Thanks everybody for being here with us today. We're thrilled to be doing this great panel here at DEFCON with the ICS Village. Thanks to Bryson Bort for inviting us to do this. My name is Jamil Jaffer. I'm the founder and executive director of the National Security Institute at George Mason University's Antonin Scalia Law School. We're thrilled again to be here and talking today about the topic. Your infrastructure is encrypted, protecting critical infrastructure for brands and where we have a terrific panel of folks with us today, sort of going around the horn from my left to right. We've got Jen DeTroni, the general counsel at NYSOS, the management intelligence company helping enterprises identify adversaries and related threats. Jen has volunteered for every year at DEFCON for a number of years. She's been a federal prosecutor. She's run a solo law practice and worked to the top law firm practicing commercial law. When she's been at DEFCON, she's been teaching kids how to be white-hat hackers through a nonprofit. She's been a member of the executive leadership team at Sun Law and Non-profit Organization, a dedicated helping advanced female and house counsel. She's a graduate of Dartmouth College of Michigan Law School, and she's grown up in the DC area, but she calls Southern California her home now. So, Jen, thanks for being here with us. We also have Ernie Bio. Ernie is an investor with Forge Point Capital. He is previously served as the Chief Operating Officer for the Defense Innovation Unit at DOD, a government startup in the Silicon Valley. He's a board member of Hunter's Labs and board observer at Bishop Fox, now secure in Bayshore Networks. He has an MBA from NYU Stern School and a BS in cellular and molecular biology from Loyola University. So, we're thrilled to have you here, Ernie. He's an avid surfer and guitarist and a music enthusiast too. So, keep an eye out for that. And last but certainly not least, we have David Etto, good friend of mine. He's the Chief Executive Officer at NISO. He's got 20 years of experience at early stage of mature companies. He previously served as the Global Head of Managed Security Services at Blue Boyant, and the VP of Managed Services at Rapid 7. He was the VP of BD at Jamalto. And is now part of, was also part of, led the Cybertree Enterprise at PRTM, which is now part of PWC. He's had a number of other awesome positions. He's also a certified information privacy professional, a certified CISO, and a graduate of GE's Information Management Leadership Program. So, David, great to have you here with us also. So, folks, we've got a great panel, and off we go to the races. So, I'll start with you, Jen. So, you know, we've heard a lot about RAN somewhere in the last few weeks and months, we've seen the attack on the colonial pipeline. We've seen the attack on Kaseya. We've seen a variety of things, JBS, the meat packer. And we've seen the Biden administration do a number of big things, including two now executive orders in a row. Talk to us about what those executive orders do.  Talk to us about what those executive orders are gonna be effective at helping protect the nation from ransomware. And if they're not, what are they doing that's helpful and what more needs to be done? Yeah, great question. And thanks for having me, and also thanks to ICS for having us. This is a great panel. So, yeah, I think what's interesting is that we're seeing a lot of leaning into the situation from that level. And that is very, very different than what we've seen in the past. I know in the past, we've looked at things in a task force manner. Here, we're seeing DHS actually kind of pushing through in a manner of sprints. And these sprints are really meant to address issues that are topical. They're not going to kind of get to the bottom of every issue, but they're forcing the industry to look at things kind of in a cadence. Recently, we've seen the ransomware sprint that came out, that was April and May. But right now, I think we're in the industrial control systems sprint. And that is a very critical one because as we saw with the colonial pipeline, it is very important that we protect the country against like any sort of infrastructure being shut down. And that's where I think, this panel has some great topics ahead of it because we're looking at how, it's a public-private collaboration, I think that is very novel in this approach. As somebody who's kind of practiced in both areas, I think it's really heartening to see that sense of collaboration. It's always been there, right? With law enforcement, there's kind of a sense of kind of poking around to see who's friendly. Now I think what these executive orders are doing is basically saying start talking, right? And so with this sense that zero trust is gonna be the overarching like theme of private and public sector. And with some definitive controls around trying to require to factor or multi-factor identification, trying to segment out networks, there is a sense that both private and public sector are meant to get better with this approach. And it's kind of fun to watch. Yeah. So David, you've been doing some of this stuff operationally, right? Back in the past in your time at Rapid7 and Blue Voyant, talk to us about some of these, some of the operational issues you should be thinking about in the context of what's happened with Colonial Pipeline, what happened with JBS, what happened with Kaseya, right? And then these executive orders and sort of, Jen's obviously told us about the fact that we're looking, at least the government's gonna move to zero trust. I think the plan is talking about moving to zero trust, right? Is that the answer? Is that the solution, right? Is it one of the pieces of it? Or we had the right direction and it's so great and how can we do more? If not, what would you be doing from an operational perspective if you were running the show today? Well, first I think one of the challenges we have to step back and realize is that, we've accrued you to 20 plus years of technical debt in time on the internet. And I haven't seen anything from the private sector or public sector that's gonna pay down that debt overnight. And so I think the first acknowledgement is that we're working from a deprecated position. And I think what's been challenging at ransomware is that we've always thought about critical infrastructure from state sponsored actors of what happened if there were a combination of cyber and kinetic action where a state actor wanted to disrupt our, either as part of an overall kinetic war or for economic reasons disrupt our infrastructure. We didn't really think about the financially motivated actors and the components that come with that. So I think the difference between the state actors and the financially motivated actors, the financially motivated actors, a lot of the basic blocking and tackling stuff does start to make a difference. So that does raise the bar. So segmentation, two-factor authentication. I do think there is some degree of hygiene that we either have to figure out how to motivate and whether that's motivation through, I think we too often fall to the regulatory stick of like, well, someone should get a rule that you must do these things. Perhaps there's other ways to drive the carrot to motivate folks or, one of the things hopefully I'll tell you about later is, I'm kind of unbullish that the insurance industry can have a role in helping us fix things here because if you don't hit a base level of capability, if your stairs you're building aren't safe, you can't get insurance. And there's no point where that comes out. So I do think on the operational side, we have some basic blocking to get down and whether that's not exposing, not running five-year-old versions of Microsoft Exchange that have been out of maintenance for five years or two-factor authentication, network segmentation, some basic data security. I think those will go a long way. But I think we have to acknowledge that there's this tech debt is built up that we're not gonna pay it on overnight. And how do we motivate folks to do that and get the right solutions in place or spend a lot of time running security operations centers serving small, medium-sized clients, at least get them to a point where they can detect and respond in a faster period. And that's, again, given what's out there, that's not a simple solution overnight. But I think we've got some good things making progress in some of the recommendations. So Ernie, it's crazy, both Jen and David had talked about two-factor, or multi-factor authentication as being sort of one of the things that's being pushed now. It's kind of crazy that we're here we are in 2021 and we're still talking about multi-factor authentication. It strikes me as nutty, but you have a unique perspective, right? At Forged Point Capital and full disclosure, Forged Point Capital is an investor and a company that I work for, Ironette Cybersecurity. But at Forged Point Capital, you help run one of the largest or the largest cybersecurity specific fund in the world. Todd just about, so you're looking across all these sort of, all these potential investments. Todd's about what the right plays are right now. Like what is the game-changing plays that you all see in cybersecurity? What are the sort of the hot ideas out there? Zero Trust is one that's obviously that we've already talked about briefly, that we mentioned, tell us if there's some ideas that you're looking at. You all are looking at in that space. Obviously, Ironette does collective defense, right? That's an interesting idea. What are the hot ideas in your mind out in the, as you look across the spectrum when it comes to grappling with this sort of ransomware and a related question, given your experience at DIU and bringing that to Bear Forged Point, is ransomware sort of a unique thing that we need to be focused on specifically or is it just a component of this larger trend of malware coming from a nation-state and non-nation-state actors? Yeah, no, great, great question. To answer your second question, it's just a continual evolution of malware and from an investing standpoint, we kind of look at it from, think of it as continuous attack surface testing as well as extended, XDR extended defensive response. And we look at it from an investment standpoint, network. So how do we restrict lateral movement? So you mentioned Ironette, but there's the network piece, there's email protection piece, there's DOP, hopefully NextGen DOP is what we're looking at, not the DOP that service 1% of the market, ThreadIntel on the endpoint side, obviously you have the EDR players, they have the crowd strikes out there. You also have smaller company, you mentioned Huntress or I'm on the board of Huntress, they do MDR for the SMB. The SMB has been a right target for ransomware because they have MSPs who are their IT service providers, they don't have the sophistication, the cyber talent, nor the budget. So how do we defend them? How do we leverage deception, privileged access management, and then moving left, app security testing. So everything from traditional SaaS to SCA to DAST, fuzzing, you name it. And then the other piece of identity, we've made a lot of investments in identity, as I'm sure Dave and Jen can attest to, there's a lot of debt there, there's a lot of legacy. So how do we start thinking about monitoring entitlements? How do we manage identities cross multi-cloud? How do we potentially use passwordless authentication, identity proofing, and then obviously NFA should be table stakes. So that's kind of how we're looking. There's no silver bullet, it's this composite solution, which will hopefully get your cyber hygiene up. Yeah, yeah. So Jen, one of the issues that's come up in this conversation is this is just cyber hygiene, and the need to sort of get better at the basics. We've all talked about that for a long time, the need to just sort of get that bottom level protection up, so that you're making the attackers work that much harder. And one of the ideas that David put on the table was this idea of insurance, that somehow insurance might be able to help us raise the bar on cybersecurity, but a lot of people in Washington DC, or I think at least a couple of us live, David, I know live down the street for me, in the Washington DC metro area. In DC a lot of the talk is regulate, or as David put on the table, that we need some sort of government intervention, or maybe if we just pass enough laws, or we get the FTC or the FCC involved, it'll solve everything. But this idea of insurance I think is interesting to me. Do you have a sense of how insurance might sort of come to bear on this problem? And in particular, can insurance help us get better at the cyber hygiene piece, and can it do more than that? Yeah, I think so, I think so. I mean, David and I don't have any skin in the game, but this is something we've averaged over time. But I mean, just like getting good drivers out on the roads, right? Like there's a concept that you've got to have a vehicle that meets a certain standard, and a driver that set a certain competency. Like that is who you will ensure to drive. Same with the insurance industry as it relates to companies, right? Like that you've got people sitting on data that doesn't belong to them. And so how are they gonna be the responsible stewards of that data, right? How are they gonna ensure that these SMBs who have a hard time scaling up have the appropriate security measures in place? I think it's all about standardization and compliance. Those insurance companies can push requirements down on companies to get them compliant in a way that the government won't be able to, right? It's a matter of doing business. And so I think, you know, we've seen some insurance companies who are kind of pushing towards that, but that standardization, I think will come from that, from that lateral movement into industries because they need insurance. No company is gonna operate without that.  And I think that leveling up is what a lot of us are here to talk about today, which is more than just, you know, those few things. There's so many things. We can't even describe them all. But I mean, even like the cloud migration, I mean, we talk about, you know, at NISA, as we talk about the fact that like, if the CIA can get, you know, everything up in the cloud. Right. And their class lights, right? It's pretty amazing. Yeah, they had a hard time. So like, so, I think it's just a matter of shifting the mindset around so that stuff. And a lot of that is gonna be kind of pushed down again. Maybe it's partially legislation. Maybe it's partially from, you know, the folks who help businesses run like insurance companies. But I think it's a, I think it's a team sport. Yeah. So Ernie, from an investing perspective, sorry, David, do you have something the way in there? I'm sorry. Go ahead. Go ahead. That was me. Oh yeah. Mr. Ernie, so from a, you know, from an investing perspective, how do you see sort of won the insurance marketplace and that driving cybersecurity? How do you see actually the venture investing space? Or one of the things I've always wondered about is, how the venture investors aren't saying to their companies, hey, look, you need to protect your own assets. Literally all we're investing in is your IP. If that's not well defended, you know, we're SOL, right? Help me understand sort of, you know, what's the right players? Are the plays in the insurance space? Are there plays in the investing space? And if yes or no to those, do we need legislation? Do we need regulation? Like what, you know, sit down there in Silicon Valley. I know the general view is, you know, government can stay out there. That's great. And I think that's generally been how it's happened. But there is a push now for the government to get more involved in what's happening in the valley. How do you see that? And then what's your sense of it? Yeah, you know, we're seeing a lot of cybersecurity MGA's. So managing general agents. Yeah, the coalitions out there, at bay, resilience insurance.  Some are approaching the S and the SMB. Some are doing upper-mid market. But what they're all doing in different levels is doing security scans before they write a policy and during the course of the policy. Some are looking at, hey, how do we do DIFAR on the back end? How do we keep the hygiene up? Because at the end of the day, in the cyber business, it's about your loss ratio. So if they could keep the loss ratio down, it's more advantageous to them. And then it becomes this kind of, you know, OODA loop, if you will, with the customers. They're writing more premiums. The loss ratio is less. Cyber hygiene is going up, especially in the S and B.  So I think that's a great first step. It's very early days in that industry, but there's a lot, I mean, look at the amount of funding that's going in. I think at bay just announced 185 million round yesterday or today. So it's, as far as the government coming in, I think the government should get their own house in order first, you know, quite frankly, and, you know, follow the executive order. Obviously with Jenny's really at CISA and Newburger and the White House, like there's some really A players. And at the end of the day, shared responsibility. So let's get our own houses in order and then share information, which, you know, I'm sure you've lived that hardship, right? Because the government never wants to share. They'll take any information you give. It's hard for them to share. So, yeah.  I definitely really raised the bar. And, you know, I think it's not just in the fact that of the insured, I think, you know, what I'm hopeful for is that they have the ability to bring people who are not currently insurable into the market, which is a huge change in our base cyber hygiene.  Well, you know, David, on that point, you know, one of the things that governments have done when we're talking about car insurance and the like is they sort of require insurance companies to take on some amount of managed risk, right? Some amount of sort of, you know, the 18-year-old me driving around, you know, nobody wants to insure that guy, right? And so, you know, there are some earlier models for that. But I have a sort of a related question for you. You know, one of the things that Ernie mentioned was this idea of companies coming in and trying to figure out, you know, what the problems are before they go in, right? Whether it's with an investment. We've heard a lot about this in the M&A space, right? With insurers, right? Sort of assessing companies from the outside, sometimes from the inside, right? There are a lot of companies that have created businesses out of doing that type of assessment. I've always wondered how sort of capable those assessments are, right? Is it really realistic to be able to tell how vulnerable a company might be from the scans you do from the outside and the scans you do from the inside, right? And you've been at service providers that have come in both before and after the fact, trying to figure out, you know, what it looks like. Do you have a sense of whether particularly from a critical infrastructure perspective and from a vulnerability to ransomware or frankly, any type of malware, you know, in a lot of ways, ransomware's simply an example of that, right? Can you really tell that from the outside in or from the inside out? And if so, is it a good measure for insurance and M&A and, you know, diligence for investors? Yeah, I mean, so for the CES and in full disclosure, that's a business that these services is in today, but I didn't know that by the way, so I did not know that, so. But let me tell you why it works. That's what the adversaries do. You know, you can take the perspective of the defender and dig in, but that's what the adversaries do and it's working for them. So it works. They're testing from the outside to see who's vulnerable and as a result, sort of that's, if we do that, we could get a sense for it too, is that your point? Yeah, I mean, they're using Shodan, they're using, you know, that they understand what's vulnerable. I think, you know, the thing from a service perspective side, I think the thing where people get very big challenges and particularly when you talk about insurance or, you know, or supply chain things, is that some of the, you know, it's very hard to identify the true external foot private organization. And so we have actually one of Ernie's companies, Bishop Fox actually has a great offering or two is I think what everyone has the story of a supply chain scorecard that, you know, had some, got some terrible score because it included their desk network or a franchise or those things. And so, you know, the challenge, you know, I think the challenge to it is doing it well. But I think, again, our adversaries are doing it well. I was like, hey, I'm looking for, you know, they're going, hey, I'm looking for things that have this, you know, this known vulnerability that exists in this space for an organization that I think has the capability of paying this ransom that is in a country that either doesn't have you just shall reach to me or, you know, or, you know, law enforcement action that would prevent this. And so they're clearly doing it.  But I think the important thing is doing it responsibly, you know, doing it and giving someone a, you know, a bad grade publicly is not, I don't think it's going to help us where we need to be. Right. Fair enough. So no name and shame unless it's the Chinese and the Russians, not for our companies.  But over there, we got to realize that no one's ever going to be perfect in this and that we got to figure out how we, again, how we motivate, not just penalize. Fair enough. So, Jim, one of the things that David just talked about was this idea of sort of supply chain vulnerability, right? And we've seen this has become a really hot topic.  And now it could say that's a supply chain vector, right? People also concerned of the downstream effects of an attack on a thing like the colonial pipeline, right? And that has sort of spillover effects. That's not quite a supply chain, that's not a supply chain attack, but it shows the sort of spillover effects. And then of course the COVID-19 pandemic and we've seen the vulnerabilities in America to supply chain our dependencies on certain foreign countries, including adversaries like China. So, Jen, help me understand, you know, from a, you know, sort of what the government can do perspective, right? Or at least what, you know, legislation might do to help address the supply chain threats. One of the things that's talked about in the executive order, right, with respect to federal cybersecurity is sharing of information between private sector actors, contractors work for the government, right? Requiring them to share information about incidents and potential incidents. We've now heard a legislation up on the hill moving where there's an effort to get people to disclose it. It goes beyond data breaches, but disclose any incident you might have. Tell us how to think about that.  And is even into disclosure a worthwhile thing to even get in the business of talking about? I think it's really, I think it'll, we'll find out when it plays out. But I think it's hard to say. I think it's, disclosure I think is a step in the right direction, right? It's that same sense of wanting to understand so you can measure, right? You can look and understand, if you can't evaluate it, then how can you respond to it appropriately, right? And so we need to create metrics across a very, more than just our own organizations to understand what's going on. And I think there's a sense, whether it's ransomware, whether it's a supply chain issue, that when companies experience an event, right? They really don't want it to be a breach. They want it to stay an event and not even kind of scare. We deploy all our resources to try to understand what to do on our company's own best interests. If there's a directive to share that outside of that, which I think a lot of companies, a lot of lawyers who are comfortable and have points of contact within federal agencies, like are already comfortable reaching out to try to pick it up. Interesting. Whether it makes sense to disclose something, but this directive that says you need to, you should, we want you to, and there's no sense of impending penalties, right? Yeah. Penalties come when you do something poorly. The penalties don't come when you show that you were vulnerable. Everybody, every company is vulnerable. There's no sense of like, you know, we talk about zero trust, there's no 100% security. Like that would be an amazing state to exist within, but no company exists within that state. So if that directive that says share, let us know, is around that attempt to try to create metrics that allow for a valid response that can be coordinated across more than just one company. And I think that's very laudable. I think that is a step, for sure, a step in the right direction. Whether it's going to be effective and how quickly that's very hard to say. Yeah. And that's a great point about sort of the need for information to get out there in the marketplace in order to first coordinate responses. So Ernie, you know, go into this question of responses, right? You served in the government, you served in the Department of Defense, you were in the military, you served at DIU, and now you've come out and you're in the investment space and cybersecurity. But you know, one of the things that's been talked a lot about is that the government not only needs to get its own house in order on the defensive side, but it needs to do more potentially offensively, right? The government needs to respond more effectively to these types of attacks you've seen now, the Biden administration talking about the fact that, you know, we're going to name the countries involved, we're going to start talking about holding countries like Russia, like China responsible for some of the things that happen in their space, even if they're not nation-state actors, but if they're criminal gangs operating in their space and they know about it, we might hold them accountable. What is this the right road to go down? Do we want to be whole? One, do we want to treat ransomware as the FBI director said, like terrorism, which I think was code for if you harbor these guys, we're going to start treating you like you're responsible, right? Is that the right approach? And then second, do we need to get more offensive? I mean, do we need to be punching back more often? I like to use the analogy sort of the bully on the playground, right?  But we also all really know that if in fact you want your kids to not be able to build on the playground, best thing to do is put them in a self-defense class, have them punch the bully in front of everybody and the bully's going to stop bothering them and nobody else is going to bother them, too. And nobody's saying tell your kids that, right? But it works.  I mean, so this is a great question. And I think that on the classifying them as terrorists, you know, I look at it with cyber, there's a beno line. There's criminal activity and nation-state activity that looks to, that's directed at, you know, data-rich companies, whether it's pure ransomware or extortionware. And then what we've seen recently with JBS, with Colonial Pipeline, now we have essential services that are being attacked.  It's another thing when you shut down the supply chain of oil and gas on the east coast. And I think back, this might be interesting analogy, but I was living in New Jersey when Hurricane Sandy hit. Lost power for almost two weeks, run-up in gas prices, people fighting at Home Depot for generate, it caused chaos. And if you think of a cyber attack, it can have those effects in the physical world. So to me, there's a clear distinction there. And are they, you know, if you're harboring these cyber criminals, I think you should be held accountable for letting them operate with impunity. On the offensive side, yes, we should be more offensive. You know, General Machisoni at the NSA, ever since he took over, he had the whole concept of defend forward. And to me, that's, you know, start punching a little more and going into other people's neighborhoods, and showing them, hey, what's going on here? So I agree with that mentality. Now, what I don't know, being out of the government now, is what happens behind the scenes, all the clandestine stuff. But overtly, we should be punching back harder. Yeah. So, Dave, you know, you've seen some of this stuff. You, when you worked at Blue Voight, you all defended some of the largest financial sector players in the business. Talk to us about how bad is the threat when it comes to critical infrastructure, right? You know, you've seen a lot of it. You saw a lot of it in Rapid 7, too. So talk to us about how bad the threat looks. And is what Ernie says right? If the government starts punching back more, sort of we get more aggressive on General Machisoni's effort on defend forward, persistent engagement, right?  We've got Chris Singles as National Cyber Director, Jen Easterly at DHS. We've got Ann Newberg at the White House. I mean, Rob Joyce is back at NSA.  And people, frankly, who are willing to go a little, sort of a little more up against the enemy and punch them, right? So from your perspective, having seen what the threat is critical infrastructure, is this the right approach or, you know, a lot of people said we shouldn't punch back because we live in a glass house, right? And if we punch too hard, they're going to hit us really hard and we're more vulnerable and more likely to, more likely to have problems than they are. Is that right? I mean, how do you think about this? I'm not sure I'd say glass house would say, but I think we, you know, while we are likely the most capable from an offense perspective, we also likely have the most to lose defensively. And I think that has to factor into our, you know, the policy of how we think about this. But if you talk about critical infrastructure, I mean, it's a fascinating term. We're sitting here talking, you know, in the ICS village, which is, you know, very focused on the industrial control side. ICS categorizes 16 categories of critical infrastructure. I mean, you know, in some ways, everything is critical infrastructure in a lot of ways. And I, and I, and I exaggerate a little bit for the point, but I think the challenge of it is, is we, we often think, and I think on the policy side, get, get wrapped up in the haves versus the have nots is, you know, a, you know, an investor in utility or, you know, a money center bank, you know, has amazing capabilities.  And one of them has an impact. And there's, there are from major investor owns, you know, multi-billion-dollar organizations to very small rural co-ops. And I think what we, what we often forget are the, the state of the have nots.   Or less.  And so I think that when we talk about things like, you know, information sharing and, you know, and public partnership, like those things are great, you know, when you can, when you can take the, you know, the, the intelligence team from Exxon or from JPMC and, you know, have them talk to peers, you know, when it's the, when it's a, you know, you know, a small rural electric co-op, it's a very different conversation. And, you know, as we've seen from I'm blanking on the details of the attack, but as we saw, you know, in one of the, you know, Russian attributed attacks on our, you know, part of it came in through a, a maintenance supplier and a small rural co-op. So I think that, that's, that's, that SMB conversation is one that's just so critical to, to our overall, you know, criminal structure security that we, we just, that leaves us vulnerable in the punch backside. Again, there's, there's definitely places for, for punching back and I'm, I'm all for it. I think we've, you know, I love that we've been more aggressive and recovered money and, and things over. Right. So I think there's, there's, there's a lot of roles for that. And I think a lot of really impressive and creative collaboration and finding ways to legally, you know, take down infrastructure or take over infrastructure. So I think there's a lot more we can be doing, but I think we just have to keep policy, keep, keep our, you know, our, our state in mind as we do that. Yeah. Well, so on that, on that front, Jen, you know, one of the things that, that, that we've seen the government do a lot of, right, is, is indict cyber criminals. You're a former federal prosecutor, right? Or a former prosecutor. You have seen some of these cases go down. You know, is, is it really sensible to, to indict folks we know we're never going to get, right? We had these Chinese, you know, military officers with these Russians, cyber criminals, some of whom are associated with the government, right? There's no chances that we're going to get these folks here. And so in a lot of ways it feels like just a name and shame game when it comes to these indictments, right? Is there any value to these indictments? And if there is, or there isn't, right? What about getting more aggressive? Are there, are there any legal concerns we might have with doing the kind of things that Ernie's talking about, sort of, you know, getting more aggressive, punching back, right? Or, you know, are there, are there legal concerns with helping the smaller providers? Can we, can we do something as a legal matter to help these smaller providers get the information they need? If they've got small teams, can we, can we push in the information or focus information on them without, you know, without having a problem where we're not helping these other folks? Is there, is there a problem when we treat people differently given how they're situated? So a number of questions there. Sorry about that. That was, I think, a three-parter. Okay. I'm going to address them all together. That's a great question. No, I think, I think the word that comes to mind when I think about the prosecutions is like symbolism, right? Like it's a symbolic sort of shot. It's a long shot, right? The idea that these people will be held accountable, you know, in a court of law in the United States is very far fetched. But is it, is it meaningless? Probably not, right?  Like that person has an identity behind a screen in a place that is very many time zones away. But still the idea of like literally like throwing down the gauntlet that this is the person here. We know it's you. Yes, that's, that is, I think there is something very gratifying about that. I don't think it'll go so far as being gratifying as far as putting them in one of our, you know, jails will be amazing, but probably not. But I think, you know, the question of what is an appropriate response and how do we properly defend, you know, our country and our companies is, is multi-layered. I think a lot of, a lot of the time, like we haven't even touched on like diplomacy, right? Like there's the idea of sanctions, the idea of like which, which country is, is this coming from? And will they be responsive to the diplomacy that kind of accompanies the sense that sanctions have the right repercussions for that country? And then can you lean on that country to then help you find justice against those individuals who are part of it? Now, in a lot of the countries that we're talking about today, those, those individual actors are not individual actors per se, right? Like we talk about their own HR departments within organizations, they're very organized. They're probably state sponsored. And that's just not a realistic outcome. I think it's interesting, you know, last week, you know, there was, there, there was a bill. There's a bipartisan bill that's being introduced to allowing companies to hack back. And I don't know if you guys have seen that. That was a 2017 initiative. It's, you know, it's been revived. And the question there is like, you know, what would be the right proportionate action by a company? Like how would a company say, all right, you did this, like, okay, now you get this, that you could rise that level of sophistication. Like the question, and at the GC level, right? Like a lot of us are kind of questioning, like, do we want to be the individual who's saying go for it? Yes. Right. Like it's all systems go, like give it to them. Like that is, it feels very far fetched, but that is a legitimate bill that is coming through that is. No, yeah. Yeah. There's some, there's some consideration because that's, if that's where we're at, you know, we might as well put everything on the table and think through that because there aren't many other. Options and revenues for companies. Yeah. So, so Ernie, look, this has come up a number of times. This idea of a private sector hack back, right? It goes, it dates back, right? As a military matter back to the founding of our nation, right? Where we actually use private, private ships to sort of form a navy for us and really defend our coastlines, right? Even though we had a nascent navy, right? We would often give these letters of mark and reprisal as people, as people refer to them, you know, it's in the constitution, right? And give these things to private individuals to go fight back on behalf of the nation. We obviously have today a cyber command. They have offensive capabilities. Even before cyber command existed. We've had, we had the joint functional component command for network warfare that did some more of the offensive stuff. But there is a lot of discussion about private companies being able to respond in some way, right? Some people talk about active offenses, meaning, you know, look, if somebody hits me, I can send sort of the way I would like a die pack in a, in a, in a, in a package of money, right? It'll go explode in their network. I'll know it was them. It'll beacon back. It'll tell me it was them, right? Nevermind that beacon activity. It looks a lot like what malware does right at the outset, but okay, whatever. Fine. So it'll beacon back to me and maybe even it'll detonate and it'll destroy my data, right? But then what if it goes a little further, right, Ernie? Is this the place we should be going where, well, maybe it detonates and takes down their infrastructure, not, not in, not their whole systems, but just the stuff they use to attack me, right? Is that a place we should be going? And should we be worried about if this is as, as Jen points out potentially, even though it looks like criminal activity, it might be state sponsored activity, right? Is there a threat that we might have private sectors, companies get us into that so-called, you know, land war in Asia? Do we have to worry about that? That's a tough one. That's a really tough one. Because part of me says, yeah, you should be able to defend your organization. And you should be able to respond proportionally or maybe disproportionately. The other part of me, you know, thanks with kinetic warfare, there's always collateral damage. And there could be fratricide. So, you know- I mean, look at, look at not Petia, right? I mean, not Petia and attacked by the Russians against Ukrainians, you know, $300 million per company, right? $10 billion worldwide. Perfect, perfect example, perfect example. You know, I think as much as I'd like to see something like that, I think it would get too chaotic. You'd have the collateral damage. You'd have, you know, it's not like when we had Stuxnet, there was an organization that could use four zero days and do it very accurately, right? You can't expect, you know, even an enterprise, a JP Morgan to do that. So I think- I don't know, tell them, I don't know, Jamie Diamond might disagree with you. He's got renewed. So- Well, they might be the one exception, but you know, when they were, when the financial institutions were attacked in 2012 by the Iranians- Right. The government didn't help. My understanding is, and I know people that were involved, the government said no. And ultimately, the, the, you know, call it enemy servers went dark. And weird. It was the Israelis. Right. They came in. So anyway, it's a slippery slope. I think we got to be very careful with that. Yeah. So Jen, what about from a legal perspective? Let's say we did grant these letters of mark and reprisal to companies that, you know, that, that, that are, that are being attacked critical infrastructure companies only, and only really capable ones, right? Only the big ones and only the smart ones, right? Whatever. We pick them. We give us authority. We say you can only do these set of things, right? Do we want private sector businesses doing this sort of thing? Right. Is, is, are there any legal concerns with that? And here's our legal concerns. Are there policy concerns about allowing private sector companies, even with all the law, all legal authority in the world from the US government, a little shoot, paper saying you're acting on our behalf. Do we want them in that business? I mean, at the risk of alienating all of my friends for general counsels, I would say, I would say probably not.  I mean, general counsels are not cyber experts, you know, by merit of having, except for you. Well, I'm still working on it. That's why I've got to spend a lot of time around it. No, but, but I think, I think it's the, I think that's the problem, right? I mean, general counsels are, the word general is in there for a reason. Like we are just at the heart of it. If we're not, then it's very hard to execute against so many different things that affect a company. I mean, I think that's the question of like, whether we want to be empowered to use force under. A UN charter, like probably not. It's probably the same question as like, should I be carrying a gun? Even if I can get a gun from it, probably not. That's, I think it is. It's an interesting question. I mean, I think there are legal ways through it, right? And there are corporate governance ways through it. You can create committees that can evaluate things that can get out of the way. I think it's a very narrow issue and protect itself. And understand that it's making a decision in the best interest of the entity. And then taking into account all the other considerations, which would be, you know, the country, the collateral damage, the repercussions and do it in a coordinated way with government. Maybe that, maybe if that, then possibly, but I would still, you know, air on the side of what Ernie said, which is. Yeah. It's a big, it's, it's, it's a big leap of faith, right? It's a faith that may not even be successful. Even if you had the technical chops to execute it, what are you going to get? Is it that sense of redemption, right? Yeah. DOJ style, like, you know, we've now named it. We've done something. Yeah. Is it, is how, how it's probably very gratifying, but is it, is it ultimately effective? Yeah. Yeah. So David, you know, it sounds like Ernie in general, like, look, we're not, it's not the greatest idea, right? So let's, let's say that's right. Let's say we're, we're not going to come into companies to do this and we're really going to take you and Ernie up on, on your suggestion that the government gets more aggressive and sort of does its part, right? Does the government know enough about what the private sector is being hit by to effectively respond to it and, and sort of deter behavior, right? I mean, it's willing to say, okay, the government's not willing to do it, right? Which they haven't been for a while. And now hopefully under Joe Knox, they're getting more aggressive and they have more authority, right? So maybe they are willing to turn, maybe even capable of deterring, right? Do they know who to go after? Do they know how to go about it? Do they, do they have the information they need to really sort of deter those who are coming up against our private sector? Or do they need, you know, we've talked about information sharing and that's all great and well, right? You know, more data, fine, great, terrific, right? But a lot of it needs to be about collaborating in real time too, right? Working together consistently day to day, day in, day out, holding hands as these things happen. Are we, are we anywhere near that? I mean, I think if we're, if we're talking hit back from a cyber attack, I think that's a very, that's a much more complex conversation.  I had a conversation, you know, a few years ago with someone at a senior level, at a state law enforcement agency.  And, and, you know, it's very, it's very well, my conversation.  You know, and, but wait, just not only for accuracy, but also things like collateral damage.  But what, but what I think we're missing in the, in the hackback conversation, and part, part of why I love the naming names, you know, side is attribution is really important for two things. One is, you know, it's, you know, it, it, it can give you organizational insight as to who's doing it. So is, is this one person, you know, or a small group of people who are financially motivated? You know, is it a, is it a broader network that's accomplishing other goals? How are they being financed? And, and when we know those things, we can all of a sudden take, take very different actions. It doesn't have to be just an infrastructure. It can be, you know, stop their ability to move money. You know, it's a cyber. Yeah. There's a lot of other things that, that we can do. I mean, I, again, I agree with Jen that the likelihood of these people ever showing up in a US jail is low, but I just kind of grin and go, well, there's a, we just took a lot of places that they can't go on vacation and spend that money they're making where extradition comes into play.  That's a very different degree of coordination that I'd actually love to see, you know, a difficult sprint around on the government side and sorting that out. Yeah. So, so this is really interesting. So, you know, we're coming up on the end of our time together. And one of the things I wanted to sort of end on is a question about ransomware itself, right? Because the topic of our panel is critical infrastructure and ransomware. One of the things that got really interesting about the colonial pipeline hack, right, was that early on in the, in the attack, colonial pipeline took their systems offline, right? They did some stuff. And then they came back up fairly quickly. Everyone was concerned about the potential for a major supply chain disruption, a boil on the East Coast. There were even some people who were hoarding gas, crazily putting bag, gas and plastic bags, by the way, for those of you out there, don't put gas and plastic bags. It doesn't work. It's a bad idea. Please don't do that. But, but there were these concerns, right? Legitimate concerns about, about, about a supply chain disruption and colonial pipeline avoided it. I'll come to find out later on that they had paid the ransom, right? Now, yes, the FBI went and they were able to get, get some of that back. That's a whole another question about how the FBI had the private key to the Bitcoin to get that, to get that, that ransom back that I'll leave for the audience. But I have a question for, for each of our panels, which is, should we be permitting companies to pay ransoms in order to get them back up and running faster? And if your answer is yes, or at least for critical infrastructure, a qualified yes, doesn't that incentivize the business? And if it does, how do we solve that problem? Aren't we sort of quote unquote, negotiating with the terrorists? I'll start with you, David, and I'll end, I'll end with Jen, because she's the lawyer in the room. I want to get the lawyers out, but David, first to you. I, I, I would not, I'm not supportive of the government having a no ransom policy today is that, that folks, that, that people need to make a risk-based decision in their business. And I, I, I get it. I love the fact that it supports these actors and, and continues to, it helps propagate the problem.  We didn't go back and say you couldn't take, you know, you couldn't pay kidnapping ransoms that, you know, we dealt with that as, as a, as a law enforcement problem. And so I think we're not quite ready for that. I do think there are a number of, there are some things where some tools that we, that, that while you say yes, you can pay. I do think we're under leveraging the, you know, the, the OFAC and, and, you know, money moving process that yeah, there's a, there's a small and growing kind of school of thought that paying ransom should, should require some more knowledge and attribution of the entity to make sure that you're not funding, you know, as a, as a, as a USNC, you can't fund things that are, that are SDNs. So I think there, there are ways that we could, we can wield other things beyond the individual companies. But, but can I, can I ask you about that? So I always hear this, right? Like, okay, we should make sure, as long as they're not paying terrorists or, or, you know, whatever, look, they're paying cyber hackers, right? For all we know these high records are funding. I mean, what do we just ask them for ID before we pay them? Like, how's that going to work? I don't get that. Yeah. I mean, there, there, look, there's, there's, there's ways there, there are services out there that help with this.  But we've, we've, we've had this SDN methodology, you know, as a, as a country for a long time and it's, you know, while it's not perfect, it's been, it's been quite effective at, at, at taking out, you know, particular groups of actors. And I'd love to see you use more here. And SDNs are especially designated nationals, right? People who are on sort of the terrorist list and the like section list. All right, Ernie, over to you. Should we allow companies to pay ransoms? And if so, what about this, this threat that it'll just incentivize the business more? Yeah. So first, I don't think it should be binary. You either pay or you don't. In a recent study I read only 8% of organizations got all their data back and 29% got half, which blew my mind because I thought if you paid, you probably like a 75% chance to get it back. So today, I agree with David. It's like, you're not going to tell like if you're, if your kid gets taken hostage, you're not the government's like, tell you don't pay the ransom.  So I think it might, but you're still going to pay the ransom. Yeah. But it's, it's a risk-based decision. Is, is PII on the line? Or is it an essential service? Is it affecting national infrastructure? Is it affecting, you know, something that, that could cause actual physical harm, you know, harm in the physical world. So I think it's up to the businesses. I don't like it, but I think there's no, there's, there's no, you know, binary answer for this. Can I just follow up on that though? So, okay. So let's say, let's, it sounds like you'd be more willing to accept payment of ransoms if, if critical infrastructure is involved. Does that, did I hear that right? That, that's, yeah. It's good. You have to look at first, second, third and. Yeah. Yeah. Okay. So, so if that's right though, aren't we just telling the bad guys, Hey, you know what you should really go after? You should go up to critical infrastructure because that's where we're going to be willing to pay the biggest ransom. So, Hey, clino pipeline, that was smart. Do more of that. You'll get paid more often. Yeah. I would not write that down or, or suggest that it would, it's kind of, again, it's business risk with the business knowing what type of risk that, that, that ransomware and extortionware is going to affect on their customers and on populist. All right, Jen, you had the first word and you get the last word. Tell us what you think about, about ransomware, you know, and, and should we be allowing companies to pay ransoms and what about this incentive effect? Right. If we, if we tell them like Ernie says, Hey, look, the one place I'm willing to pay ransoms is critical infrastructure. For sure. Well, doesn't that make critical, but you're even bigger critical infrastructure. Sorry. And even bigger target than it already was. Yeah. I mean, I agree with both David and Ernie. So I'm going to kind of layer onto their sort of suggestions that also kind of go far, which is like, can we get to a point with, with public sector, with government agencies where like, because, because the thing that we're not talking about with that ransomware is that it's a very rapid response that's required. Yeah. So making a very quick decision and as a company, everything that you do as an officer is in the company's best interest. That's kind of the overarching theme. Like obviously the collateral effect is important, but if it, but if it's, if it is, if it's contraindicated by something legal, then that takes it off the table. I kind of query whether we could get through this, like, you know, the Biden orders and the sense of collaboration to a point where companies feel like they can turn to law enforcement during a ransomware attack to say, this is happening. We're going to do this. We're letting you know. And maybe get some, some, some sense of assistance, even to try to get to that level of attribution. Right. Like, maybe that's where this all goes. Maybe you split it and try to get there. And that's kind of the best case for right now, because it is a very heated issue. I think companies are in a really bad situation, especially as Ernie said, when there's PII on the line, the government is not willing to indemnify you, right? From all those suits that are coming. So, so you've got to still make the best decision for your company. That's a, that's a very multi-layered question. Right. Well, it looks to me like that's a great note to end on. Thank you so much to Ernie, David, Jen. Thank you for being here. Thank you for contributing to this conversation. And thanks to Bryson Bort and I see a spillage for hosting us at this DEF CON panel talking about ransomware, critical infrastructure and the potential impacts. Have a great afternoon, everybody. Thanks a lot.


The Alka-Seltzer Show, transcribed in Hollywood, featuring radio's favorite singing stars Kate Massey and Martha Tilton from the Music of Country Washington. It's Alka-Seltzer time, Alka-Seltzer time. Morning, good night, I'm Kurt, I'm Martha, and here we go with the Alka-Seltzer show.  Just direct your feet to the sunny side of the street. Can't you hear a pitter-patter, and that happy tune is your step. Life can be so sweet on the sunny side of the street. I used to walk in the shade with those blues on parade, but I'm not afraid. This covert mess said I'll be rich as rock on the sunny, on the sunny side of the street. And that's where Martha and I are going to stay through the whole show today on the sunny side. No doubt about it, Kurt, that's the best medicine in the world. To look on the bright side of things, even if you have to pretend a little. Pretend you're happy when you're blue. It isn't very hard to do, and you'll find happiness without... Uh-oh, that could be the end of a beautiful romance. But let's trust the lady in question you want to do for acid-upset stomach. For fast relief, be wise, alkalize with Alka-Seltzer. Yes, Alka-Seltzer reduces excess stomach acidity with instant alkalizing action. And those sparkling Alka-Seltzer bubbles soothe and settle an unsettled stomach with gentle action. Just drop an Alka-Seltzer tablet or two into a glass of water, and let it fizz into a bubbling solution, and drink it for fast relief. Yes, enjoy that feel-better feeling you get with speedy Alka-Seltzer. And so that you're not without Alka-Seltzer this weekend, why not check your supply today? You can get Alka-Seltzer at any drugstore, by the glass at the fountain, and by the package at the counter. Ask for Alka-Seltzer, fast relief from acid indigestion. Now, if we may restate our philosophical premise for today, let's see. How can we sum it up in a few words, Martha? We don't have to, Kurt. Johnny Mercer's done it for us. Accentuate the positives. Oh, I sure. You got her accent, you ate the positive, heal her, but ate the negative. Let y'all to the infirmity, don't mess with mister in between. You've got to spread to illustrate that last remark, Jonah and the Whale. What did they do just when everything looked so dark? They said you better act. And ate the negative. Let y'all to the infirmity, don't mess with mister in between. Now, Martha, here's a wonderful new song that fits right into our campaign for positive thinking. Well, good. Let's hear it, Kurt. Well, it's a little on the serious side, and a good thought to cling to when things go wrong and worries pile up. Always remember that this too shall pass away. The stormy clouds that hide the sun, this too shall pass away. The shadows falling one by one, this too shall pass away. The lonely bells that shine for those who know the pain apart. This too shall pass in time. This too shall, in the darkness, there's a life patient. Time, Chinlifters. Kurt, there's a million of them in the memory book.  Forget your troubles and just get happy. You better chase all your cares away. Sing hallelujah, come on, get happy. Get ready for the judgment. Here's another way to chase the blues away. Where the sky rubbles in dream, that sunshine peeps through. There's only one thing to do, rubbles in dream. This is no day for Johnny Ray, Kurt. We don't allow no crying or sighing. There's no room for blue. No, sir, there you have a blue note today. If you like sad songs, you'll have to sing. Enjoy that feel better feeling. When a headache happens along to slow you down, remember speedy Alka-Seltzer for fast relief. Just drop one or two Alka-Seltzer tablets into a glass of water. Let it fizz and there it is. Alka-Seltzer is ready to go to work as soon as you drink it. In fact, tests prove the system absorbs more of the pain reliever from Alka-Seltzer. And gentle Alka-Seltzer has thousands of tiny bubbles that help the pain reliever on its way. Next time a headache gets you down, get that feel better feeling with speedy Alka-Seltzer. Now enjoy that feel better feeling. The feel better feeling. When a headache gets you down Alka-Seltzer, goes to town Alka-Seltzer. Well, how'd we do with our positive thinking? Is everybody happy? Well, if not, it sure isn't our fault, Kurt. We did our polyana best. Well, friends, we hope that all those cheery tunes start you off on a happy weekend. Martha and I'll be around again on Monday between now and then. Enjoy yourself, take care of yourself, and be sure to take your family to church, won't you? Bye now till next week. Same time, same station. We'll sing the old song. We'll sing the new. We'll sing the bright songs. And maybe we'll sing the blues on Monday, Tuesday, Wednesday. Thursday, Friday, too. Have you ever felt out of step? Just can't seem to get into the swing of things. Well, a vitamin shortage is one of the common causes of a dull, listless feeling. So take one a day brand, multiple vitamin tablets. They supply all you normally need to take of all the vitamins proved necessary. And they're in tablet form, easy to take with no unpleasant aftertaste. Also, they now contain vitamin B12. It's easy to take and pleasant to take one a day brand, multiple vitamin tablets. Take them regularly, not just once in a while, but every day. Get one a day brand, multiple vitamin tablets, at any drug store. Listen Monday for the Alka-Seltzer show starring Kurt Massey and Martha Tilton for the music of Country Washburn and his orchestra. Today's program was transcribed in Hollywood and this is for Pearson's people.


Welcome to lecture 29 on measure and integration. In the past few lectures, we have been looking at measure and integration on product spaces. So, let us just, we will continue doing that in this lecture also. So, we will be studying what are called Fubini's theorems. We had proved some versions of Fubini's theorems in the previous lectures. So, let us recall what are those theorems that we have proved. So, in the, we first proved what is called Fubini's theorem 1, which said that suppose f is a function defined on the product space x cross y, taking values in the real line and suppose this function f is non-negative and it is measurable with respect to the product sigma algebra a times b. So, f is a non-negative measurable function. Then, we claim the following statements hold namely, if we fix one of the variables for this function say x not belonging to x or fix the other variable y not belonging to y, then with respect to the other variable these functions become non-negative measurable with respect to the corresponding sigma algebras. So, for example, if x 0 is in x is fixed then the function y going to f of x 0 y is a function of the variable y on the space y. So, it becomes measurable with respect to the sigma algebra b and similarly, for every fixed x 0 the function for every fixed y 0 in y, the function x going to f of x y 0 is a measurable function on x with respect to the sigma algebra a. So, for every one of the variables fixed in the other variable it becomes a non-negative measurable function. So, once it is non-negative measurable you can integrate it out. So, look at the integral of f x y d mu x the variable y is fixed. So, you are integrating with respect to x. So, the integral depends on y. So, this gives us a function y going to integral of x of f x y with respect to the variable x and similarly, if you integrate out the other variable y then you get a function of x namely x going to integral over y of f x y d mu y. So, the second claim is that these functions are again non-negative measurable functions of y and x respectively and once these are non-negative measurable functions you can integrate out the other variable now. So, integrate with respect to the variable x. So, you get one of the iterated integrals namely integral with respect to x and then integral with respect to y of f x y d mu y is equal to the other iterated integral namely first integrate with respect to x and then with respect to y. These two iterated integrals are equal and the claim is this is equal to the integral of the given non-negative function f x y with respect to the product sigma algebra. So, as we had stress that importance of this term lies in the fact that to integrate a function of two variables f x y we can fix either of the variables first integrate it out and then integrate out the other variable. So, you can do integration with respect to one variable at a time. So, this was called Fibonese theorem 1 for functions which are non-negative measurable f x y and then we extended this theorem to functions which are integrable. So, that we called as Fibonese theorem 2 and that stated that let f be a integrable function on the product sigma algebra product space. So, f is in l 1 of mu cross mu then the following statements hold namely if you fix one of the variables say x or y then as a function of the other variable these functions are integrable, but not for almost all variable fix for almost all points whichever are fixed. For example, if you are fixing y then it says that for almost all y the function x going to f of x y is an integrable function and similarly for every almost all x fix y going to f of x y is an integrable function. So, when you fix one variable at a time for almost all such fixings the function of other variable are integrable. So, you can integrate out. So, you get function y going to integral over x of f x y d mu x and similarly the other function is x going to the integral over y with respect to y of f x y d mu y. So, these two functions are again so the claim is that these two functions are again integrable with respect to the corresponding measures mu and mu. So, you can integrate them out and what you get is that the iterated integrals once again in this case are equal and equal to the integral of the product of the function with respect to the product measure. So, basically what we are saying is that the two iterated integrals are equal to the integral of the function with respect to the product measure whenever f is a integrable function. So, these two theorems we had proved and we want to give one more version of this theorem. So, to do that we need to prove a proposition about integrable functions on the product space. So, let us take a function f on the product space f x y on the product space a cross b then the claim is that the following statements are equivalent for one the function is l 1 function as a function of two variables the function is integrable. So, that is f belongs to l 1. Secondly, if you look at the absolute value of the function f and look at its iterated integral with respect to x or y. So, look at the absolute value of the function f that is a non-negative measurable function. So, look at its iterated integral first integral with respect to x and then with respect to y that is finite. So, that is the second condition and the third is you can interchange this. So, look at the other iterated integral that first integrate with respect to y and then with respect to x. So, then this is a second iterated integral that is finite and fourthly. So, these three conditions we want to show these three conditions are equivalent. So, let us prove them. So, let us first assume. So, f is a function given on the product space x cross y to r. So, let us assume one that is namely saying that f belongs to l 1 of x cross y. We want to show two namely that the iterated integral of mod f x y d mu of x and then integrate that with respect to y. So, that is d nu y is finite. So, this is what we want to show. Now, since f is integrable, so the condition that f is integrable. So, one implies that integral of the function mod of f x y with respect to the product sigma algebra, product measure mu cross nu is finite over the product space.  So, it is a non-negative measurable function on x cross y. So, Fubinist theorem 1 is applicable. So, by Fubinist theorem 1, we get implies by Fubinist theorem 1 which was for non-negative. So, by Fubinist theorem 1, for non-negative functions, what we get is that the iterated integral of mod f x y with respect to x and then with respect to y d mu x d nu y must be equal to the integral over the product space x cross y of mod f x y d of mu cross nu, which is given to be finite. So, that implies that this iterated integral is finite by the second condition. So, what we have shown is, so hence, so 1 implies 2. Let us try to show that 2 implies 1. So, what is 2? So, the condition 2 says that integral over x of mod f x y d mu x that integrated with respect to y d nu y is finite. That is given to be finite. So, once again we observe that mod of f x y is a non-negative measurable function. So, by implies by Fubinist theorem 1 that the double integral, so now we can revert that. So, double integral, that means integral of the product space of f x y d mu cross nu must be of absolute value of f x y must be equal to the iterated integral. So, that is integral over y integral over x of mod f x y d of d mu x and d nu of y and that is given to be finite by 2. So, implies that 1 holds namely integral of mod f with respect to the product measure is finite that is that f belongs to l 1. So, what we have shown is that the condition 1 is equivalent to condition 2 and a similar proof implies that condition 2 is also equivalent to condition 1. So, saying that the function is integrable is equivalent to saying that either of the iterated integrals of mod f are finite. So, all these 3 are equivalent conditions. So, this can be put into the statement of the Fubinist theorem. So, combining Fubinist theorem 1, 2 and then this proposition gives us what I call as the combined Fubinist theorem. Basically, combined Fubinist theorem gives you conditions under which you can say that the iterated integrals of a function of 2 variable are equal to or equal and equal to the integral of the function over the product measure space. .. So, let us look at the combined Fubinist theorem which says let x a mu and y b mu be sigma finite measure space is right. We have been working under sigma finiteness because the product measure is defined only for sigma finite measures. So, if 2 sigma finite measures spaces are given and you are given a function f on the product set x cross y which is measurable with respect to the product sigma algebra a times b, then the following conditions any one of the following conditions namely f is non-negative and secondly f is integrable. The third condition that is the iterated integral of mod f with respect to y and then with respect to x is finite or the other one the iterated integral of mod f with respect to mu and then with respect to mu is finite. So, if any one of these four conditions is satisfied then we can say that the integral of the function f over x cross y with respect to the product sigma algebra is equal to both of the iterated integrals namely either integrating with respect to y first and then with respect to x or integrating with respect to x first and then with respect to y. So, basically these three integrals are equal in the sense that if either of them exist then all the three will exist and are equal. So, basically Fubinist theorem says that the two iterated integrals are equal and equal to the product equal to the integral over the with respect to the product measure whenever either of these things either of these integrals are defined. For example, if f is non-negative then these are all defined and hence they should be equal by Fubinist theorem 1 and if f is l 1 then integral of f x y over x cross y that exist. So, these all three must be equal and other iterated integrals of mod f they are equal into saying f is l 1. So, they all will be equal. So, this is what is called combined Fubinist theorem and it is of importance. We will see lot of applications of this soon. .. So, let us look at some examples. So, I want to stress this point namely that in the statement of the theorem we have assumed the condition that mu and nu are sigma finite measures. So, these conditions are going to be important. So, let us look at some examples to illustrate this. So, let us look at the space when x is equal to y is equal to 0 1. So, my underlying space is x is same as y as the interval 0 1 and the two sigma algebras sigma algebra A is same as a sigma algebra B is equal to Borel sigma algebra the sigma algebra Borel subsets of 0 1. So, let us define the measure mu to be the Lebesgue measure on A and the measure mu on when treated as y 0 1 as treated as other space we define it to be the counting measure. So, what is the counting measure? Counting measure is the number of elements in a set E if the set E is finite, otherwise it is equal to plus infinity. So, we have got two measure spaces. So, let us look at the example that we have gotten. So, we have got x which is equal to 0 1. The sigma algebra A is the Borel sigma algebra on 0 1 and mu is Lebesgue measure. On the other side we have got y which is again 0 1 and the sigma algebra B is again the sigma algebra of Borel subset of 0 1 and we have got mu which is equal to the counting measure. So, counting measure as defined it is if the set E is finite then it is number of elements other it is equal to plus infinity. So, now let us look at the product space x cross y A times B and mu cross mu. So, let us look at the product space. So, let us look at the set. So, we are going to look at the set D which is the set x is equal to y. So, this is you note that x cross y this is a subset of x cross y. So, the claim is that this is a closed subset of x cross y and hence is an element in A cross B. So, what is our space x cross y? x cross y is if you picturized it is just 0 1 cross 0 1. So, that is our space this is 1 1 and what is D? We are looking at the set D which is contained in this the set D which is contained in this. So, that is D is equal to x comma y x is equal to y. So, that is a this line is my D. So, the claim is that this D is a Borel set. So, one way of looking at it is the D is closed in x cross y. What is the meaning of that this set is closed? So, one way of showing that this is a closed subset of 0 1 is to show that it contains all its limit points that is one way of showing it. So, if I take a sequence x n comma y n belonging to D and x n comma y n converges to say x y then claim we should be able to show that x is equal to y. But let us note x n y n belonging to D that implies. So, note that x n is equal to y n because x n comma y n belongs to D is the diagonal and x n y n converging to x y. So, this implies. So, this condition implies that x n converges to x and y n converges to y. So, x n is equal to y n, x n converges to x, y n converges to y. So, all that will imply that x is equal to y. So, this set D, the set D is a closed subset of 0 1. So, implying that D belongs to the product sigma algebra A times B. So, that is the D is a closed subset of 0 1. Next, we want to compute the iterated integrals of the indicator function of the set D of this diagonal with respect to mu. The claim is that if I integrate, if I fix one of the variables say y and integrate the indicator function of D with respect to x then this is equal to 0 for every y. The other integral when we fix x integrate with respect to y the counting measure that is equal to 1 for every x. So, that will imply that the two iterated integrals are not equal, one of them is equal to 0 and the other one is equal to 1. So, let us verify this first. So, let us verify the condition that if I take the indicator function of the set D x y and integrate with respect to mu over x. So, the claim, so the first claim is that this is equal to 0 for every y belonging to y. So, let us see y is this integral equal to 0. To note that, to show that let us observe that for fix y, we want to compute the indicator function of D at x y. So, what is that equal to? So, this is equal to 1 if x comma y belongs to D that means x is equal to y and it is 0 if x is not equal to y. So, this function, the indicator function of the diagonal for y fix takes only two values 1 and 0 and only at one point it takes the value y, it takes the value 1 when x is equal to y at all other points it is just 0. So, it is the indicator function of a singleton set and hence, so this implies that integral over x chi D x y mu x is equal to the indicator function of the singleton set namely y x D mu x and that is single point and measure mu is the Lebesgue measure. So, this is equal to 0. So, a simple observation that the indicator function of the diagonal x y is equal to 1 if x y is fixed so it is x is equal to y otherwise it is 0. So, that proves that this is equal to 0 and similarly let us compute the other one for fix x. Let us look at the indicator function of x y equal to so what is that equal to? So, that is again equal to 1 if y is equal to x and is 0 if y is not equal to x. That is again the same function, but now let us observe that so the if I integrate with respect to y of the indicator function of D x y with respect to D nu y nu is the counting measure. So, for one point for one of the one point when y is equal to x the value is 1. So, the value is 1 for one point and the measure of that single point is equal to 1. So, this is equal to 1 for every x belonging to for every x belonging to x. So, that proves the required claim namely that the the integral of D indicator function of D for every y fix is 0 and for every x fixed is 1. So, the iterated integral with respect to one of one of the iterated integral is equal to 0 while the other iterated integral is equal to 1. So, that seems to contradict Fibonius theorem because the indicator function is a non-negative function that the two iterated integrals are not equal, but that is not the case because the measures involved both of them are not sigma not both of them are sigma phi, Lebesgue measure is sigma finite, but the counting measure is not sigma finite. So, this does not contradict Fibonius theorem since the measure counting measure is not sigma finite. The counting measure of the whole interval 0, 1 is infinite and you cannot divide it into countable number of pieces each having finite because 0, 1 is uncountable. So, the counting measure is not sigma finite. So, that is why this does not contradict Fibonius theorem. Let us look at another example. Let us look at two sets. Once again the underlying space is same x is equal to y is equal to 0, 1 and a the sigma algebra on both of them is equal to the Borel sigma algebra. Now, let us look at measures mu equal to nu to be the Lebesgue measure. So, basically what we are doing is we are taking 0, 1 the Borel sigma algebra and the Lebesgue measure and take a copy of it and take the product of that. Let us define a function of two variables f x y to be equal to x square minus y square divided by x square plus y square to the power 2 if x and y is not equal to 0, 0 and it is equal to 0 if it is 0 otherwise. So, the first of all we want to claim that this function f of x y is a measurable function on the product sigma algebra. So, for that one has to look at the basic properties of functions of two variables. One can show that this function is continuous everywhere except at 0. So, it is almost everywhere continuous function of two variables and hence it is going to be a measurable function with respect to the product sigma algebra that is the Borel sigma algebra on the square 0, 1 cross 0, 1. So, saying that f is a measurable function requires a proof and the proof I am giving you a hint. The hint is as follows. Look at this function, this function as a function of two variables. Let me just write down the steps so that you are able to verify yourself later on. Let us look at the function f on x cross y. So, that is 0, 1 cross 0, 1 to r. So, this is a function which we are saying is f of x y x square minus y square divided by x square plus y square square if x y not equal to 0, 0 and it is equal to 0 if x y is equal to 0, 0. So, the claim is this function f is continuous on x cross y that is 0, 1 cross 0, 1 except at the point 0, 0. So, at 0, 0 you can see that if I take y to be equal to 0 that is x square divided by x to the power 4. So, it looks like 1 over x square and as x approach is 0 that is going to blow up. So, it is not continuous at the point 0, 0 but that does not matter. So, that means f is continuous almost everywhere because one point does not matter. So, implies f is continuous almost everywhere. So, this continuous almost everywhere implies f is Borel measurable because continuous means inverse images of open sets are open and hence there will be Borel sets. And to show that inverse image of Borel set is Borel, you apply that sigma algebra technique. So, this we have shown that every continuous function is continuous almost everywhere is Borel measurable. So, using A in this step you will be using the sigma algebra technique. So, look at all sets for inverse images are Borel, open sets are inside and so on. So, this will prove that this is a this will prove that this is a measurable function. Now, let us compute the iterative integrals of this function with respect to the two that measures separately. So, let us first observe that for every fixed x. So, let us look at for every fixed x if I fix x any point then this is a function which looks like minus y square divided by x square plus y square over whole square. So, that is function of y for every x fix continuous almost everywhere except at the point 0. So, it is going to be a Riemann integrable function. So, it is a function for every fixed x it is a function which is Riemann integrable function of y and if you look at the integrable it is the derivative of the function y divided by x square plus y square. So, partial derivative of the function y divided by x square plus y square is equal to f of x y. So, I know the anti derivative of this function for every fixed x. So, I can integrate it out with respect to the variable y. So, when I integrate f x y with respect to the variable y because it is a Lebesgue measure we are integrating and for Riemann integrable function Lebesgue integral is same as the Riemann integral. So, that will give me that the integral 0 to 1 of f x y d nu y is equal to 1 over because y is 1. So, that will give me integral of this is equal to 1 over 1 plus x square. Now that we want to integrate with respect to x. So, integrate this with respect to x and that we know how to integrate this function 1 over 1 plus x square by substitutions putting technometric substitutions. So, I leave it for you to verify that the integral of 1 over 1 plus x square between 0 to 1 is equal to pi by 4. So, one of the iterated integrals is equal to pi by 4, but a simple observation in the function tells me that if I change x to y. So, let us look at the function if I change x to y interchange x and y then you get a negative sign outside because there is a negative x square minus y square. So, that so I do not have to compute the other iterated integral by using this property that if I interchange x and y that gives me a negative sign. So, if I want to integrate first with respect to x and then with respect to y, the answer will be same as the earlier one with a negative sign. So, the other iterated integral is going to be minus pi by 4. So, for this function of two variables we have got two iterated integrals one of them equal to pi by 4 and the other is minus pi by 4. And both the measures here are sigma finite. So, the question is what is going wrong? So, we have got two sigma finite measure spaces actually the same measure space 0 1, Borel sigma algebra and Lebesgue measure. And on this we have got a function f x y equal to x square minus y square divided by x square plus y square when not the point is not 0 0 and this function has got iterated integrals which are different. So, does this not contradict Fubini's theorem? The answer is no, this is simply because though these your iterated integrals are different because the function is not integrable on the product space. So, we cannot apply Fubini's theorem 2 to it. So, let us verify that with respect to the product sigma algebra the function is not integrable and that is a very simple observation. So, let us look at that. .. So, look at the function for two variables. So, let us look at mod of f x y. So, this mod of f x y with respect to two variables this is a non-negative function. So, by Fubini's theorem 1 we know that this is equal to the iterated integral of mod f x y with respect to say variable y. So, that we can because the integrand is non-negative and x is in the inner integral the x is fixed between 0 and 1. So, we can write the iterated integral from 0 to x. So, it will become bigger than or equal to. So, the integral of absolute value of f x y with respect to the product sigma algebra product measure is bigger than or equal to integral 0 to 1 integral 0 to x of mod f x y d nu y. But mod of that is nothing but 1 over x and let us just look at mod of 0 to x here x is fixed with respect to y. So, once you compute that inner integral that is nothing but 1 over x 0 to pi by 2 cos 2 theta and those and that can be computed and that comes out to be 1 over 2. So, it is 1 over 2 x d mu x and which is equal to plus infinity because 1 over x is not integrable. So, the simple computation shows that this function is not integrable. So, as a consequence again the Fubini's theorem is not contradicted because the two iterated integrals are not equal because the function is not integrable. Let us look at an application of Fubini's theorem. We want to prove that if f is a integrable function on x a mu and g is another integrable function on y b mu then look at the product of the two functions f x and g y. So, phi x y is equal to f x into g y. The claim is that this function is integrable and its integral is equal to the integral of f into integral of g. So, let us show this as a simple application of Fubini's theorem. So, we want to look at a function f. So, we have got a measure space x a mu of course, sigma finite and f is a function defined on x and f belongs to l 1 of x. On the other hand, for y b mu we have got a function g y to r and g belongs to l 1 of y. So, we are defining a function phi on x cross y taking values in r and the function defined is phi of x y is equal to phi of x y is equal to f x g y for every x y. So, claim that phi belongs to l 1 of x cross y. So, that is what we want to show. So, let us see how does the proof, how will the proof go? How will the proof of this theorem go? So, phi belongs to l 1. So, that is we want to show mod phi x y integral over x cross y d mu cross mu is finite. So, this is what we want to show. So, to show that it is enough to show. So, let us observe to show this, enough to show because of Eugenius theorem 1 or earlier. So, to show this, this is what we want to show. So, enough to show, say for example, integral with respect to y of phi x y integral with respect to x, this is d mu of y, d mu of x is finite. So, enough to prove this, that this is finite. But let us compute what is this quantity. So, this quantity is equal to the inner one integral over y, phi x y is f x g y. So, it is mod of f x mod of g y d mu of y integral over x of d mu x. So, this, which we want to show is finite is equal to this. Now, this is independent of integral x is fixed. So, this is independent. So, it is integral over x mod of f x. Inside is integral over y of mod of g y d mu y d mu of x. Now, g is integrable. So, this quantity is finite. So, this quantity is finite. So, what is that quantity equal to? So, let us write what is this quantity equal to. So, this quantity is equal to... So, this is a constant. It is finite. So, it comes out. So, I can write this quantity is equal to integral over x mod of f x d mu x integral over y mod g y d mu of y. And that is finite, because both of them are finite. So, what we have shown is that integral of mod of f x y, the iterated integral is finite. So, that just now we observed that is equivalent to saying that the function mod f x y is less than finite. So, this will imply that phi belongs to L 1. So, phi is L 1 function. So, now, so we have proved. So, let us just say, so this last thing that we proved implies that phi is L 1 because of product space L x cross y. Because it is in L 1, so Fubini's theorem is applicable. So, implies by Fubini's theorem 2 that the integral over x cross y of phi x y d mu cross mu is equal to the iterated integral either one we can write.  And that as now just now we have observed, this is independent of the integral is independent of y. So, this you can take it out. So, this is equal to integral over x f x integral over y integral over g d nu d mu. And that is precisely, so this integral that we have written is precisely equal to integral over x of f x d mu x, the first one and the second one is integral over y g y d nu y. So, that is that is how Fubini's theorem is applied. So, you have seen that 2 applications of Fubini's theorem to prove this result, namely that if f is L 1, so if f is a L 1 function, then and g is a L 1 function on y, then the product is a L 1 function on the product space and integral is equal to the product of the 2. So, this is how Fubini's theorems are going to be applied. And so, let me just recollect or revise what we have done till now. Given product, given product measures x a mu and y b nu, which are both sigma finite, we constructed the product sigma, product sigma algebra a times b, the product measure mu cross nu. So, we got the product measure space x cross y a times b and mu cross nu. So, for this product measure, the first thing we did was how to compute the measure of a set in the product sigma algebra. So, we said you can go away as sections. So, that gave us that the product measure mu cross nu of a set E same as you look at the x section E x, look at the measure of that mu of E x and integrate with respect to x or similarly do with respect to y. So, that gave us ways of computing the product measure of a set in the product sigma algebra. And that result when interpreted as an integral gave us the first Fubini's theorem, namely for non-negative measurable functions, you can fix one variable at a time and integrate it out and then we extended this to functions of to functions, which are not necessarily non-negative but integrable. So, those gave us the Fubini's theorems. So, in the next lecture, what we will do is we will now specialize when x is the real line, y is the real line, A is the Borel sigma algebra, B is the Borel sigma algebra or Lebesgue sigma algebras and look at the product measure, Lebesgue measure, product of the Lebesgue measure on x that is real line and product measure and Lebesgue measure on y that is again real line. So, we will look at the Lebesgue measure space on the real line and take its product with itself to come to a notion of a measure Lebesgue measure on the plane, which will extend the notion of area in the plane. So, we will continue this study in our next lecture. Thank you.


Hey guys, welcome to Archland. We're gonna be doing some summons here for semi and hopefully we could bring her home and After this one if we still have enough actually I'd like to pull for The banner of Erica. So let's start off with seminar here semi seminar. I don't know if it's really seminar But her name is semi, but anyway, um if I have extra I'll pull for Erica's banner because I want to get her then after that I'd be saving for the next banner I hope that it's What they call this going to be a good banner for the next one But for the time being I'm going to be pulling for semi. So let's I have five Definitely, but I am I have some you know I have some this one. This is your gems here. So I still have I think two extra pulls after the 50 So let's start Hopefully I could get her here Within the next three 30 pulls probably so this is the first one So none So hoping that let's go out and do some more pulls outside So this is this is it. This is it. This is it. This is going to be it again another dud, so we have 20 pulls already and Nothing so far, but good that I have a lot of yellows. So this is the third This is for 30 Thirds There's the lucky one, right? No, oh my god So we have 30 pulls and still man This is bad 30. So 20 more 20 more pulls 20 more pulls. Hopefully this is it already done My god So this is 40. Oh Let's pull here. This is 50 shoots Still nothing. Oh my this is 50. Oh My Beginning yellows all day Let's do 60 here.  It's an off-banner pull which I was actually needing as well but So I didn't get semi so might as well be contented with this pull But that is it guys. No semi for me And I don't have you know, I don't have What do you call this? I don't want to reset the pity for this banner because that will cost me more So I'll save all my summons for the next banner. So thank you very much guys for staying this far Take care. Stay safe. It's the warden and I'm out of here


Futakomo applauded Sims and Gemma for choosing love over bitterness after break-up. Businesswoman and former beauty queen Futakomo has praised actress Sim Faiwee Sims and Gemma for speaking highly of her baby daddy Tino Cignani even as she announced their break-up, saying it takes a mature person to handle a break-up the way Sims did. Sims sent her fans into a state of confusion when she announced that her relationship with model and baby daddy has come to an end. More than the break-up itself, fans were shocked at how the announcement read like a love letter as Sims sang Tino's praises and still professed her love for her co-parenting partner. The actress's choice of words and tone of her post made it clear that the break-up was amicable and Futakomo took to Sims's comment section to applaud her for her approach. To whom it may concern. We always expect our fellow sisters to be bitter and filled with blinding rage during break-up-s. That is why no one will see love in Sim Faiwee's post. On the surface, it looks like a break-up post but if you actually read what she wrote intently, and the pictures on the post, you will realize that this post speaks of a love celebrated between two people and a love for a child, said the former beauty queen. But this said she especially loved the way Tino and Sims handled their break-up because they have a child to consider. The decision to speak highly of one's former partner and to co-parent comes from love. It takes a different kind of love to make those kinds of decisions after the decision to move away from the person you had in your heart. But I understand how not everyone will see that. It takes a person who comes from love to see expressions of love, even in the most unideal circumstances. I love the love and maturity that Sim Faiwee is showing in this post, but this said, in her Instagram post, Sims, who has one baby, Tyani, with Tino, said she appreciated the contributions he made in her life and they intended on staying friends and co-parenting their son. An end to a beautiful love story. This has been one of my greatest experiences, a beautiful love story of two people fighting all the odds to be together. I have learned to love again, to feel again, to live again, and to smile again. I will forever be grateful for everything you have taught me. I pray that God gives us the strength and wisdom to raise our beautiful son. Tyani Cignani we will always be great parents to you and we will always be there for you. The actress added that she was grateful for the lessons and memories and said she still cared greatly for Tino. No tears here, just lessons learned and beautiful memories. Ears to friendship and dope co-parenting. Tino, take care of yourself. Love you forever and always, she wrote.