committee be thinking about what what that list might look like in fact all the rest of you just to a couple of the comments that the council made next meeting we will be going over budget stuff and we will be so we've set that aside we'll be going over the first quarter finances of the current budget because you've probably made budget changes with the idea that we revisit those quarterly and see where they're at at that you know I think when we did this it was the actually with the idea that gee things will be getting better and we'll be able to restore things and I'm not sure that's going to be the case at least for the first quarter but then we'll also be talking about the process coming up and the challenges we might be facing so to Connor's point that we should be thinking about this I don't think it will be business as usual so we're going to have to have some hard conversations there I'm trying to think there was something else somebody said and I know public bathrooms that will also be on the next agenda and Cameron is heading up the toilet task force and they are they've done a lot of things but amongst them was to identify existing resources that potentially could be put back into action soon for the winter including city hall I haven't seen the full list but even private ones and state well you know I think there's some at state buildings and since the state is technically supposed to be the lead agency on human services we're hoping that maybe the very least they could do is open up some of their bathrooms to the public to help with this issue so but we'll know more about that with a list of ideas and then obviously some longer term thinking about where we might construct something so that's all I have okay well that is the end of our oh there's we have to make sure to swear in Dan yes John do that can you still hear me yes okay oh good because I can't even pull up zoom at all so I'm just like talking to a magic screen so I'm glad you're all here for me I can't hear you so so no face to face here but it is legal to do this I've checked over the phone so I assume over video conferences even better so Dan I'm counting on you to raise your right hand here because I can't see you then there's two oaths as he probably can remember okay do you sound me swear or affirm that you will be true and faithful to the state of Vermont and then you will not directly or indirectly do any act or thing injurious to the Constitution or government thereof so help you God or under the pains and penalties of perjury I do do you sound me swear or affirm that you will faithfully execute the office of city council representative of the central Vermont public safety authority for the city of Montpelier and will there do equal right injustice to all persons to the best of your judgment and ability according to law so help you God or under the pains and penalties of perjury I do all right you are duly swerd thank you John thank you Dan okay I think that is the end of our our business so yeah so without objection I will consider this meeting adjourned thank you everybody bye all good night


A new Mystery Gift is now live in Pokemon Scarlet in Violet and it is running for a very small window so you don't have much chance to get this Pokemon, it's running in conjunction with the Japan National Championships that's happening in this weekend and as part of the national championships in Japan you'll be able to get yourself the Gift Pokemon Bronzong that was used by the 2022 Seniors World Champion winner in their team. To get the event in your game you're gonna need to come down to your poker portal. Once you are here come down into Mystery Gift and get with code and password. And the code that you're gonna need to use is 22 Senior Champions so there is no i and there is no o so you want to use a 1 and a 0 and it is Champ. Code will be on the screen as always. This event like I've mentioned is running for a very limited time so you've only got until the 11th of June at 259 UTC so convert that into your relevant time zone but that is when the event ends for this Mystery Gift Pokemon so like I say a very small window to use it so you make sure to try and get it while you can. It will end when the Japan National Championships ends tomorrow as of recording this video on the 10th of June so there is the Bronzong Mystery Gift and it is exactly the same as the Seniors World Champion from 2022 used in their team. Over here we may as well cover another Mystery Gift that is also running at the minute this one is running for a little bit longer until the 30th of June but it is to get yourself two TMs in the game and the code for this one is Play Double so this one will give you the moves bulldoze and it will also give you the TM Rock Slide as a Mystery Gift like I say this one's running for a bit longer so you've got a little bit of time to get this one and get these free TMs in your game might help with team building and things like that but they are doing a lot of TM giveaways every month that seems to be going forward so this is this month's one as well and while you're getting the Bronzong you may as well pick this one up they are free of course and there you go there is TM Bulldoze and TM Rock Slide so they are the two other Mystery Gifts that are running at the moment but like I say the big important one is that Bronzong if you'd like to get that Mystery Gift this weekend then you are going to have a limited time you've only got till the 11th of June at 2.59 UTC so like I say there is the Bronzong and it has that steel terra typing the leftover's item obviously terra types weren't in the world championships for 2022 so it's just got its base terra typing but a useful pokemon body press iron defense protect and trick room in the cherish ball which is pretty unique and it does have a ribbon as well the battle champion ribbon so very nice pokemon to have a nice mystery gift that we are getting and it makes a change from the regular TM mystery gifts that we get so try and grab this one while you can very short update video for you this morning thank you so much for tuning in hope you find it useful if you have do drop a like do subscribe to the channel to stay up to date with all of our pokemon skull and violet content remember the raids are coming back next week so we'll be covering all of that on the channel as and when they go live so thanks for tuning in friends have a great rest of the day and I will catch you in another video very soon so until then take care and bye bye


This paper explored the use of recycled polyethylene terephthalate, PET, to create eco-friendly engineering materials for construction projects. The recycled PET was obtained from waste bottles and used to replace sand in cement mortar mixtures and as fibers in premixed screed mixtures. The effects of PET treatment, chemical or mechanical, on the thermal performance of these materials were evaluated through non-destructive physical testing. The results showed that both types of PET treatments reduced the thermal conductivity of the cementitious materials without significantly affecting their compressive strength. This suggests that recycled PET could be used in non-structural applications such as flooring, wall cladding, and roofing. This article was authored by Mikayla Lerna, Dora Fodi, Andrea Petrella, and others.


Johnny is an excellent bowler, and his dad owns the local alley. He can practice all he wants. He was up against a good bowler in the tournament, but he knew he was a little better than his competition, and his dad made sure he had the most consistent lane in the building. He was up six points going into the ninth frame when it happened. He was on his approach, right on target. When the bug landed on his left eyebrow totally distracting him, it was a gutter ball. There's no way to recover from that. It doesn't matter how good your rules are, reality is not going to follow them. Reality does not honor authority recognized by men, nor does it even obey the soundest laws. Reality just is. What that means is that Johnny might beat the other fellow 98% of the time, but there will always be the 2% where something unplanned happens and changes the whole playing field. We plan the best we can with the knowledge we have that is both practical and reasonable. This is the purpose of science, to give us the best ability to predict what is going to happen when we do things. We even build bridges with safety factors knowing that there are going to be challenges that we could not foresee. We do have some general rules for handling tasks. You build a bridge to handle three or four times the heaviest load it is expected to handle. You build it to withstand a hurricane and flood. Then it is expected to serve until the utterly unexpected occurs, until a riverboat captain suffers a heart attack and his massive barge strikes one of the bridge supports. One general rule for planning is expect anything you plan to cost twice as much as you could predict that it should cost. And plan it take twice as long as it seems reasonable when you look at what has to be done. These generally seem to work as planning rules. There is no science that can say why such rules work, but application is practical. Such planning helps us see what to expect in performance matters when reality refuses to follow the rules and laws we think it should follow. Engineers consider something that will happen 95 out of 100 times to be reasonably certain. When they design a bridge to last 100 years, they will generally design it to withstand the highest flood expected, with 95% certainty, to occur within that period of time and to withstand the worst storm that is expected to hit within that time. For day-to-day use, the statistics are not that important. What is important is realization of chaos. Chaos is real. We can do all the planning we want, and it will not have any effect on reality. There will still be a chance of things going wrong. No matter how good our planning, there is still a chance that it will fail. This is not meant as discouragement. It is a statement of planning itself, that the planning has value, but not certainty. It is a statement that results will not always be forthcoming from actions taken. A failure to gain the desired result on the first try is not an ultimate witness to failure. It is simply the reality experienced. It is only those things that seem to fail with regularity that should be accepted as problems to solve. Johnny could not reasonably have planned for corrective action when a bug landed on his face, nor when an earthquake hit, nor when a meteor from space hit the bowling alley during his approach. Such things are chaos. They cannot be reasonably planned. The general performance rule is that you plan what you can and leave the reasonable amount of leeway for what cannot be planned. There is going to be chaos. If there is time, it will be encountered. If you need half an hour to do homework, plan an hour, and it will generally give time even with interruptions and distractions of living. If you need to turn in some assignment and have eight working hours to work on it, plan to have it completed in four hours, and it will normally be done in spite of the delays and interferences that life always seems to provide. Keep in mind this will work for you about 95 out of 100 times. The remaining five will not get done in time to turn the homework in for credit. Adults may not always know the principles of planning, but they have learned to live in the same world, and they experience the same level of chaos. This is what makes adults tolerant of us not getting everything done on time and right the first time through. The purpose of this presentation is to make you consciously aware of both the chaos of reality and the requirement and limits that this places upon us. Being aware of these, your capacity for planning is increased, and your potential for effectiveness is increased as well.


It's chiptips, chiptips, I have no music and I can't sing! Working with surface mount components is an essential skill for the maker of electronics. For one thing, some components are only available in surface mount packages, so even if you're only working with a breadboard, you'll still need to solder that thing to some kind of adapter. And when you make a printed circuit board, it's going to be a lot cheaper to use surface mount components because the circuit board is going to be smaller. And when you get that printed circuit board, you're going to want to build the circuit a little bit at a time in order to test each section. Now you could certainly use solder paste and a reflow oven in order to be able to solder an entire circuit board all at once, but that doesn't really help when you're just doing sections of one. It is possible to hand solder surface mount components, which is what I'm going to show you today. But first, you're probably going to need to give up that cup of coffee for at least an hour before you try. Probably the minimum you'll want is a magnifying lamp, preferably one with a clamp. I've seen these start at around $70 US on Amazon and the more you pay, the better they do get. Just six inches is all you'll need to get your soldering iron in the space.  Just touch it with your nose. That's right. Just touch your nose to the lens. Get right in there and touch it. Now this is my soldering iron. It's a Weller WT-CPS. It's basically temperature controlled, but you don't get to set the temperature. It's got the replaceable tips. Here are some other tips that I have. One is a chisel tip and one is a slightly thinner chisel tip. But I usually stick with the nice thin pencil tip because I do a lot of surface mount. I bought this thing like 30 years ago and it's still going strong. I did have to replace the heater in here once. I would not buy a modern Weller, by the way, because they were bought out by some company that completely cheaped out on the internal components and they're crap now. If you want to buy a soldering iron today, I would recommend a HAKO, H-A-K-K-O. Anyway, this thing heats up real fast. What I also have is never use a sponge to clean your tip because that just sucks away the heat and it causes a lot of heat shock to your tip. Instead I use this sort of, I don't know what this is, copper or brass shavings. This is also by HAKO. This is very cheap and basically all you do to clean your tip is you dip it in once and you're done. So this is pretty awesome. And the other thing that I have is solder. Now I have two different kinds of solder. These are both leaded solder. I suppose I could use non-leaded solder but I don't see why because I'm a hobbyist. I'm not an industry. So my exposure to lead is pretty much zero. This is a rosin core. So it's got the flux on it. Nevertheless, I also have a flux pen which you should use. Don't rely on the flux in the solder because that flux is not going to do a whole lot in getting rid of the oxidation that happens to printed circuit boards when you get them. More flux is better. So anyway, I've also got two different diameters. This one is .4 millimeters. This is what I use for really, really thin pins like for these SOICs. And then I've got this which is, I don't know if it actually says, yeah, it's great. It's .6 millimeters. And I use that for the larger things like for through holes. I would definitely use .6 because with .4 millimeters, you're just going to be sitting there feeding solder in forever. So I have looked at the schematic and I have determined that this capacitor, this is a hundred microfarads, goes over here on C26. C26 is connected to this pin right over here, which is plus five. So this is the plus five regulation thing. So let me zoom in a little bit again. So first what I'm going to do is I'm just going to apply a little bit of flux on there. That cleans the pads. And now for surface mount, what I do is, so this is a relatively large land. So I'm going to use the thicker solder. So what I do is I typically just put solder on one land, not a whole lot. The idea here is that if you're not using a stencil and you're not using an SMD reflow oven, basically what you can do is you can just put solder on one pin, orient your component, and just hold it down, and then heat up the land and you're done. That's it. You don't need to apply a lot of solder and you don't need to apply a lot of heat. That sticks the component down, then you can just solder the other end pretty easily, and then you can put some more solder on the first end and you're done. Now the other thing that is nice about putting flux on is that the solder will just sort of follow the flux into the pad. Sometimes if you're dealing with pins, what I actually do is apply flux to the pins and the solder actually just flows up into the pins, which is quite nice. So there's that one. Now I'm going to apply the one for 12 volts, which is a 10 microfarad capacitor on C25. So that's this guy right over here, C25. So I just have to find my 10 microfarad capacitors. These are quite big because they're electrolytics, and then I just peel this off, and it's going to be done this way. So the nice thing about surface mount electrolytics is that they have a distinctive shape on the bottom. They're not just rectangles, and I have the outline of these electrolytics on the printed circuit board to show you which direction they go. Also I put a plus in so that you know which side is plus. The electrolytics are marked with a stripe on the negative end because kind of the negative symbol is just a stripe. So there's some flux, doesn't have to be a lot. Go ahead and wet the land. Each hands, I'm not ambidextrous, but nevertheless this doesn't require a whole lot of dexterity. So there I just stuck it down, waited for it to cool, and then I am just going to fill that in on one end, and just fill it in on the other end with some more solder, and then I'm done. Usually what I would do, and here is where I would just dip this in, and now it's completely clean and shiny, so usually what I would do at this point is take this, if I were done, take this and look at it under the inspection microscope to make sure that I've soldered these things correctly. Mine is an Amscope Trinocular Inspection Microscope. It starts at about $350 US in Amazon, and if you're going to get one you need the one with the boom arm, that's really useful. In fact if I weren't doing this for you, I would solder the entire thing under the inspection microscope because then I could inspect while I solder. Let's take a look at what soldering one of these components looks like under the microscope, the inspection microscope.  So I have the component, it's flat, so I can pick it up and be reasonably certain that it's also going to maintain its flatness, and then I'm just going to place it down, and that's it. So it's a little bit wonky, but that's okay, I can maybe fix it a little bit there. So you can see that there's only a little bit of solder on one side, so now I'm going to complete the other side by taking my thin solder and doing this, and then I just add a little bit of solder on that side and we're done. This is a pretty good solder joint because there's not an excess of solder over here and there's this nice sort of slope to the sides. The solder crawls up the side of the component. I suppose you could even have it go over the component like that, but this is a pretty good solder joint. Okay, and now all that's left is this C24, which is the capacitor for the incoming minus 12 volts, and that will go to the minus 5 volt regulator. So now according to the datasheet, this is actually supposed to be either a ceramic capacitor or a tantalum capacitor for whatever reason. They don't want you using an electrolytic capacitor, so I have these one microfarad tantalum capacitors. They're 1206, that's 0.12 inches by 0.06 inches, they're 20 volts, and I think they're going to fit on the lands that was for the electrolytic capacitor. Now there is what appears to be a stripe on one side, so that would be the negative. What I'm going to do is I'm going to take a close look at it under the microscope to make sure that that's exactly what it is, or rather I'm just going to look at it under a magnifying glass and indeed it is minus, so that'll just go over there. Now on these, you can see that there are two terminals, and the terminals sort of go up the side. So these aren't like pins or anything, so you just treat them in the same way. Now of course because this is going to be regulating a negative voltage, the positive terminal is connected to ground, and the negative terminal is connected to negative 12. So I'm just going to flux that, and now I'm going to, let's see, let's use this terminal as the sticking terminal. Now this is especially important for these little components to put them down, see right now it's tilted, right? This end is going to be higher than this end, so what I'm going to do is I'm going to grab it and just press down very lightly and melt the solder and there it goes. You can feel it just go into place. Now all I have to do is do the other terminal, done, maybe add a little more solder on this terminal and done. Okay, those are the capacitors. Now for soldering chips like this one here, first I'm going to flux it right in the pads, okay, great. Now typically what I do with chips first of all is I'm going to tack down opposite corners, and the reason you want to do two corners is that with one corner the chip can still sort of rotate. So I'm just going to wet a pad, and I'm going to wet the opposite pad, okay. Now I can put the chip down, always being sure to put it down in the proper orientation. Pin one is right here because there is a line next to it, so I just need to flip this around, and then just place it on there. So here I'm just going to hold it in place, and then just push down on the one pin, and then gently pressing down on the chip, I'm going to push down on the other pin, and then I'm going to push down on the chip again and reflow the first pin. So that ensures that the chip now is completely flat and in place. Now in terms of all the pins, first of all again I'm going to flux its pins, and again you can't have too much flux. Now I know that some people use a drag technique to just sort of put a blob of solder on their soldering iron and then just drag it across, and that does tend to work for lots and lots of pins. For this, I mean it's just as easy to just go and solder each one individually, especially when you're using thin solder. Now if I were to drag across here, like let's suppose I just put a lot of solder here, and then just drag across, see that works except with the thin solder I just don't have enough solder on it to make that technique very effective. So that's it, I mean it's just as fast to solder every individual pin rather than drag solder and then have to maybe go back and break some bridges. So that's that. So I can try another chip now with, maybe I can use the drag technique with some thicker solder, maybe that's the problem here. So first flux the pads to get them nice and clean. Second of all, figure out what U4 is. So first I'm going to do opposite corners with a thin solder because you don't need too much. Then I'm going to identify pin 1, that's down here, I'm going to make sure that my chip is oriented in the correct direction, so it's like this, and then I'm just going to hold it in place and tack down one end, push down the other end, and push down the first end again. Okay great, now this is secured. So now I'm going to get my thick solder and see if that actually makes a difference. Yeah that did kind of work, lob some solder on and then just, I guess I didn't have enough solder on, see I tend to just sort of dip the solder in and then not get enough solder for the drag technique, but that sort of worked. Either way, it's chip tips, chip tips, I have no music and I can't sing. Get right in there and touch it.


Anderson and he's giving a talk to us today. And the title is what price the upload filter from Cold War to Crypto Wars and back again. And we're very happy that he's here today. And for our non English speaking public, we have translations. These are talk but on German. And this conference is translated in French as well. Yeah. Ross, ready to start? Let's go. Have a good have a good time. Enjoy. Yes, ready to go. Thanks. Okay. As the as has been said, I'm Ross Anderson. And I'm in the position of being one of the old guys of this field and that I've been involved in the Crypto Wars right from the start. And in fact, even since before the clipper chip actually come out, if we could go to the slides, please. Right. Can we see the slides that had supplied the US armed forces? And guess what happened? Well, in the 1950s, Boris Hagelin, who'd set up that company, secretly sold it to the NSA. And for a number of years, quite a lot of years, countries as diverse as Latin America and India and even NATO countries such as Italy, were buying machines from Crypto Argue, which the NSA could decipher. And this had all sorts of consequences. For example, it's been revealed fairly recently that Britain's success against Argentina in the Fortress War in 1982 was to a large extent due to signals intelligence that came from these machines. So next slide, please. And in this prehistory of the Crypto Wars, almost all the players between governments, there was very little role for civil society. There was one or two journalists who were engaged in trying to map what the NSA and friends were up to. As far as industry was concerned, well, at that time I was working in banking. And we found that encryption for confidentiality was discouraged. If we tried to use line encryptors, then false mysteriously appeared on the line. But authentication was okay. We were allowed to encrypt thin pad, thin blocks, and we were allowed to put max and messages. There was some minor harassment. For example, when Revesh Shamir and Adelman came up with their encryption algorithm, the NSA tried to make it classified, but the provost of MIT, Jerome Weissner, persuaded them not to make that fight. The big debate in the 1970s, though, was whether the NSA affected the design of the data encryption standard algorithm. And we know now that this was the case. It was designed to be only just strong enough. And we're definitely predicted back in the 1970s that 2 to the power 56 key search would eventually be feasible. The EFF built a machine in 1998. And now, of course, that's fairly easy because each Bitcoin block costs 2 to the power 68 calculations. Next slide, please. So where things get interesting is that the NSA persuaded Bill Clinton in one of his first cabinet meetings in 1993 to introduce key escrow, the idea that the NSA should have a copy of every of these keys. And one of the people at that meeting admitted there so that President Bushley Elder had been asked and had refused that Clinton, when he got into office, was naive and thought that this was an opportunity to fix the world. Now, the critical trip which we can see here was tamper resistance and had a secret block site for an NSA backdoor key. And the launch product was an AT&T secure phone. Next slide, please. Now, the clipper protocol was an interesting one in that each chip had a unique secret key KU and a global secret family key K NSA burned in. And in order to send data to Bob, Alice had to send her clipper chip a working key KW, which is generated by some external means such as a Diffie Helm and key exchange. And it made up a law enforcement access field, which was basically Alice and Bob's names with the working key encrypted under the unit key, and then a hash of the working key encrypted under the NSA key. And that was sent along with the Cypher text to make authorize while tapping easy. And the idea with the hash is that this would stop cheating. Bob's clipper chip wouldn't use a working key unless it came with a valid leaf. And I can remember a few of us can still remember the enormous outcry that this caused at the time. American companies in particular didn't like it because they started losing business to foreign firms. And in fact, a couple of our students here at Cambridge started a company and Cypher that proved to be quite large because they could sell worldwide unlike US firms. People said, why don't we use encryption software? Well, that's easy to write, but it's hard to deploy at scale as Phil Zimmerman found with PGP.  A secondary concern was whether, you know, how on earth would we know if government designs are secure? Why not should you trust the NSA? Next slide, please. Well, the first serious fight back in the crypto wars came when Matt Blaise of Bell Labs found an attack on Clipper. He found that Alice could just try lots of leaves until one of them works because the tag was only 16 bits long and it turned out that 2 to the power 112 of the 2 to the power 128 possibilities work. And this meant that Alice could generate a bogus leaf that would pass inspection, but which wouldn't decrypt the traffic. And Bob could also generate a new leaf on the fly so you could write non interoperable rogue applications that the NSA had no access to. And with a bit more work, you could make rogue applications interoperate with official ones.  Next slide, please. Okay, so why don't people just use software? Well, at that time, the US had export controls on intangible goods such as software, although European countries generally didn't. And this meant that US academics couldn't put crypto code online, although we Europeans couldn't. We did. And so Phil Zimmerman achieved fame by exporting PGP, pretty good privacy, some encryption software he'd written from America as a paper book. And this was protected by the trust amendment. So they sent it across the border to Canada, they fed it into an optical character recognition scanner, they recompiled it, and the code had escaped. For this, Phil was subjected to a grand jury investigation. There was also the Bernstein case around code as free speech, and Bruce Schneier rose to fame with his book, Applied Cryptography, which had protocols, algorithms and source code in C, which you could type in in order to get cryptographic algorithms anywhere. And we saw export controlled clothing. This t-shirt was something that many people wore at the time. I've actually got one, and I plan to wear it for this, but unfortunately, I come into the lab in order to get better connectivity, and I left it at home. So this t-shirt has got an implementation of RSA written in parallel, plus a barcode so that you can scan it in.  So by these means, people probed the outskirts of what was possible, and an awful lot of fun was had. It was a good laugh to tweak the Tyrannosaurus tail. Next slide. But this wasn't just something that was limited to the USA. The big and obvious problem, if you try and do kiasco in Europe, is that there's dozens of countries in Europe. And what happens if someone from Britain, for example, has got a mobile phone that they bought in France with a German SIM card, and they're standing on the street in Stockholm, and they found somebody who's in Budapest, who's got a Hungarian form of the Spanish SIM card in it, then which of these countries, secret police forces, should be able to listen to the call? And this was something that stalled the progress of kiasco, if that's a good way to describe it in Europe. And in 1996, GCHQ got academic colleagues at Royal Holloway to come up with a proposal for public sector email, which they believe would fix this. Now, at the time, after Clipper had fallen into disrepute, the NSA's proposal was that also certification authority should have to be licensed, and that this would enforce a condition that all private keys would be escrowed. So you would only be able to get a signature on your public key if the private key was held by the CA. And the idea is that you'd have one CA for each government department, and civilians would use trusted firms like Barclaysbank or the Post Office, which would keep our keys safe. And it would also work across other EU member states so that somebody in Britain calling somebody in Germany would end up in a situation where a trustworthy CA, from the NSA's point of view, that is an untrustworthy CA from our point of view, in Britain would be prepared to leak a key, and so would one in Germany. This at least was the idea. So how did we do this? Next slide on the GCHQ protocol. So here's how it was designed to work in the UK government. If Alice at the Department of Agriculture wants to talk to Bob at the Department of Business, she asks her departmental security officer, DA, for a SEM key for herself, and a receive key for Bob. And DA and DB get a top level interoperability key, KTAB, from GCHQ. And DA calculates a secret SEM key of the day as a hasher of KTAB and Alice's name and the DSO's identity for Alice, which you give us to Alice. And similarly, a public receive key of the day for Bob. And Alice sends Bob her public SEM key along with the encrypted message, and Bob can go and get go to his DSO and get his secret receive key of the day. Now, this is slightly complicated. And there's all sorts of other things are wrong with it once you start to look at it. Next slide, please. The first is that from the point of view of the overall effect, you could just as easily have used carboros, because you've basically got a key distribution center at both ends, which knows everybody's keys. So you've not actually gained very much by using complicated public key mechanisms. And the next problem is, what's the law enforcement access need for centrally generated signing keys? If this is actually for law enforcement rather than intelligence, while the police want to be able to read things, not forge things. A third problem is that keys involve hashing department names. And governments are changing the name of their departments all the time as the Prime Minister of the day moves his ministers around and they chop and change departments. And this means, of course, that everybody has to get new cryptographic keys and suddenly the old cryptographic keys don't work anymore. And those are horrendous complexity comes from this. Now, there are about 10 other things wrong with this protocol. But curiously enough, it's still used by the UK government for the top secret stuff. It went through a number of iterations. It's now called Mikey Saki, those details in my security engineering book. And it turned out to be such a pain that the stuff below the top secret now just uses a branded version of G Suite. So if what you want to do is to figure out what speech Boris Johnson will be making tomorrow, you just have to guess the password recovery questions for his private secretaries and officials. Next slide, the global internet trust register. This was an interesting piece of fun we had around the 1997 election when Tony Blair took over and introduced a labor government before the election. Labor promised to not seize crypto keys involved without a warrant. And one of the first things that happened to him once he was in office is Vice President Al Gore went to visit him. And all of a sudden Tony Blair decided that he wanted all certification authorities to be licensed and they were about to rush this through Parliament. So we put all the important public keys in a paper book and we took it to the cultural secretary, Chris Smith, and we said, you're the minister for books. So why are you passing a law to ban this book? And if you'll switch to the video shot, I've got the initial copy of the book that we just put together on the photocopying machine in the department. And then we sent the PDF off to MIT and they produced it as a proper book. And this means that we had a book, you know, which is supposedly protected. And this enabled us to get the topic onto the agenda for cabinet discussion. So this at least stopped precipitous action. We ended up with a regulation of investigatory powers bill in 2000 that was far from perfect. But that was a longer story. So what happened back then is that we set up an NGO, a digital rights organization, the Foundation for Information Policy Research. And the climate at the time was such that we had no difficulty raising a couple of hundred thousand pounds from Microsoft and Hewlett Packard and Redbus and other tech players. So we were able to hire Casper Bowden for three years to basically be the director of FIPPA and to lobby the government hard on this. Now, if we can go back to the slides, please, and go to the next slide, the slide on bringing it all together. So in 1997, a number of us, Hal Abelson and I, and Steve Bellifin and Josh Benelow from Microsoft and Matt Blaise, a broken clipper and Whit Diffie, who'd invented digital signatures and John Gilmer of EFF, Peter Nyman of SRI, Ron Rivest and Jeff Schiller of MIT and Bruce Schneier had written applied cryptography, got together and wrote a paper on the risks of key recovery, key escrow and trust in third-party encryption. Where we discussed the system consequences of giving third-party or government access to both traffic data and content without user notice or consent deployed internationally and available around the clock. We came to the conclusion that this was not really doable. It brought in simply too many vulnerabilities and too many complexities. So how did it end? Well, if we go to the next slide, the victory in Europe wasn't as a result of academic argument. It was a result of industry pressure. And we owe a debt to Commissioner Martin Bangaman and also to the German government who backed him. And in 1994, Martin had put together a group of European CEOs to advise him on internet policy and they advised him, keep your hands off until we can see which way it's going. Let's just run with this thing and see what we can do with it. And the thing that he developed in order to drive a stake through the heart of key escrow was the electronic signatures directive in 1999. And this gave a rebuttable presumption of validity to qualifying electronic signatures but subject to a number of conditions. And one of these was that the signing key must never be known to anybody else other than the signer. And this killed the idea of licensing CAs in such a way that the NSA had access to all the private key material. The agencies had argued that without controlling signatures, you couldn't control encryption. But, of course, as intelligence agencies, they were as much interested in manipulating information as they were in listening into it. And this created a really sharp conflict with businesses. In the UK, we had a regulation of Investigators Repairs Bill went through the following year. And there we got strong support from the banks who did not want the possibility of intelligence and law enforcement personnel either getting hold of bank keys or forging banking transactions. And so we managed with their help to insert a number of conditions into the bill, which meant that if a corp or a chief constable, for example, demands a key from a company, they got to demand it from somebody at the level of a director of the company. And it's got to be signed by someone really senior such as a chief constable. So there were some controls that we managed to get in there. Next slide. What did victory in the USA look like? Well, in the middle of 2000, there's a number of people who had predicted Al Gore decided that he wanted to stop fighting the tech industry in order to get elected president. And there was a deal done at the time which was secret. It was done at the FBI headquarters at Cranteco, where my US law enforcement would rely on naturally occurring vulnerabilities rather than compelling their insertion by companies like Intel or Microsoft. Now, this was secret at the time. And I happened to know about it because I was consulting for Intel. And the NDA I was under had a four year time limit on it. So after 2004, I was at liberty to talk about this. And so this basically gave the NSA access to the cert feed. And so as part of this deal, the export rules were liberalized a bit with various hooks and gotchas left so that the authorities could bully companies who got too difficult. And in 2002, Robert Morris senior, who had been the chief scientist at the NSA, at much of this period admitted that the real policy goal was to ensure that the many systems developed during the dot com boom were deployed with weak protection or none. And there's a huge long list of these. Next slide, please. So what was the collateral damage from crypto war one? This is the first novel part of this talk, which I've got together as a result of spending the last academic year writing the third edition of my book on security engineering. As I've gone through and updated all the chapters on car security, door lock security and web security and so on and so forth. We find everywhere that there are still very serious costs remaining from crypto war one. For example, almost all of the remote key entry systems for cars used inadequate cryptography per random number generators and so on and so forth. And car theft has almost doubled in the past five years. This is not all due to weak crypto, but it's substantially due to a wrong culture that was started off in the context of the crypto wars. Second, there are millions of door locks still using my fair classic, even the building where I work, for example. The University of Cambridge changed its door locks around 2000. So we've still got a whole lot of my fair classic around. And it's very difficult when you've got 100 buildings to change all the locks on them. And this is the case with thousands of organizations worldwide with universities with banks with all sorts of people simply because changing all the locks at once and dozens of buildings is just too expensive. Then, of course, as a CA in your browser, most nations own or control certification authorities that your browser trusts. And the few nations that weren't allowed to own such CAs such as Iran, but up to mischief, as we found in the case of the digital tar hack a few years ago. And this means that most nations have got a more or less guaranteed ability to do man in the middle attacks on your web logons. Now, some companies like Google have, of course, started to fix that with various mechanisms such as certificate pinning, but that was a deliberate vulnerability that was there for a long, long time and is still very widespread. Phones, 2G is insecure. That actually goes back to the Cold War rather than the Crypto War. But thanks to the Crypto Wars, 4G and 5G are not very much better. The details are slightly complicated. And again, they're described in the book. Bluetooth is easy to hack. That's another piece of legacy. And as I mentioned, the agency's own the search responsible disclosure pipeline, which means that they get a free, far hose of zero days that they can exploit for perhaps a month or three before these end up being touched. Next slide, please. Last year when I talked at the Chaos Communications Congress, the audience chose this as the cover for my security engineering book, and that's now out. And it's the process of writing this that brought home to me the scale of the damage that we still suffered as a result of Crypto War One. So let's move on to the next slide and the next period of history, which we might call the War on Terror. And I've arbitrarily put this down as 2000 to 2013, although some countries stopped using the phrase War on Terror in about 2000 and head once we have got rid of George W. Bush and Tony Blair. But that's a historical convenience. This is, if you like, the central period in our tale. And it starts off with a lot of harassment around the edges of security and cryptography. For example, in 2000, Tony Blair promoted the EU dual use regulation number 1334 to extend export controls from tangible goods, such as rifles and tanks to intangibles such as crypto software, despite the fact that he had basically declared peace on the tech industry. Two years later in 2002, the UK Parliament bolted an export control bill that was going to transpose this because it added controls on scientific speech, not just crypto code, but even papers and crypt analysis and even electron microscope scripts. And so Parliament inserted a research exemption clause at the argument of the then president of the Royal Society, Sir Robert May. But what then happened is that GCHQ used EU regulations to frustrate Parliament. This pattern of extra legal behaviour was to continue. Next slide. Because after export control, the play shifted to traffic data retention. Another bad thing that I'm afraid to say the UK exported to Europe back in the days when we were, in effect, the Americans conceivably airy on the European Council. Sorry about that folks, but all I can say is at least we helped start EDRI a year after that. So one of the interesting aspects of this was that our then Home Secretary, Jackie Smith, started talking up the need for a comms database, a database of all the metadata of who had flown whom when, who had sent an email to whom when, so that the police could continue to use the traditional contact tracing techniques online. And the line that we got hammered home to us again and again and again was if you've got nothing to hide, you've got nothing to fear. What then happened in 2008 is that a very bad person walked into Parliament and went to the PC where the expense claims of MPs were kept. And they copied all the expense claims onto a DVD and they hopped it around Fleet Street until the Daily Telegraph bought it from them for £400,000. And then from the best part of the year, the Daily Telegraph was telling scandalous things about what various members of Parliament had claimed from the taxpayer. And it turned out that author Jackie Smith may have been innocent. Her husband had been downloading pornography and charging it to her parliamentary expenses. So she lost her job as Home Secretary and she lost her seat in Parliament and the communications data bill was lost. So was this a victory? Well, in June 2013 we learned from Ed Snowden that they just built it anyway despite Parliament. So maybe the victory in Parliament wasn't what it seemed to be at the time. But I'm getting ahead of myself. Anyway, next slide please. The other thing that we did in the 2000s is that we spent, I spent maybe a third of my time and about another 100 people joined and we developed the economics of security as a discipline. We began to realise that many of the things that went wrong happened because Alice was guarding a system and Bob was paying the cost of failure. For example, if you've got a payment system then in order to prevent fraud, what you basically have to do is to get the merchants and the banks who buy transactions from them to take care. But the costs of fraud fall on the car holder and on the banks who issue them with cards and the two aren't the same. And it's this that causes the governance tensions and causes governance to break down and makes fraud higher than it should be. Now after that one of the early topics was patching and responsible disclosure. And we worked through all the issues of whether you should not patch at all, which some people in industry wanted to do or whether you should just put all the bugs on bug track as some hackers wanted to do or whether you would go through the cert system despite the NSA compromise because they at least would give you legal cover and would be Microsoft into patching the bug at the next patch Tuesday and would then do disclosure after 90 days. And we eventually came to the conclusion as an industry followed that responsible disclosure was the way to go. Now one of the problems that arises here is the equities issue. Suppose you're the director of the NSA and somebody comes to you with some super new innovative bug, say they had prediscovered Spectre for example. And so you're going to bug which can be used to penetrate any crypto software that's out there. Do you report the bug to Microsoft and Intel to defend 300 million Americans? Or do you keep it quiet so you can exploit 450 million Europeans and 1,000 million Chinese and so on and so forth? Well once you put it that way it's fairly obvious that the NSA will favor attack or a defense. And there are multiple models of attack and defense. You can think of institutional factors and politics. For example, if you're the director of the NSA and you defend 300 million Americans, you defend the White House against the Chinese hacking it. You know, the president will never know if he's hacked or not because the Chinese will keep it quiet if they do. But if on the other hand you manage to hack the Politburo land in Peking, you can put some juicy intelligence every morning with the president's breakfast cereal. So that's an even stronger argument of why you should do attack rather than defense. Another thing that I'll mention in passing is that throughout the 2000s governments also scrambled to get more data on their citizens. For example in Britain we'd a long debate about whether medical records should be centralized. In the beginning we said if you were to centralize all medical records that would be such a large target that the database should be top secret and it would be too inconvenient for doctors to use. Well Blair decided in 2001 to do it anyway. We wrote a report in 2009 saying that this was a red line, that this was a serious hazard. And then in 2014 we discovered that Cameron's buddy who was the transparency star in the NHS had sold the database to 1200 researchers including drug companies in China. So that meant that all the sensitive personal health information about 1 billion patient episodes you know had been sold around the world and was available to not just to medical researchers but to foreign intelligence services. Now this brings us on to Snowden. In June 2013 we had one of those game changing moments when Ed Snowden leaked a whole bunch of papers showing that the NSA had been breaking the law in America and GCHQ had been breaking the law in Britain that we had been lied to that Parliament had been misled and a whole lot of collection and interception was going on which supposedly shouldn't have been going on. Now one of the things that got industry attention was a system called Prism which was in fact legal because this was in you know done as a result of warrants being served on the major internet service providers. And if we can move to the next slide we can see that this started off with Microsoft in 2007, Yahoo in 2008 they fought it in court for a year they lost and then Google and Facebook and so on got added and this basically enabled the NSA to go to someone like Google and say Ross J Anderson at gmail.com is a foreign national river for entitled to read his traffic kindly give us his Gmail and Google would say yes sir for Americans you have to show probable cause that they've committed a crime for foreigners you simply have to show probable cause that they're a foreigner and next slide this disclosure from Snowden disclosed that Prism despite the fact that it only cost about 20 million dollars a year was generating something like half of all the intelligence that the NSA was using by the end of financial year 2012 but that was not all next slide please the thing that really annoyed Google was this slide on a deck from a presentation at GCHQ showing how the NSA was not really connecting stuff through the front door by serving warrants and Google in Mountain View it was collecting stuff through the back door as well because they were harvesting the plain text copies of Gmail and maps and docks and so on which were being sent backwards and forwards within Google's different data sensors and the little smiley face which you can see on the sticky got Sergey and friends really really uptight and they just decided right you know you know we're not going to allow this they will have to knock and show warrants in the future and there was a crash program at all the major internet service providers to encrypt all the traffic and so that in future things could only be got by means of a warrant. Next slide please the EU was really annoyed by what was called Operation Socialist. Operation Socialist was basically the hack of Belgium and the idea was that GCHQ spearfished some technical staff at Belgium and this enabled them to wartap all the traffic at the European Commission in Brussels and you know as well as mobile phone traffic to and from various countries in Africa and this is rather amazing it's as if Nicola Sturgeon the First Minister of Scotland had tasked Police Scotland with hacking BT so that she could wartap what was going on with the Parliament in London so this annoyed a number of people. With the next slide we can see that the Operation Bull Run and Operation Edge Hill as GCHQ called their version of it have been aggressive multi-pronged efforts to break widely used internet encryption technologies and we learned an awful lot about what was being done to break VPNs worldwide and what had been done in terms of inserting vulnerabilities in protocols getting people to use vulnerable prime numbers for Diffie Helm and Key Exchange and so on and so forth. Next slide thrust slide and Bull Run and Edge Hill SIGINT enabling project actively engages the US and foreign IT industries to cover the influence and or overtly leverage their commercial products designs these design changes make the systems in question exploitable through SIGINT collection endpoint midpoint etc with formality of the modification so the consumer and other adversaries however the system security remains intact. Next slide so the insert vulnerabilities into commercial systems IT systems networks endpoint communication devices used by targets. Next slide and they also influence policy standards and specifications for commercial public key technologies and this was the smoking gun that crypto war one had not actually ended it had just gone undercover and so with this things come out into the open. Next slide so we could perhaps date crypto war two so the Snowden disclosures in their aftermath in America it must be said that all three arms of the US government showed at least mild remorse Obama set up the NSA review group and adopted most of what it said except on the equities issue Congress dropped data retention where it renewed the Patriot Act and the FISA court introduced an advocate for targets tech companies as I mentioned starting started encrypting all their traffic in the UK on the other hand government express no remorse at all and they passed the investigatory powers act and legalize all the unlawful things it already been doing and they can now order from secretly to do anything they physically can however data retention was nixed by the European courts the academic response in the next slide keys under door mats much the same authors as before we analyzed the new situation and came to much of the same conclusions next slide the 2018 gch cube proposals from Ian Levy and Crispin Robinson proposed to add ghost users to what's happened facetime calls in response to warrants the ideas that you've got an FBI key on your device key ring you still have end-to-end crypto you just have an extra end and this of course fills the keys under door mats tests your software would abandon best practice it would create targets and increase complexity and it would also have to lie about trust next slide please this brings us to the upload filters which were proposed over the past six months they first surfaced in early 2020 for you stand from think tank and they were adopted by Commissioner Yulva Johansson on June the ninth start of the German presidency on the 20th of September we got a leaked tech paper whose authors include our GCHQ friends Ian Levy and Crispin Robinson the top options are that you filter in client software assisted by a server as client side only filtering is too constrained and easy to compromise the excuse is that you want to stop illegal materials such as child sex abuse images being shared over end-to-end messaging systems such as whatsapp various NGOs objected and we had a meeting with the commission which was a little bit like a Stockholm syndrome event we had one official there on the child protection front thanks by half a dozen officials from various security bodies departments and agencies who seem to be clearly driving the thing with child protection merely being an excuse so where might this lead well the obvious things to worry about are as a similar language in the new terror regulation you can expect the filter to extend from child sex abuse material to terror and static filtering won't work because if there's a bad list of 100 000 forbidden images then the bad people will just go out and make another 100 000 child sex abuse images so the filtering will have to become dynamic and then the question is whether your phone will block it or report it and there's an existing legal duty in a number of countries and in the UK too although this is obviously no longer a member state an existing duty to report terror stuff and the question is who will be in charge of updating the filters what's going to happen then next slide well we've seen an illustration during the lockdown in April the French and Dutch government sent an update to all anchor chat mobile phones with a root kit which copied messages crypto keys and lock screen passwords the anchor chat was a brand of mobile phone that was sold through underground channels to various criminal groups and others and since this was largely used by criminals of various kinds the UK government justified bulk intercepts by passing it off as targeted equipment interference in other words they brought a targeted warrant for all 45 000 anchor chat handsets and of 10 000 users in the UK 800 were arrested in June when the white tapping exercise was completed now again this appears to ignore the laws that we have on the books because even our investigatory paris act rules out bulk interception of UK residents and those who follow such matters will know that there was a trial at Liverpool Crown Court a hearing of whether this stuff was admissible and we should have a first verdict on that early in the new year then that will no doubt go to appeal and if the material is held to be admissible then there will be a whole series of trials so this brings me to my final point what can we expect going forward China is emerging as a full stack competitor to the west not like russia and cold war one because russia only ever produced things like primary goods like oil and weapons and trouble of course but china is trying to compete all the way up and down the stack from chips through software up through services and everything else and developments in china don't exactly fill one with much confidence because in march 2018 president Xi declared himself to be ruler from life basically tearing up the chinese constitution there are large-scale state crimes being committed in Tibet and Sinki and elsewhere just last week britain's chief rabbi described the treatment of Uyghurs as an unfallable unfallable mass atrocity in my book i describe escalating cyber conflict and various hacks such as the hack of the office of personnel management which had clearance files on all americans who work for the federal government the hack of Equifax which got credit ratings and credit histories of all americans and there are also growing tussles and standards for example the draft isaac 27 double five three and biometric authentication from mobile phones is introducing at the instance of chinese delegates a central database option so in future your phone might not verify your face print or your fingerprint locally it might do it with a central database next slide how could call war 2.0 be different well there's a number of interesting things here and the purpose of this talk is to try and kick off a discussion of these issues china makes electronics not just guns the way the old uss r did can you have a separate supply chain for china and one for everybody else but hang on a minute consider the fact that china has now collected very substantial personal data sets on the office of personnel management they got us government employees by forcing apple to set up its own data centers in china for iphone users in china they get access to all the data for chinese users of iphones that america gets for american users of iphones plus maybe more as well if the chinese can break the hsm's and chinese data centers as we expect they would be able to equifax got them data on all economically active people in the usa carried out data gave them medical records of everybody in the uk and this bulk personal data is already being targeted in intelligence use when western countries for example send diplomats to countries in africa or latin america the local chinese counterintelligence people know whether they're bona fide diplomats or whether they're intelligence agents undercover why from exploitation of all this bulk personal information now given that this information is already in efficient targeted use the next question we have to ask is when will it be used at scale and this is the point at which we say that the equities issue now needs a serious rethink and the whole structure of the conflict is going to have to move from more offensive to more defensive because we depend on supply chains to which the chinese have access more than they depend on supply chains to which we have access now it's dreadful that they were headed towards a new cold war but as we had there we have to ask also the respective roles of governments industry and civil society academia next slide please and so looking forward my point is this that if cold war 2.0 does happen i hope it doesn't but we appear to be headed that way despite the change of government in the white house then we need to be able to defend everybody not just the elites now it's not going to be easy because there are more set players the usa is a big block the eu is a big block there are other players other democracies there are other non democracies there's other failing democracies it's going to be complex and messy it isn't going to be a situation like last time where big tech reaches out to civil society and academia and we get a united front against the agencies and even in that case of course the victory that we got was only an apparent victory a superficial victory that's only lasted for a while so what can we do well at this point i think we need to remind all the players who listen but it's not just about strategy and tactics but it's about values too and so we need to be firmly on the side of freedom privacy and the rule of law now for the old timers you may remember that there was a product called tom skype which was introduced in 2011 in china the chinese wanted the citizens to be able to use skype but they wanted to be able to wiretap it as well despite the fact that skype had the time at end-to-end encryption and so people in china were compelled to download a client for skype called tom skype tom was the company that distributed skype in china and it basically had built-in wiretapping so you had end-to-end encryption using skype in those days but in china you ended up having a trojan client which you had to use and what we are doing at the moment is basically that the eu is trying to copy tom skype and saying that we should be doing now what china was doing eight years ago and i say we should reject that we can't challenge president she by going down that road instead we've got to reset our values and we've got to think through the equities issue and we've got to figure out how it is that we're going to deal with the challenges of dealing with non-democratic countries when there is serious conflict in a globalised world where we're sharing the same technology thanks and perhaps the last slide for my book can come now and i'm happy to take questions yeah thanks a lot ross for your talk it's a bit depressing to listen to you i have to admit let's have a look okay so i have a question i'm wondering if the export controls at EU level became worse than UK level export controls because entities like gchq had more influence there or because there's a harmful franco-german security culture or what it was do you have anything on that well the experience that we had with these export controls once they were in place was as follows it was about 2015 i think or 2016 it came to our retention that a british company um sophos was selling bulk surveillance equipment to president our asset of syria and he was using it to basically what happens into our population and decide who he was going to arrest and kill the following day and it was sold by sophos in fact through a german subsidiary and so we went along to the export control office in in victoria street a number of NGOs the open rights group went along and privacy international and us and one or two others and we said look according to the EU dual use regulation right bulk intercept equipment is military kit it should be on the military list therefore you should be demanding an export license for this stuff and they found every conceivable excuse um you know not to demand it and it was the lady from gchq there in the room who was clearly calling the shots and she was absolutely determined that there should be no export controls on the stuff being sold to syria and eventually i said look it's fairly obvious what's going on here if there's going to be black boxes and president our assets network you want them to be british black boxes or german black boxes not ukraine you know israeli black boxes and she said i cannot discuss classified matters in an open meeting which is as close as you get to an admission and um a couple of months later angela maracle to her great credit actually come out in public and said that allowing the equipment to be exported from uti marco to syria was one of the hardest decisions she had ever taken as chancellor um and there's a very difficult trade-off between maintaining intelligence access given the possibility that western troops would be involved in syria and um the fact that the the kit was being used for very evil purposes so that that's an example of how the export controls are used in practice they are not used to control the harms that we as voters are told that they're there to control right they're used in all sorts of dark and dismal games and we really have to tackle the issue of export controls with our eyes open yeah yeah there's a lot a lot to do and now germany has left the uh u uh u n security council so let's see what happens next um yeah we'll see ross anything else you'd like to add we don't have any more questions oh no we have another question it's just come up second good do you think that refusal to accept backdoors will create large uncensorable applications well if you've got large applications um which are associated with significant economic power um then you know pressure gets brought to bear in those economic players to you know do their social duty um and this is what we have seen with the platforms that intermediate content uh the actors content intermediaries such as facebook and google and so on that they do a certain amount of filtering um but if on the other hand you have wholesale um surveillance before the fact of end-to-end encrypted stuff then are we moving into an environment um or a private speech from one person to another is no longer permitted you know i i don't think that's the right trade-off that we should be taking um because we all know from hard experience that when governments say think of the children they're not thinking of children at all if they were thinking of children they would not be selling weapons to Saudi Arabia and the united arab emirates to kill children in the yemen and they say think about terrorism but the the censorship that we are supposed to use in universities around terrorism the so-called prevent duty is is known to be counterproductive it makes Muslim students feel alienated and marginalised so the arguments that governments use around this are not in any way honest and we now have 20 years experience of these dishonest arguments and for goodness sake let's have a more grown-up conversation about these things now you're totally right even if i have to admit it took me a couple of years not 20 but a lot to finally understand okay i think that's it we just have another comment and i'm thanking you for your time and um are you in an assembly somewhere around hanging around in the next hour or so maybe if someone wants to talk to you he can just pop by if you ever if you if you have used this 2d world already no i i haven't been using the 2d world um i had some um issues with my browser and getting into it but um you know i've got my my web page and my email address is public and anybody who wants to discuss these things is welcome to get in touch with me all right so thanks a lot thank you for the invitation yeah thanks a lot


Well, ST Microelectronics is a very well-known brand and they give us access to very valuable customers that would have been extremely difficult to reach on our own. Our solution, NanoAGI Studio is very complementary to ST Microelectronics offerings, which give us the ideal framework to showcase our solution with a worldwide market leader of microcontrollers. It's a great opportunity to be part of the ST Partner Programme. It raises visibility for us. Between partners, we combine our expertise in order to offer a global solution. The ST Partner Programme provides us with a close collaboration with technical teams and a co-marketing strategy which has been very beneficial.