Hello everyone, I'm Tabitha Sable from Kubernetes 6 Security. During the day, I work at Datadog. Hi, my name is Ian Coldwater, co-chair of Kubernetes 6 Security along with Tabitha. During the day, I work at Twilio. And we are the co-chairs of Kubernetes 6 Security, which is a new SIG to the Kubernetes project. We're new, we're super excited to be here, and we would like to tell you about us. So where did the SIG come from? What's up with this? Why now? What are we doing? Let's talk about it. So SIG security evolved from the third-party security audit working group. The original founders of the SIG, who were the people who ran the working group, recognized that more could be done to promote security in Kubernetes across the project and over time. So they decided that expanding the working group into a SIG would be one way to help them do that. So they wrote the charter, did all the applications and paperwork, and transitioned the working group into a SIG. They also recognized that it was really important to build community, to establish a successful cross-sig effort, as well as reach out to the external security community and get the external security community involved in the security of the Kubernetes project. They asked us to come help with that because we had experience building communities. We were super excited to do that. So we're here to help build community, hopefully with you. What does the SIG do? One thing we do is to try to foster security knowledge sharing in the Kubernetes project across SIGs and among contributors. We also want to encourage people from the external security community to come get involved in the security of the Kubernetes project. We want to make it a kind of coalition community building effort. And in pursuit of that, we've built our SIG as a community building effort. This is important, both because we think it's important and for historical reasons too. Historically, Kubernetes hasn't really had a place for people who are interested in helping with the security of the project to have a home. Security-minded contributors could traditionally go to SIGAuth or other SIG efforts that kind of had security involvement. And I think part of that was the thought that security affects all parts of the project. And that makes sense. But also that could leave newer contributors confused because they were like, where's the security place where I can go? So one thing SIG security does is helps provide that form for them. One thing Kubernetes has had, historically, is the Product Security Committee. But the Product Security Committee isn't public, so that wasn't really a place where they could go. I can't speak to the Product Security Committee, though, because I'm not on it, but Tadatha is. I'm delighted to report that another service that we can provide to the Kubernetes community is to offer up our Slack channels and scheduled meeting times and eyes and ears as a public forum for the Product Security Committee. So, of course, most of the work that's done day to day by the PSC has to be private by necessity because of the nature of the work. As the PSC, we are really here to serve Kubernetes as a community and as a software development project. And so while the work may be private, the planning that goes into how the work should be done, how the work should be prioritized, how we should interact with the rest of the project, really should be a community project. And before SIG Security, getting that sort of community input to drive the PSC's direction was a lot harder. But now, when the PSC has concerns, they can bring it to the broader part of the security community by coming to SIG Security. We believe that building community rather than being non-technical actually helps technical excellence because when people work better together, people can build better systems together. When people are communicating with one another, things that might be missed if people were in silos are more likely to be seen. So we've really built this SIG on purpose as a community forum, as a community building thing so that people can come together across SIGs and outside of the community and the project to be able to work together to help build Kubernetes up better. So we want to encourage SIGs and contributors to work together beyond security issues by security people because we don't actually think that those silos are what we need. We think that increased collaboration means a better outcome for everybody and that's a big reason of why we're here. And we have built our group that way on purpose. When there are issues that people see that they believe are security relevant within the Kubernetes project, they can come bring them to SIG Security and bring their ideas, bring themselves, bring their input, and then we can all look at it together as a community and try to figure out what we can do to help. We can also encourage SIGs to talk to one another. One example of this is our work with SIGAuth on the pod security policy replacement effort. Tabby, you want to talk more about that? Yeah, yeah, absolutely. So pod security policy has been a feature in Kubernetes for a very, very long time. If I remember correctly, it first had its alpha release in 1.3 and from the beginning, pod security policy evolved over time as Kubernetes evolved as the pod specification evolved. And so as that evolution happened, it became more and more apparent to users and to SIGAuth who were taking care of it that pod security policy needed some love. But it was really difficult for it to find the love that it needed and to really get a good concrete way to move it forward beyond these limitations. So we wanted to help with that. We brought ourselves to SIGAuth and we heard what their concerns were. And so then we applied the experience that we have as Kubernetes end users to writing a proposal for a replacement for pod security policy. Tim Alcler from SIGAuth wrote another proposal that was different but working to address the same kinds of concerns. Then together with Tim, we were able to bring both of those proposals to the community in SIG security, to the community in SIGAuth and really iterate on both of those proposals together with all of those community groups. You know, this resulted in the creation of a temporary spin-off meeting for iterating on these ideas. And people really responded wonderfully. The both proposals improved really dramatically as a result of the input that all of the folks from SIG security and SIGAuth and from the broader Kubernetes community put into them. Eventually, Jordan and Tim synthesized those two proposals into yet another proposal that combined the strengths of both with, you know, getting rid of most of the limitations of both as well. And that's the proposal that has moved forward into the cap that you're able to see today. And we think that that kind of collaboration between different groups of people was really key to how we were able to get from a difficult problem that had eluded us for quite a while to a concrete potential solution that addresses a lot of people's concerns in a relatively short period of time. We all focused our energy together on it. Speaking of doing things together, another thing that we do is we help encourage new leaders in Kubernetes by encouraging people to come with their ideas and start subgroups if there are people who are excited about implementing these ideas. Two subgroups that we have going, which are really awesome right now, are the subgroup for security docs and the subgroup for the security audit. And we're going to hear from two of the leaders of those subgroups talking about their work there. But first, I think Tabby wanted to talk a little bit about what's going on with security docs and some of the things that SIG Security is involved with helping them with too. Yeah, yeah, SIG Security docs has been doing some great work picking up some efforts that had been taking place previously in SIG docs and some other efforts that had really been a twinkle in various contributor's eyes by providing a place for all of those things to take care of. I think Savita will actually do a better job of explaining it than I will. So I'll leave it to her. My name is Savita and I am going to talk about the subproject SIG Security documentation today. So what do we do there? We work on improving the overall security documentation in the Kubernetes website and we do it by going through the existing content and adding supplementary security guides and tutorials. We look through the examples and make sure they have the right security context in them. If not, we create a PR and fix it. We also remove the old and deprecated security content from the website. One of the major goals of this subproject is to create a platform for new and existing contributors to come together and talk about their passionate security topics and share and learn together. The beauty of this subproject in creating all these guides, examples is that all the content spans around various special interest groups and thereby it brings people together. It creates a medium for collaboration and it also pays way for continuous improvement in the form of good reviews and feedback. This is also a good place for someone who is starting out who wants to know and learn about Kubernetes. They can do that slowly and steadily. For example, there is a new contributor who wants to improve an example in a persistent volume page. They can do that by start talking to six security, six documentation, six cloud provider, six storage mainly, and so on. There could be more six involved but these are just examples. They can, by doing this, they will get some more knowledge around this area and they can grow from there. If these things are interesting to you and you want to contribute here so you can do it, we are working on a Kubernetes hardening guide that is targeted towards the cluster operators and it will help them secure the cluster when they are provisioning it. This can be treated like a best practices guide. We have identified various subsections in this guide and we are looking for contributors who can pick a section or two and start discussions and eventually create a PR for their subsection. I want to give a special shout out to Rory and make him for putting this guide and the base structure together. Thank you, Rory. If you are a new contributor and want to learn and you want to participate in the discussions, you can do that by attending our meetings that happens every first and third Thursdays at 6 p.m. UTC that is 2 p.m. Eastern. And if this time is not right for you and you cannot make it for some reason, we also have a Slack channel say Security Dogs and we encourage asynchronous collaboration so you can stop by there. Say hi, post your topic and discuss away. If you have, there is also another place where you can start contributing to security stop by the Kubernetes website and you can filter through the issues and PRs based on the label security and you can pick an issue or you can review a PR whichever that interest you start discussions provide feedback and in case if you are going through the Kubernetes documentation for your work or for some exam or for your personal reading and you come across a page where security can be improved, we would request you to create a issue in the Kubernetes website tag it with security and if you're interested you can create a PR and someone or the other will be there to review and provide some feedback. This is how you can help us make the Kubernetes security better and better. Thank you everyone. Happy honking. Thanks, Samantha. I'm really excited about the things that our Dock sub-project is doing and I'm really excited about the way that we are all working together to help level up contributors. People who are newer people who are learning and people who want to come be future leaders in the project. I'm really excited that we're able to do this and with a security lens I think it's really great work and I'm so glad that it's happening. I'm really excited about the hardening guide too. So another thing that is happening on an ongoing basis is the third-party security audit. As we said earlier SIG Security came out of the third-party security working group and that is a thing that the CNCF is having happen on a cyclical ongoing basis. Right now, as a recording time we have a request for proposals open for vendors who want to be involved in that process but actually I bet I can't speak to this as well as Aaron can so I'm going to throw this to Aaron. Take it away. My name is Aaron Small. Ian and Tabitha asked me to join them and give a brief update on what's going on with the third-party security audit. So our job in short is to facilitate a third-party vendor to come in and perform a security assessment of Kubernetes, help them find vulnerabilities and get them fixed. We're also looking to find these horizontal architectural choices that exist across Kubernetes that may be hindering our security generically and get those fixed as well though those tend to resolve over much longer timelines. And finally we're looking to engage the broader security community. When you publish findings on an audit that's this large and this visible what can happen is what we're hoping happens is independent researchers around the world look at what you've done look at your findings and think to themselves I think I could have done better or I don't think you went far enough or I think you missed something really important and then we can take all that interest and all that excitement and we can funnel it right back into the public bug money program get those researchers paid and make Kubernetes more secure. So this year we're focusing all of our research on this list of components. The last audit we ran in 2019 spent a lot of energy on threat modeling and understanding the relationships between components and how threats might propagate through the environment. We've selected this list because we think they're really critical from a security standpoint and we didn't pick every component because we need to strike a balance between breadth and depth. If you don't go broad enough then you don't build confidence that you've looked in all the right places and if you don't go deep enough then you're not going to find the really critical stuff. You spend an hour looking at a component you might find a surface level vulnerability but if you spend much more time on that component you might find the one that is business ending for someone who uses Kubernetes. So we want to go deep enough to find the good stuff. As we go through the process of evaluating these components adjacent stuff is going to come up we're just going to use the public bug bounty program scope to determine if they're in or out. Rule of thumb would be if it's part of Kubernetes Kubernetes or one of the other repos it's probably in scope but if it's related to a specific deployment technology or related to a specific distribution it's probably out of scope. So as I mentioned before the first third party security out of Kubernetes finished in May of 2019 that audit generated a lot of excitement. We have a talk here people were very interested very engaged and we wanted to channel that into making these audits recurrent making it part of community's process. And we also lobbied for the creation of security which is now up and running and doing really great work. However 2020 was really hard on a lot of members of our community and it slowed us down but we did finally publish our first request for proposal for this audit on February of this year. However we've only received one proposal thus far so I don't think one proposal is sufficient for us to make a good assessment and pick one. So we're excited to relax our timelines a little bit wait for more proposals to come in because we want to focus on having a really high quality audit rather than one that turns around really fast. One of the reasons for this delay appears to be high demand right now in this space. Personally I can attest and other people on the subproject have mentioned that they're having a hard time getting a vendor engagement on audits even for smaller corporate projects. So we'll relax our dates we'll get in the proposals we'll select one our selection criteria by the way is all public as is our evaluation of the proposals from last audit and the final proposal that we did eventually accept all this is available on the GitHub repo. Anyway once the RFP closes and we select the proposal we're going to need to come back out to the community and ask for your help. So the reason we need your help is really simple communities is really big and moving really fast. We have 6.2 million lines of code when I ran that command right before I recorded this and also about 240 commits one week in February. That's big and that's fast and it's not reasonable for us to expect a vendor to come in and know right where to start and how to dive in. We are selecting for vendors that have experience in the space experience with Kubernetes experience with open source projects but we need more depth than that. So the subproject members will be facilitating interviews with leaders around the Kubernetes project. SIG owners people who have been here a long time anyone who knows where the bad code is we're going to want to talk to and point the researchers where their time is most valuable. After these interviews and potentially with some overlap they'll go about the process of building out an environment. They'll use this environment for dynamic analysis of a running Kubernetes cluster as well as the static analysis that they'll also do. As this process is ongoing vulnerabilities will start to come out and we're going to take these vulnerabilities and send them straight to the product security council following their standard disclosure process. We won't be disclosing them as they come out to the public though at the end of the audit we are going to take all of the findings all of the research and all of the the writings that come out of it and share them publicly just like we did last time. Though there may be some delay if there's a disclosure timeline we need to follow for the safety of Kubernetes. We're looking for more help we're looking for more engagement on this. Please come join us in the SIG Security Slack channel. You can also reach out to myself or Ray directly Ray is the chair of this sub project and he'd love to hear from you. I hope to see you there soon. Thank you so much for your time and I'll see you around. Thanks Erin. As Erin said one way that you can get involved with SIG Security is by helping point vendors to the third party security audit if you have relationships with anyone in that line of work and there are lots of other ways to get involved with SIG Security too. We really want you to come and bring yourselves your concerns your project ideas things you want to see happen whatever thoughts you've got to our meetings and to our Slack channel we would love to hear from you we would love to have you come get involved because security is everybody's responsibility and the more we work together the better we can make it together. Also while we're on the subject of sub projects our sub projects are born from ideas and people who come to us with these ideas and have people respond to them.  The sky is the limit really security is an enormously wide field there's lots of opportunities for growth lots of work to do we would be so excited for you to come help us do it. Another way What else can we do Tabby? Sorry. Another way that you can that you can participate is with a simple slash command on GitHub. So if you apply the label SIG Security by typing slash SIG Security into an issue or a PR it will label that with our label and by doing that you'll get it on to the list that we review periodically before meetings and then those issues get brought up for the interest of the community and so sometimes that means that there is a huge level of interest and a great deal of attention that gets paid to that issue. So if you have something and you think this seems like it has a security smell to it if you aren't really sure what to do next there one thing that you can do with that is put the SIG Security label on it and I think Ian has something to add here. One thing to note though is if you have found a security vulnerability in in Kubernetes you should not come and bring it to a public GitHub issue or necessarily a public meeting that is what the product security committee is for. We do have a security disclosure process and above bounty so I recommend taking a look at that but if you have kind of security topics that can be spoken about publicly we would love to have you come and speak about them and we would love to hear from you. We're really excited to see you come and get involved come and bring yourself come bring your ideas we want to hear them thanks. Thank you so much for coming and sharing bye. Bye.


Hello, and how are you doing? Welcome to Abadji Talk. Gordo, the techs are here. I'm here with my good old buddy, Papi Chulo, who's in the house, filling in for the security guy, Andrew Lanning, who once again is traveling around the globe, spreading the word on security. Well, spreading something. I don't know, spreading the Aloha. That's what he's doing. Anyway, we have with us today Pete Insall. He's our guest today. He's a security architect for Presidio West Coast. Yep, that's correct. So we're going to talk about secure network architectures in the cloud and some things that are happening in that space, which is kind of interesting. You can tell by this pale skinned Hollywood boy that is his first trip to Hawaii. And you don't get much paler than that. And thank God there's someone paler than me in the house. He blends in with his shirt. Hey, thank you. Nicely worth his shirt. So it's great to have you on the show. We have a few segments. We do a little bit of news. We have this thing, you know, got one tech job. And then we'll we'll get into your background and things like that. But before we we'll do, we'll get out of the way. You know, got one tech job. You know, feel, feel to feel free to comment any time when this is the latest one that is actually down the street from where I live. You got to take a little close look at that photo. That is a lamppost. And that is the light for my street. It's been like that for, oh, I'd say we're coming up on three months. It's been down three months. That's how it is. But I tried to figure out what the problem was. And then I remembered when I was with the city, there's a thing called the joint poll committee. So it's probably in the committee right now, trying to determine who's got to fix it. Because the poll itself is one committee or one department. The arm that holds the poll is another department. And the end is another department. So that's probably going through its due diligence right now at the joint poll committee, at the sitting and counting of Honolulu. Who was in trouble when somebody crosses the night without the light and gets hit by a car. OK, well, then that's going to be another story. By the way, there's a crosswalk just up the street from there. So you nailed it. And that's all you got to do is have someone happen there. But anyway, we're on it. We've got our stuff on the upside, taking care of everything, sitting and counting of Honolulu. So security in the cloud is kind of an interesting thing. But before we get there, tell us a little bit about yourself. So where are you from? Where did you go to school? Did you go to school? Yes, home school. Yeah, interesting background. So I've been a little bit all over the map. So I was a military brat for years. So I've been all over the United States and Europe as well. I was actually born in Germany. But I ended up, myself, ended up going in the military. I actually ended up going to Texas A&M University for engineering degree. Didn't finish that up. Ended up going in the military. And I was stationed in the Navy on submarines. OK, so you were a Navy, and you were? Army. OK, so we like each other. So it's funny you like each other. Now, do you have any unique and interesting stories about getting arrested the first time you were assigned when you were stationed somewhere? Not that he had it happen to him. No, no, he didn't get arrested. He got a ticket for jaywalking. Nothing that I can disclose publicly. Well, this was the same. All I know is his uniform was wrinkled. So, by the way, you're looking pretty tan.  Thank God I worked so hard for a living. I wouldn't mind borrowing some of that. Yeah, oh, look at that. There's a contrast. Oh, wow. That's scary. Just wear a lot of sunscreen. You know, when you spend all your time in a submarine, this is what happens to you. Oh, that's true. You're deprived of sunlight and other things. Yeah, you ever get cloudy day syndrome? Exactly. You're stuck inside. So you were in the Navy, you got out of the Navy, and where did you say you went to school in Texas A&M? Yeah, I went to Texas A&M originally, and I was going for an engineering degree, mechanical engineering, ended up going into the Navy after that, never finished out, finished about two years of my engineering degree, and then ended up going to the Navy, and actually was a nuclear chemist in the Navy. So I did radiation protection and reactor chemistry on a sub. That explains the color of your skin. That explains why I'm a little wider. Yeah, am I glowing? Am I glowing now?  I love you on this show, man. You're the best. So yeah, after I got out, I got interested in information technology in the late 90s and started pursuing that, ended up relocating and landed in Florida, ended up. But wait, Florida has sun. Yeah, Florida does have sun. And unfortunately, I didn't spend enough time in it. Yeah, obviously. So yeah, I ended up going into network engineering, my first job for a large insurance company, Liberty Mutual. Ended up starting to work for them, and I kind of progressed and ended up getting into security at that time, and kind of went from there, and that became my passion. And that was in the mid to late 90s? Yep. And so think of what, I mean, in your young career in doing this, how much has security changed over the past 10, 15 years? Night and day difference. The entire concept that we started with is cloud concept, public cloud. What is that, right? The internet was just starting out the dot-com days. So it just shifted the whole world.  And so, and we'll talk a little bit. Let's talk a little bit about that. So give us a definition for our viewers. What is the cloud to you? What is the cloud? No, that's something that he hasn't seen much of because of his suntan. But the cloud. Well, the cloud by definition is, well, cloud that goes out of my head. Let's only try to put together the right definition, but effectively it is services being delivered from outside of the organization is the most common. So if you're getting services from a bank and they're using their computer system and such, our house somewhere else, maybe managed by someone else like Presidio, then that would be in the cloud. Versus if they had it in their own location. Well, there's a couple definitions here. And it's really hard to explain this, but there's a concept of private cloud and public cloud. Private meaning you fully have control of this environment, which you're making available. All these resources available to all these end users. But you're controlling it in a fashion that allows you to deliver it with some degree of separation. OK, within a box, OK. And then public is, it isn't your environment. It's hosted in somebody else's environment, but you're using their services. So for example, I mean Netflix, Google, they're all technically cloud services. OK, and they're public or private? They're public cloud services, right? The end user is consuming those, yeah. And they're public services. So if I'm using like Microsoft Office 365. That's a public cloud service. That's a public cloud service. If I'm using ABC Bank and all of that stuff is in theirs or a secluded data center that they control, that's a form of private cloud. It's got some gray areas in there. I know, I'm just trying to get where you can define the lines, which show how complicated it could be. So just think about, so now you specialize in the security side of this thing, on the security side. So you've got all these different types of clouds, and then you've got to secure it. Now, he's in security too. Now, but he's in the wetwear side. We finally educated him. Wetwear is people, 90% or whatever it is, water. That's who it is. And then you've got the software side and the hardware side. What's the worst side? The hardware software or the wetwear, the people side? Oh, I think people. Yeah, guaranteed. People, hands down. I mean, you can do everything you can to secure everything, but at the end of the day, you're working with people. And human error. Human error or human intent. Yes, human intent, human error. They can do all of those kinds of things. Lots of harm. Lots of harm. So tell me, what it is you do? What is it you do? As a cloud security architect. So I spend most of my time educating and talking to customers how best to protect their data. Whether that be delivered in their own data centers, whether that be put into public cloud environments, for example, like we just talked about. But it's about putting together the right type of security solutions. But I'm mainly on the technology side, but like we just talked about, people are the biggest problem. So I like to talk about the people aspect of things as well. Not just focusing on how technology can solve the problems, but how do we help get awareness on the people side? Or how do we help control the people side? And then we use tools to help control the people problem that's going on there. Now you were saying earlier on today, there's a cloud is a growing industry. Yeah, yeah. So cloud services are expanding. What did you say, 37 billion? 37 billion, yes. It's expected to expand or top 37 billion this year. So that's 37 billion spending in cloud services, providing cloud services? Yeah, it's all cloud services combined. That's things from Amazon. That's things from Microsoft. That's Google's cloud services. All these other cloud services are it's going to be a roughly 37 billion dollar market this year. 37 billion dollar. And your job is to make sure all of that 37 billion dollar market is secure. Not all of it. No, wait, that's right. You've only got the West Coast. So not a problem. You got that under control. It's only one small person, one small. So that's a huge, do you see this growing? Yeah, cloud is the trend of the future right now, as we call it cloud. That is the trend of the future. Every customer is looking at cloud services, public cloud services specifically, if they haven't already adopted it, they're already there. And they're there without even knowing about it, because guess what? We're all consumers of Google services, Facebook, you name it. We're all consuming these public software as a service offerings that are ultimately underneath the noses of a lot of organizations. So is it safe to say that if I'm on my mobile device that and I'm going Facebook or LinkedIn or that I'm on the cloud? You're all on the cloud. So anyone that's sitting out there thinking, well, I'm not on the cloud, they're on the cloud. They're on the cloud, yes. Unless they get a flip phone and it's only the phone and it doesn't have anything else. But even then, that dial tone is coming from somewhere. That's true. And that carrier could be in the cloud. That's true. Providing it's turned down though, right? The cloud, the system has to be on your phone for it to go. Well, your phone has to be on. That's true. That's a good question. I didn't have this, the cloud was out there on Verizon. I said, where's all my stuff? Oh, it's in the cloud. Oh, you didn't turn yours on. So whatever you thought you saved is not safe. It's the best security. If you just turn off all your electronic devices, you're more secure. I'm in the cloud, the app. Your app itself was not there. But you were on the cloud from a dial tone perspective to make the call, right? But not from your data side. So a good point. But if you have the app and you don't turn on the app, it's not going to the cloud. Your photos aren't going or things aren't going.  And so that's still in the, is that safe to say, in the cloud? Yeah. And all your data is stored there too. So here we go. So data's in the cloud. And we agree to that by signing on that long. Yeah, it's called a eula that no one reads. Yeah, nobody reads it. No one reads it. So you got the eula. So you got to cloud the data. You got to protect applications that are running on the cloud, client things, and so on. All this kind of stuff. So we're going to have to take a short break. It's amazing. We just cranked through 15 minutes. And I feel like we haven't even scratched the surface of this cloud. It is. But let us do that. Let us do a little short break. We'll go get Angus. He's got a new gadget, I think, this week, and a new Scottish sign. And you haven't met Angus? No, no, I haven't. And I can forward to it. Oh, yeah. And I hear your English. Oh, my goodness. Wait till he finds out. Anyway, we'll be escorting the techs out. Puppet you low. I forgot your name for a minute. Puppet you low. I was here like, what goes? And we're here with Pete Insall from Presidio. We'll be back in a minute. You're watching Think Tech Hawaii on ThinkTechHawaii.com, which broadcasts six live talk shows from 11 AM to 5 PM every weekday, and then streams earlier shows all night long. Great content for Hawaii from Think Tech. Hi, I'm Chris Leitham with The Economy and You. And I'd like to invite you each week to come watch my show each Wednesday at 3 PM. Hi, I'm Donna Blanchard. I'm the host of Center Stage, which is on Wednesdays at 2 o'clock here on Think Tech. On Center Stage, I talk with artists about not only what they do and how they do it, but the meat of the conversation for me is why they do it, why we go through this. A lot of us are not making our livings doing this. And a lot of us would do this with our last dying breath if we had that choice. And that's what I love to talk to people about. I hope you enjoy watching it. And I hope you get inspired, because there's an artist inside G2. Join us on Center Stage at 2 o'clock on Wednesdays. Bye. Aloha, everybody. My name is Mark Shklav. I'd like you to join me for my program, Law Across the Sea, on ThinkTechHawaii.com. Aloha. Aloha. My name is Danelia, D-A-N-E-L-I-A. And I'm the other half of the duo, John Newman. We are the co-hosts of Keys to Success, which is live on Think Tech live streaming network series weekly on Thursdays at 11 AM. Aloha. Aloha. Welcome back. And we're here to see our good buddy here, Angus. Angus, it's all of you now. Hey, there. How you doing there, puppy? You're looking a wee bit broon. That's how we see him sculling you. You're broon. You're broon. Yeah. And your guest is a wee bit peckish. I see that, too. He's like, yeah, it's nice to see someone here a little bit more pale than me. Well, almost pale to me. And so that's the English name, you know that.  Just so you know, the bruises were in there. And you never stood a chance. Anyway, we forgive you. So just keep all your stuff done in England. Scotland will see you when they did ever again. Anyway, so I've got a couple of things. I got a Scottish sign of the day. And I put this up especially so when the English come up into Scotland, they can know where it is. This is a bus that's been a working. And when our bus is in our working, it says, ah, we no more than service. That's how it is. Ah, we no more service. That's the bus, the Scotland area. So that's how we're going. Anyway, you know, I always go out and try to find a new innovative gadget. So I got a new one today. It's so innovative, you can't buy it. It's a fan you put on your motorcycle to charge the battery or your iPhone. It's called an iFan. Can you beat that lad? It's an iFan. Easy, but you know, it's awesome. It's not Malaysia. You can't buy it yet. It's designed in Norway. And Norway's really good at saving energy. So I think they're gonna come up with it. The trouble is, they're gonna charge us too much, I bet. But anyway, it's called the iFan. Watch out for it. It's kind of really cool. Anyway, that's my gadget. That's my punch on the English. It's my punch on the Papi Julo. It's nice to see you all again. And remember, everybody, let your wing gang free. We're ready to be. Hello. This is so funny. Look forward to being a guest host. One day I'm gonna take over the show, one day. We'll do it all in Spanish. We'll do it all in Spanish. Oh, that's too funny. That's too funny. Anyway, we're here with Peter and Saul from Presidio on the West Coast.  We're talking about securing the cloud. So what are some of the biggest challenges you have in trying to secure companies' applications and data that are on the cloud? Well, a couple things that come to mind is a lot of times we just talked about that a lot of times organizations haven't actually identified what their goals were for going to the cloud. What are they actually trying to protect? The first thing we need to do in security is identify what we're trying to protect. What are our threats? What are the vulnerabilities, our exposure? So we always start with risk assessments. So that's one challenge is being able to identify the need that a risk assessment is critical whenever we're looking at the cloud or we're moving in the cloud. The other thing as part of it is what are the applications and that kind of data we're going to be putting in there, right? Is this sensitive information? Is this credit card? Right, is this credit card? Is this healthcare information? Because now we need to treat that a little bit differently and we need to provide proper security architecture around that. So there's a number of those considerations as well. So, but people, go ahead. It'd be like considering who has the right to that information also because they have different levels. Yeah, that's right. Because I'm on the same web network. I don't have any business looking at this guy's PII when it had nothing to do with me but I have a level of security clearance. But security clearance, exactly. It's a principle of least privilege that we try to apply for anything. And PII is public? Personally identifiable information. Personally identifiable information. Exactly. I was off for a couple of weeks. I was off for a couple of weeks. You're obviously a rank and he was officer. He was one of us, yeah.  I was off for the last couple of weeks. No brain is right. You're still working on it. So there's that. So what about compliance? Yeah. Like there's PCI, HIPAA. Yep, there's CGIS, there's ITAR. We can keep going on and on about every type of compliance. So when I hear this, then I start panicking out and say maybe I shouldn't go to the cloud. No, actually, really the biggest thing that needs to be looked at in these public cloud environments because really that's what we're talking about here. These public services that you can put your data in. It's just knowing what the potential risks are and how you can actually secure those environments. What they have natively to offer security to you but what else you need to do to protect your information out there. But they are compliant. They are compliant. Now how much further ahead do you think that the cloud providers are then, and this is a loaded question because I already have my opinion, but the cloud service providers versus the people that are doing it in-house with limited, I'm coaching it, limited talent and resources. When you've got like, I bet AWS and Amazon and Microsoft got a lot of people doing security. Yeah, they have some of the better security teams that you can ever find. It's just the reality is Amazon and Microsoft, they have some of the best security teams out there and they're going to know how to secure their environments better than most customers can themselves. Now it doesn't mean that a customer that puts their data in there doesn't have a responsibility to equally secure their information because at the end of the day, there's not a, there's a concept of a shared responsibility. Right. So everybody's- Like a poll committee. Yeah, exactly. The shared responsibility. So, by shared responsibility, so I can use like the endpoint. Oh, there you go. Cloud, let's not say cloud services statistics. There's the 37 billion in 2016. Yep. So I have another slide, Missouri, if you can find that, would it be this a dirty dozen cloud security concerns? Oh, here's what we're protecting. Oh, hold it, hold that one. That's great. So this is what we're protecting. This is a great picture. This is the value of a hacked company. You know, a lot of people think that it's just data that they're trying to protect but there's a lot more information. When cyber criminals are going after a company, they can exploit and get access to a lot more information through different means here, right? They can go through partners, they can get access to the cloud services a company has and get access to the financials, the assets that they own.  It goes far beyond that. Yeah, you look at the slide, you've got physical aspects, you've got the HR data, you've got financials like you said, virtual, all those kinds of things that are being protected. Yeah, even whether you're in the cloud or whether you have to do it on-prem, on your, it's the same thing. And do you have the talent that can do that? Exactly.  You know, even though it says cloud security concerns, when I look at this, it's security concerns no matter whether it's cloud or not, right? I mean, how can it just be cloud data breaches? How many data breaches that we heard of, that I know of, from local firms that have their own data center? Well, what this comes from is, this is actually a survey put out by the Cloud Security Alliance for this year, actually. And it's a ranking of for cloud services, what are the highest risks and threats for cloud services? And this is ranked according to some of the concerns that are out there from professionals and everybody else. And where do we see the highest risks? And actually, you know, data breaches being number one, that's top of mind right now. Right, yeah. We're seeing hacked companies everywhere. So, of course that's top of mind. That, you know, the second one. Yeah, what's credential management?  And how is that information being transmitted back and forth? How do you validate that it was you that logged on to a particular service, right? And that's where you've heard things like, have you heard of two-factor authentication?  That code, that's two-factor authentication, exactly. And that should be, I would say, commonplace. It should be the norm. Unfortunately, there's so many organizations that have no concept of that today. Yeah, and I would say if you look inside the organizations, and I could point this out, organizations that are running their own data centers in their own facilities, see if your sign-ons are two-factor authentication. Do you change your passwords every 90 days or 60 days, whatever it is? You're not allowed to reuse passwords. There's a whole set of rules that should be followed, right? The governance. Yep, that's the governance. That's the governance that I can guarantee you that most in-house-serviced organizations that don't have to be regulatory components. Yeah, we find that the higher the regulatory requirements on the particular customer, the tendency that they happen to have better security hygiene, as I like to call it. Oh, yes, we've heard that word. Yes, exactly. Mr. Lanning uses that word a lot. Yes. So what about there's an insecure APIs which are application program interfaces? Correct. So that's number three. A lot of people wouldn't know what that is, but kind of give us in a lay person's way. So it's a way to programmatically make changes or retrieve data or input data into an environment using programmatic methods. So you're familiar with scripting and things like that, orchestration, automation. Those are all using what's known as APIs. As APIs. These APIs must have secure authentication mechanisms, though, in place. Sometimes they have vulnerabilities to where those can be exploited by criminals, et cetera, that know how they work. Now, an example of an API, if I downloaded a particular application onto my mobile device that then got into one of my production systems, per se, how do I know that that mobile device application is secure enough to be handling? One way to secure interface, it's usually behind the scenes, but your application is a mobile web version. That's just using native access, but it's a web version. It's a web version. So what's the next one you think that the next one that people should be conscious of and be made aware of? Well, one other thing is people are having their credentials stolen, right? We're hearing of these phishing emails where people click on them, and they're asked to put in their username and password into a log form, into a form filled. They fill it in, and ultimately, the attacker steals their credentials, and then uses that to compromise another system. Another system. Yeah. So they impersonate that individual. So it's hijacking. So hijacking. Hijacking. So what should a lay person be doing to ensure that that doesn't happen? Once again, this whole concept of identity is the new perimeter. You may have heard that phrase. It's true. I mean, at the end of the day, we're only as secure as how we can validate if it was you or myself logging into a particular system. And if passwords are dead, I think that's pretty well common. Yes, pass phrases now. Yeah. Exactly. 21-bust characters. Nobody can remember past phrases. So this whole concept of, I have a system, but I'm not going to tell anybody it, because then they'll have my system. So there's any money. This whole concept of two-factor come from. It's something you have and something you know. It's the way to. Well, yeah. OK, so we've got to move quick, because we only got a minute. This is CSA. You talked about that. Yeah, I didn't have a chance to talk about some of the news. But I'll do a quick one, because Palbox gives us some interesting stuff, and it's really related to this. They were saying it related to cost. The health care IT costs per doctor now are at $32,000 a year, just for security. And that's just to protect the records. And if your doctor, dentist, health care provider is not paying in that range, then you have to start wondering if they've got stuff going on. And maybe they should be putting their stuff on the cloud. So it's expected to increase. That's not 40% increase since 2009. Like you said earlier about what was going on. And then we had a hip-hop criminal for prosecution in Tampa the other day there. The guy went to jail for violating hip-hop. So get ready, the more that stuff is happening. So anyway, Pete, we haven't even scratched the surface, so we've got to get you back. Pete is obviously an expert in this cloud stuff. I'm dizzy with everything that's been going on. But we also have something that we never, this is a totally secure, hip-hop-compliant solo cup that we give to all of our guests. And you have number 82 in the series. Well, that's great. And that's it. So anyway, that's it. We're ready to head on to the show. And like we said, thank you, Nick, and thank you, Zerry. Like we say at the end of every show, one, two, three. How you doing?


Richard Epstein is the Lawrence A. Tisch Professor of Law at New York University. He's previously been the Peter and Kirsten Senior Fellow at the Hoover Institution and the James Parker Hall Distinguished Service Professor Emeritus and currently a senior lecturer here at the University of Chicago. Richard has been a member of the American Academy of Arts and Sciences since 1985. He's served as the editor both of the Journal of Legal Studies and the Journal of Law and Economics here at the University. Richard's most recent book is The Classical Liberal Constitution, The Uncertain Quest for Limited Government, last year. By my count, this book is Richard's 14th, but I expect I've missed a few. He's taught courses in administrative law, antitrust, constitutional law, contracts for our mental law, and also medicine and health policy, including pharmaceutical issues. Richard has written extensively on this wide range of topics. He writes a regular column for defining ideas, publishes occasionally in the Wall Street Journal, a bid page, and frequently speaks on legal and social topics. Today, Richard will speak to us on the political obstacles towards developing a private market in organs. Political obstacles, Richard. Well, it's always a great pleasure to come back to the University of Chicago. And, you know, I'm never quite sure what I'm going to say, but you'll notice the slides are not there. They never are. But fortunately, I was blessed by hearing two talks before me which set up an essay in contrast. The first by Dr. Singer was an explanation of how it is that you do entrepreneurial innovation with extraordinarily high rates of return by going after low-hanging fruit. And essentially what he said is, what you do is you play, let's make a deal with anybody and everybody whom you can find, understanding full well that gains from trade are the only way in which you can take different people with different inclinations, different skills, and different expertise, and put them together. And the rate of return he gets from his investment is simply remarkable. Dr. Connick works on a different scale. He's a vet guy taking care of people who suffer from various kinds of synergies. And the research program and the collaboration turn out to do exactly the same kind of thing. I regard both of these peoples as an exemplar of what our good friend Adam Smith said a long time ago, which is that the way in which you secure social progress is to find gains from trade by willing partners one to another. I'm now talking about another market which can only be described as brain dead. And that turns out to be the market in organ transplants. And I won't read to you all of the grisly statistics about this, but I do want to show you that there's an enormous amount of low-hanging fruit which will never be captured so long as note that turns out to be in effect and so long as it turns out to control the distribution of organs amongst various individuals. But the current state I think is really quite striking as to what's going on. I follow the number of people on the organ transplant list now for over 30 years and I don't think there's ever been a day or a month where it's gone down from what it is before. The last time I looked at it, it was about 122,000 people needing transplants on the line. There are about 100,000 of those needing kidneys. Kidneys are by far the easiest organ to transplant. It is also the greatest need under these circumstances. And yet when you start looking at the rate of transplants, what you discover for the last 12 or 13 years, it's exactly the same number, notwithstanding the increase in population. You see roughly 17,000 people getting kidney transplants each year. About two-thirds of those are cadaveric transplants which are much less effective than live transplants. The live transplants are essentially those done within families of one kind or another. Probably we give you in terms of useful life twice the benefit that you get from a cadaveric kidney. We've had very ingenious schemes for organ swapping that have been developed by amongst others, Lainey Ross. And it turns out they net you about 15 transplants per year at enormous cost, proving once again another proposition that Adam Smith well understood that barter was always less efficient than a various kinds of arrangements associated with sale. And then you start figuring out what's happening. Well, about every 12 minutes somebody on the list starts to die because they can't take it. Somebody becomes too sick in order to be able to receive an organ, yet the number of people who come on exceed by a factor of two, those that get off. And we turn out to be in perfectly stable equilibrium. Nothing whatsoever has been done except you see every time you open up a unicycle, a smiling young boy on a tricycle, and what he does is he says, this organ has saved me. And what I want to do is to talk about the thousands of people who weren't on tricycles, who were and saved, and you want to save for want of an organ. How did this happen? So I'm going to do something which is extremely unfashionable, but I think totally provocative and correct, which I'm going to try to monetize the situation on both sides of the organ situation. What does it you get when you receive an organ, and what is it that you sacrifice when in a voluntary market you give a cadaveric situation in order to ask the very simple question of whether or not it turns out there can be gains from trade. And if you look on the benefits side, one of the few things in which we actually have some confidence about what we know is the kind of value that you attach to a human life. It's not because people are routinely selling their lives, but they do take risk into account in one way or another, and the basic estimates that you have vary from somewhere between $6 million for a life to $9 million of life. That's the kind of number that's used with respect to pollution and various kinds of environmental harms. Kindie will not get you a full life under these circumstances. It will get you 20 years. Well, you have to discount that a little bit, so maybe you're talking about $4 to $6 million of potential gain under the current situation. Well, now you have to look at the cost on the other side, and it turns out that these costs are positive. And if you start with the risk of death, it roughly works out that the average transplant under current technology costs you about three deaths and 10,000 transfers, which on average works out to be a shortening of life by about 10 days compared to the gain of about 20 years on the other side of the line. There are collateral consequences associated with the cost of the operation, the loss of work time, distress to relatives, and so forth. You can really fiddle with these numbers whatever way you want, but you're something of a genius if you can get the sum to exceed $100,000. So what is the current political equilibrium given the fact that NODA is in place with its total prohibition? $100,000 is a very large sum of money to ask somebody to give to a random stranger to put it mildly, and so very few people will do that, and their families will often object. On the other hand, $10,000, $5 million is a very large sum to get, and so the question is, can you find a way in which you could compensate the losers in order to have the surplus transferred to the winners? And it turns out that the current systems of exhortation and so forth do absolutely nothing to change the dynamics of this by more than a couple of lives every year. If you could find a system of transfer, this would solve the problem. And so then the question is, why is it that we have the total prohibition on transfer? And what we do is we get a very long litany of excuses as to why markets don't work. And the first thing they don't work is because they sometimes fail, but that's exactly true with everything that Dr. Singer said, and if they fail the first time, you try to figure out how they're going to go. And in this situation, you have such huge gains from potential trades to take place that you could introduce all sorts of safeguards on a voluntary basis to make sure that the right people are chosen for these kinds of organs and the right recipients of the people who can get it. The only thing you have to do is to have a willingness to try, which you cannot do if it turns out that it's utterly impossible to develop an infrastructure which would allow these trades to be organized because these transactions are per se illegal under the current law. And so what we therefore do is we end up leaving about, you know, for every transplant that doesn't take place, four or five million dollars on the table. Well, how big a problem does this turn out to be? Again, I'm not an expert on this field, but there are about 600,000 people in the United States today who need dialysis in one form or another. The cost of running this particular system is over $70,000 a year, ignoring the pain and suffering with respect to the recipients and their families. And it turns out therefore that the end state renal disease program in the United States probably cost the United States north of $30 billion in order to maintain this moribund situation in its current status quo. So when you start looking at the situation, here's one very simple suggestion to make. If you're worried about whether or not people can pay in order to acquire an organ, what you do is you take some fraction of the $31 billion that's put there, give it outright to certain individuals, say, you go into the market and we're giving you enough money so that if you happen to get a good price for the organ, you could keep the change and spend it on everything else. So if the market rate would be around $100,000, double that, give it to people, tell them to go out there and to buy these organs and then develop intermediate institutions to solve it. Now people are going to say, well, you can't do this because we've never run an experiment on nothing that Dr. Singer ever did was run with an experiment before you have it. And it turns out you cannot create markets through experiments because in order for them to succeed, you have to have a long-term time horizon, which is the only way that people who are going to make fixed investments in acting in brokerage functions, knowledge functions of one kind or another can recoup their particular cost. If you tell them we're going to do it under lock and key, do it for a year, see what the results are like, nobody will invest in the kinds of institutions that are needed because the people who are running the program, in fact, are going to get it all wrong. So if this is the way in which the situation works, what then are the political obstacles to the particular program in question? And on this particular point, I'd like to refer to some work by a man named Bruce Randall, surely not a household word in this particular audience, but about 30 odd years ago this public choice economist started to tell the tall story of the Baptist and the bootlegger. Now, for those of you who are not economists or lawyers, which I guess is the majority of this particular room, let me sort of mention to you briefly what I mean when I use the phrase public choice, which is a well-established discipline. It turns out decisions are made in markets, and they are made typically by self-interested people. A little bit of benevolence thrown in here or there, but essentially self-interested most of the time. Public choice is what happens when you have a variety of political institutions in question where the same kind of self-interested people come together and make decisions by legislation and so forth. And essentially the basic story of the public choice literature is you can find cases where people rise above petty faction and conflict and do the right thing, but you can find a lot more cases where very bad outcomes come because the one thing about politics, which is not true with respect to markets, in markets you bind yourself and your trading partner, in politics you bind whatever minority you could happen to overrule by the legislative process that you put into place. So if a majority doesn't want something and it passes a prohibition, the minority is no longer free to innovate in any way, shape, or form. Well, how do you put these majorities together when you're dealing with this situation? And the basic theorem of the bootleger and the Baptist is there are strange bedfellows who come together in order to achieve the same objective for very different motivations. And so the original story of the Baptist and the bootleger had to do with the question of whether there's a prohibition with respect to the sale of alcohols. And it turns out we know why the Baptist wants it. They are people who believe that everything should be kept dry, that it's good for the soul, it's good for the moral being of the nation, and all the rest of that stuff. But they probably are not going to be sufficient in strength to be able to carry the day themselves unless they get a little bit more organized clout behind it. And that's where the bootlegers come in. These are individuals who will be able to make money only if there is an illegal market, which means that they have to invest in a prohibition that the stake had put into place so they can develop the wherewithal in order to beat it by the same tactics that were used during the course of the Depression. And the alliance that takes place is that the bootleger is essentially the source of money and the Baptist is the public moral statement of what's going on in the particular way so that you can basically give a high moral tone to what is chiefly an anti-competitive activity. Now, when we start to talk about organs, they may not be Baptists and they may not be bootlegers, but there are moral philosophers who are sitting in universities whom I regard as extraordinarily dangerous people. Thank you, Laney. And there will also turn out to be large numbers, to you too, my dear, and there are large numbers of people on the other hand who make huge profits from keeping the dialysis industry exactly the way in which it works. So if you're getting $30 billion in sales from one thing to another, who knows who the vendors are who essentially would find that if you could have an organ mark point to get basically $5 billion a year, spend it, knock the cues out, all of a sudden the need for dialysis implementation stops being a mainline growth industry, and it becomes essentially a transitional mechanism before people can get themselves their way. Well, if you're getting the kinds of profits from those sorts of situations, somewhere or another you will find a way to support political activities by people on high moral grounds who announce that the particular results that you're trying to achieve in any given case are in fact the kinds of result that the public ought to embrace. Now, this is a very large indictment that I'm making, and I want to make it perfectly clear that it's not simply an indictment that one wants to do with respect to the organ transplants. It carries over to virtually every aspect of medical care in the United States today. And what I want to do is essentially say that the biggest problem with respect to the intelligent reform of medical care is the healthcare profession itself and the politicians who work with it. Why is that? Because I'm looking at a group of individuals who are inherently, intuitively, and deeply statused with respect to everything they say or do. And so whenever somebody proposes a market solution, the only thing they can think about are negative externalities on the one hand and human exploitation on the other. So if you want to find yet another example of the kind of folly, I am now having the painful experience of teaching in detail, of course, concerned with how the FDA decides to allocate new drugs and so forth. And basically the organization is one giant barrier to entry with respect to treatments that might turn out to be prosperous. If you look in the Wall Street Journal from yesterday, Paul Howard of the Manhattan Institute has a review on that particular book by somebody trying to knock the thing down and it's exactly the same notion, which is there's somebody in government who knows so much about the way in which voluntary markets turn that they'll shut those things down without a chair. And then when it turns out, you see exactly the things that you would predict from these kinds of interventions, namely systematic shortages, no ability to adopt it, to work your way around it. There's never going to be a black market and organ transplants. Everybody knows that. You can go overseas for certain things, but not for many things. What you're going to do is to have yourself a recipe for stagnation and drift. And that's exactly the way in which we start to work in this particular country today.   You believe in voluntary markets. So I do. But there's nothing extreme or fanatic about it. It turns out you can't run voluntary markets unless you have a state that enforces contracts. Make sure that various agreements are on in a systematic fashion. Protects against various kinds of fraud and misrepresentation. Deals with the problem associated with respect to monopoly. Make sure that negative externalities like pollution don't take place. Deals with infrastructural liabilities and so forth. All of which I'm prepared to talk about on another day. But on today, what we are talking about is a subject that can you have a system of independent suppliers handling this situation so as to get rid of the particular problem they have now, which is an acute and blinding shortage of organs? And the answer is every gimmick that has been applied since Al Gore, that noted free market expert, decided to introduce Notaback in 1984 has been a resounding, total and complete failure. And that's exactly the way it will turn out to be. The economics are very clear. I'm going to repeat it to you again. It caused somebody about $100,000 or less to give an organ. The gains on the other side are about four to six million under current calculation. There are gains from trade of about $4 million for every single additional organ you can induce into the market. And the only thing that we're prepared to do as a nation right now is to sing ditties on television to people's moral conscience. But if you put a little bit of cash on the barrel, no matter where it comes from, you could have innovation and then you'll see the way in which that market starts to develop. There'll be generations and iterations that's tremendous rapidity, decentralize knowledge, we've central controlling, and it's actually on this particular issue healthcare is too important to be left to healthcare providers. Thank you. I have three minutes left, right? You're leaving. Why am I surprised and disappointed? Be fair, you mentioned my name twice and in the Republican debate it means I get to talk twice. I'm not a Republican, those statuses, come on, give me a break. Richard, what you failed to mention was who will be the sellers in this market and I think that would bring us back to the two speakers and to talk about sustainability, so why don't you comment on that? I think the answer to that question is anybody who's vulnerable doesn't have an organ that anybody else wants to acquire, so that the market will become pretty clear on how it organizes. First of all people will not come forward as sellers independently, there will be brokers and intermediates who will come forward and they will try to look to those people for whom the physical damage is the one which is going to be transplanted and remember it's only one organ transplant per person and so forth will go from a person who suffers less harm than anybody else so if today the family transplant involves somebody who say 50 years of age and maybe a little bit dicey you're running an organ market it's going to be people in their early 20s who are going to give it. And then on the other side what happens is that you're going to have a far greater, higher rate of organ cadabric and it can be transferred above the ground, what you'll do is you'll get maximum likelihood, you will change the sequence in which the organs are used, no longer will you have to be near death doorsteps in order to get to the top of the list, the highest bids will probably come from people who could get the greatest benefit, those people are just on the cusp from what's happening. So the way you deal with vulnerability is you create major transactions when they know by definition they're doing it only one time because they don't have a second organ in which to give. So actually they have more than one organ to give. I'm sorry. I don't think there's going to be a strong market for life, heart transplant and so forth. The reason I start with kidneys is you could solve five, six of the problem in a perfectly responsible way, save budgets and in effect what you're going to do just in the next half year that you add you're going to basically cost somebody else a day, that's a great trade if you can make it and you should be able to make it. Okay, so Richard you didn't attend yesterday where we talked about the health risks of being a living donor and in fact the group that is at highest risk of being a living donor are young people, African-Americans and males and those are going to be your sellers. No they're not, if what you say is correct then somebody will target those populations and people like you will get up there and say you know if you are in a high risk group don't do it and that information will come out there as well. Those are the same people. The thought that systematic ignorance is going to remain in a market when you have multiple commentaries is another one of the fantasies of people who believe that rigidity in the academics would translate into the world. Richard I just described the demographics of the people who are also the poorest in the world who have the highest use for the money if the health. Look the selection factor can be dealt with. The problem is you always think of worst case hypothesis and never ask the question is there somebody out there who can improve the way the situation works and the answer is Peter figured out how to do these things. When they go to Nepal they figure out counteract transplants that take five minutes to do and where do you can't introduce them in the United States because of all the things that are so rigidly status that it's time for me to get off the stage. I do want one clarification. Only one? Just one for the moment. Are you espousing and I thought I heard it at the end that the value of the organ might change depending on who is bidding for it. Are you advocating an entirely free market or sort of a controlled government market? I hesitate to ask you. You should not hesitate Mark. The moment you introduce government control it becomes government suffocation. If you need control there will be third party voluntary organization. Let me give you one example. You want to get information about what drugs are safe and not safe. The last thing you look to is an FDA warning. What you do is you find the voluntary warnings that are generated by organizations like the FDA. They will take into account the information you know. Which to see when should you use drugs, what about drug interactions, how long can you do it, what uses are appropriate. The government essentially can't have a monopoly over information. And recently with the First Amendment cases it can't have it at all. And what we know systematically is the information that is put out by the FDA warnings is far worse than that which is generated by the FDA. The only thing that is not that that prediction is not that markets will fail, it's that intermediates will flourish. Thank you.