Hey everyone, welcome to Alchemy Stars. So we have here N16 event announcement, The Hidden Truth. What kind of truth is this? So fragments of a feast. We have three new aurorians joining us to this one. We have May, we have Lenore, and we have Giles. So three new aurorians, kind of excited on how or what they bring or new dynamic that they could bring to this game. So moving on to the announcement. So along with our three aurorians, we have a limited time event overview. So event content introduction, The Hidden Truth. Fragments of a feast will be available for a limited time. So the event has two faces, face one being a peculiar tail, face two being banquets, and an additionally interesting gameplay such as riddles and rhymes will be unlocked at a specific time, which is interesting. At the same time, navigators can obtain the event item spirit jewel from phase one. Main storage stages and restore stages also grants event item spirit jewel. Event item spirit jewel can be used to redeem amazing in-game rewards from the event store. So I think this is a short term store. Also the event includes aurorians trial stages, limited time, login rewards and more. Fulfill the specific conditions and you will earn heaps of rewards. So unlock conditions, be sure to clear main stages one dash 16 and all of the events here, face one, phase two and event store drops on May one. The interesting gameplay, riddles and rhymes available, availability period is on May 17. So take note of that. You might forget that it drops on the 17th. Number two event stages overview. So this is just a more detailed, more detailed description of the events and how it will unlock. So phase two will unlock after clearing phase one of course. Then during the event three aurorion trial stages will be available for navigators to fight along Lenore, Giles and May. Successful clear of all peculiar tale and banquet end stages and the three aurorion trial stages with the three star grants navigators Lumamber times 2050 and special star flare times two. This is actually pretty interesting. This is big. So number three limited time event exchange store cryptic oddity store redemption guide of navigators can get the event item spirit jewel, blah, blah, blah. We know that already. Okay, so you can exchange spirit jewel spiritual can be used to redeem in game rewards from the event store cryptic oddity such as five star event limited edition aurorion may and her sulambur special star flare times three limited edition furniture legendary aurorion breakthrough material, aurorion upgrade materials and more five star aurorion may and her sulambur can only be redeemed from the event store during the event. So we'll see if she is that good. And if she is this is going to be pretty interesting event item acquisitions clearing phase one additional info once the event store closes a new spiritual be converted to 90 of maturation one is to 15 players will receive these by mail by logging into the game again an hour after the event ends interesting gameplay riddles and rhymes event content introduction after the riddles and rhymes event begins six stages of riddles riddle quiz and one and riddle quiz tool for sorry not two four will be made available once after another each stage has tool that was a difficulty which can be challenged respectively and answering correctly grants challenge rewards each stage has a has wrong answer attempts and completing all questions before using all attempts will be counted as successful. Okay, so you don't have to really get it right the first time there are challenge attempts that you can can use and fail sometimes. However failing to complete all questions after using all available attempts will be counted as failure. Also if navigators failed a challenge they can still reattempt the challenge until successful and receive a one time reward event reward overview successfully clearing all stages for grant navigators up to 360 lumamber number five is going to be a limited time daily login event daily sign in here and it starts on May 11 of course and the event content so this is going to be for eight days spiritual lumamber general jasper lumamber nightium day three spirit jewel recharge your pack lumamber for day four anonymous gift spirit jewel for day five nightium day six oracle scroll recharge your pack day seven spirit jewel two thousand non-almost gift one times four and the last one is lumamber at eight days lumamber times 500 and in the end in the indecipherable linoar event exclusive avatar times one so there's an avatar for the nor event content acquisition guide during the event you can obtain some exclusive furniture and avatars the specific guidelines are as follows exclusive avatar this uh for linoar furniture and furniture again limit the time recruitment your audience linoar and guiles so they will be available for recruitment may is from the shards limited time recruitment summary during the limit time the marionette recruitment event linoar will only be available from the event recruitment banner when the recruiting six star orion there's a 50 chance it will be linoar so the schedules is from may 11 to june 2 uh this is from utc pal zero or 11 may to june 1 utc minus five okay so limited time recruitment summary during the limited time black mag black magma recruitment event guiles would also be available when recruiting a six star orion there's a 50 chance it will be guile so they will be in i think separate banners based on this one so hopefully uh either of them could be good i don't like for both of them to be good because it's going to be a toss up and most probably one of them you won't be summoning for so let's look after the best ones and summon for that so noted uh note after the limited time recruitment ends linoar and guiles will enter in mainstay recruitment that with that we all know recruitment update azurn roy they will end and they will enter the mainstay recruitment pool and all subsequent limited time or orion recruitment starting from may 11 okay so take note of that so but if you still want to pull for them you still have time we have around you have around a day or more or day and a half for azure and roy number nine is special event book phase two event quests after the event update special event book phase part two will become available the special event will uh book will guide you to complete the virus in game quests which will offer rewards once the specific conditions have been met so new outfits in the store um this is going to be for connelly's outfit the race queen you've seen this already new outfit for six star connelly i'm not sure if you guys are you know would like to pull for that but if you do it will be available on may 11 okay outfit for sale schedule outfit returning to the store nekinis is returning to the store we've previewed this already so for those who are interested you can purchase that limited gift pack in the store as well charger pack dark rhythm rhyme special pack dark rhyme recruitment kit dark rhyme recruitment kit plus dark rhyme ascension kit green and red and that is it the specific price may vary by two percent due to the exchange rate in your payment currency bonuses for everyone the hidden truth fragments of a feast event is now available get prism times 120 in carrier two each day to help you make the most of this event gift contents prism times 120 carer times two every day for five days in a row up to prism um 600 and carrier times 10 all in all so this is going to be available on may 11 to 15 claim period up to 24 hours from the time of availability so to thank our navigators for loving and supporting alchemy stars we prepared an update bonus for all we hope everybody will enjoy them and we look forward to creating more happy memories together and alchemy stars a reward content lumambris 500 and background mystery residence availability this is going to be in may 11 as well so we're nearing the one year anniversary of alchemy stars and this is the next event that will be receiving guys okay guys so that is it for this update and more details to come on um the skills of these new aurorians and if you're still here please do consider subscribing because this helps my channel a lot thank you guys stay safe take care of this is the warden and i'm out of here


Microcontrollers with secrets that they don't want to tell our next speakers have been convincing Them to open up despite a plethora of protection schemes Don't even try holding back your enthusiasm for Johannes and Mark so good evening and Welcome to our tales from hardware security research today We are going to shed light on three questions. First of all, why are we doing hardware security research? Then we will present you two examples on how we do it and then I will come to the consequences of our work So first of all, let's talk about the wire So my name is Johannes Uwe Meyer. I'm doing research on embedded system security and physical Unclonable functions. I'm employed at the Farnhofer Institute for applied and integrated security and currently I'm about to finish my PhD there Okay, so hello everybody, my name is Mark Schenk. I'm working as a security researcher Basically, I do everything that it's somehow related to hardware security So from analysis of security concepts to I'm such an attacks on microcontrollers Um We both both work Quite often with microcontrollers and work really a lot with them And we also and read the data sheets and sometimes they have really strong security claims in the data sheet about the security concept And you know a security researcher you the question arises Do they really hold? Um, but why should you care actually about from protection at all? So if you develop of microcontrollers, you probably want to protect your firmware, but even if you don't Care about IP protection at all you might want to protect your credentials on the microcontroller So let's say you have cryptographic keys on the device or privacy related stuff Then you want to protect these data against readouts and also you want to protect your firmware your microcontroller against data or firmware Manipulations so that your firmware does not run malicious firmware or work on manipulated data Okay, so but why we try to break these devices so there are multiple reasons for example in research projects We use microcontrollers and their security project and sometimes it turns out that the security concepts are not well Implemented or have weaknesses Another reason is that We have customers that want us to do a security analyst analysis of certain concepts Because they want to use these features in their components and their components and we am shoulder Evaluation of this concept and the other thing is of course scientific curiosity Sometimes we see that there's a new firmware protection out there in some product and we would like to see how this works and If this is really secure So but the question still remains Would anybody really try to break the security of your microcontrollers? So unfortunately the answer is that it's not only anyone who wants to do it That's even an entire market that evolves around Cloning embedded systems. That means we have companies that offer Cloning a device like you can get a clone PCB and they will also pull Firmware from a microcontroller and put it onto the clone device So you might perhaps think that's quite an expensive So we did an inquiry for one of our customers and found out no actually it's quite cheap It just cost around 6,000 us dollars per chip What state of the art microcontrollers and it will even be delivered in like 30 days You know, so that's surprisingly cheap and it's in we it's a real threat here so unfortunately Vendors of microcontrollers often mistake us as malicious attackers. That's bad because it's not like We are sometimes seen like I select a product from a mic from a vendor and I choose this specific vendor because I think I don't like them and Then I pull my cyber hammer from my drawer and hit the product until security breaks. That's not true We don't select a specific Product or a specific vendor and please keep in mind don't shoot the messenger The vulnerabilities in the microcontroller are already there. We are just pointing them out that they are present We are not bringing any vulnerabilities into microcontrollers here. We have an entirely different approach We do a scientific evaluation of security concepts So the science is the center of our research here. So first of all, we try to start with a Theoretical analysis, so we read the datasheet think about how does the security concept work? Then if we think that we discovered of law, we try to test it in practice on one of the devices And if this is really successful, we will Develop a proof of concept for the vendor so that the vendor can reproduce our Detected issues and maybe also can fix them in the next revision And then we will publish a paper and that closes the loop of this scientific evaluation of the security concept because then it becomes reproducible and the next developer Will not need to make the same mistake as we will see later on that Sometimes vulnerabilities are spread across several manufacturers so after I've Pointed out why we are doing this I will now continue with the how and bring one example of Research that we have actually done some time ago So usually if we want to start the questions always How do we start at all? So do we really smell bugs? So any questions to that is that it's not far from being incorrect because Sometimes you really have some gut feeling that this security concept looks a little bit fishy and then you investigate it further For example, I had these stm32 f0 micro controller board In my opinion, that's a quite powerful and good micro controller So I spent a lot of time developing with it So I got to know it quite well, and then I came across some security feature Well, I didn't know are they really that strong as it is promised here So and that was reason for me to just say well, hey, let's take a look inside So for the protection of the firmware the micro controller offers three protection levels We have RDP level zero up to RDP level two and the datasheet says that in RDP level zero You have no protection at all that is that what developers are using when you buy the micro controllers And so that you can do everything what you want to do with it Then we have the read protection in the level one and we have no debug access in RDP level two so And I can configure this micro controller by writing a specific value into a location in the flash memory So that's a permanent setting for example if I write 3 3 cc into that into that memory location This tells the micro controller to shut down its debug interface So of course how it is common for those security levels I only can increase them if I want to decrease them if it's even possible Then this goes hand-in-hand because a full device erasure Of the entire firmware. So this security concept looks quite good on a first Look, but then if you look closer in the datasheet you realize that all this explanation is written a subsection Of the flash firmware protection So does this RDP level one only refer to flash read protection, but what about SRAM? So I just tried it out. I took one micro controller loaded firmware to it locked it to RDP level one and tried to read the SRAM and Well surprise SRAM is still readable and all the data that may be in SRAM So for example some keys that are currently processed They are still accessible and you can even exploit it in a way that you can in some cases extract parts of this Of the firmware. So this is something that you must keep in mind if you select the RDP level one So people think well, we also have RDP level two. So well, we just use RDP level two. That's a good idea, isn't it? Well, let's have a look at this how the settings are stored on the micro controller So here we see the two levels RDP level two and zero And their corresponding heads a decimal and binary representation of the setting all other settings as we have seen Map to RDP level one. So I thought well It might be possible to ground grade RDP level two to RDP level one by just flipping a single bit So is this perhaps possible in some way? So the settings are stored in flash memory and in flash memory the data is Commonly stored on the so-called floating gates So if there are electrons on the floating gate that Represents the binary value zero and if the electrons are missing then it's a one so then I need a way to remove these electrons from the Flash del and then can that can be achieved by ultraviolet light. So if I illuminate this cell Then the UV UV light kicks out the electrons from the cell and flips our zero to a one Okay, but is this practically feasible at all? So first of all, we need a strong ultraviolet source This type here that we see on slide. That's a mercury vapor lamp I got mine from the dumpster from a university, but you can also buy them online for just a couple of bucks So they are quite easy to obtain and next so that you have access to the chip and not the flash memory you will have to Create a decapsulated IC. So you have to remove a part of the package You can do this for example by strong exit assets Or you can also go to a company or to some chemist that has access to the technology So that's basically is feasible to decapsulate this chip And then if you take a closer look and have a little bit of experience You can identify the region where the flash memory resides on that chip and by doing more experiments You can all find us in the paper You find out that only the lower right region holds those RDP bytes that Store your security setting and by putting a mask on to the remaining flash memory where the firmware is you want to protect You will just illuminate this region of RDP bytes for several hours and then you indeed Achieve a full security downgrade from level two to level one and thereby the Security of RDP level two is broken and that's only possible because there's a very weak fallback mechanism Where everything maps to RDP level one if I flip a single bit Okay, but in RDP level one I still cannot read out the flash memory But that is also something I didn't really trust because I have access to everything Except the flash memory That must be quite complicated as it is implemented here So I eavesdrop the communication between the standard debugger that is shipped with the microcontroller and the microcontroller in RDP level one so initially the debugger starts up the debug functionality the microcontroller acknowledges that and then an Entirety of 18 transactions are taking part between the debugger and the microcontroller So the debugger for example reads out the CPU ID reads out some meter data regarding the debug configuration like break points watch points and so on and as soon as I take control Over the debugger. I try to read out the flash memory and that's no surprise I cannot read it because it's locked in RDP level one that I don't have access So I didn't really have possibilities to use the standard debugger So I decided well, I will just implement my own debugger on another evaluation board and try out if I can perhaps mess around with the entire communication here and Since I don't I'm not interested in break points watch points and so on I skip this entire readout I know which microcontroller I'm talking to so there's no reason for me to read the CPU ID So I skip this entire config readout and then Just to verify that my system works correctly I try to read one of the flash addresses and we all expect this to fail because RDP level one is active So I should not have access to the flash memory But surprise we have some data there Okay, first of all, I thought yeah, I must have made some implementation error. So I checked it again But no, it was really some data that I've written into the microcontroller before So I tried to do it again to read the next bite But this failed again and I played around with this a little bit more and found out if I don't do any configuration in the beginning and adjusts and the first transaction goes directly to the flash memory I can read out a single word from this protected flash memory So, yeah, that's quite surprising So there seems to be a race condition so that the flash is not locked quickly enough and I can read out this data here We also requested a CV for this and it's already published here. So this issue persists in this microcontroller and I can even show you this in a short demo now. So on the left side you see we have the device under test That's the microcontroller and are the TV level two and on the right side We have the so-called firmware extractor that performs this attack and always resets the microcontroller We starts it and pulls one word after another so as I Prepared this beforehand. So as you can see here Using GDP. I cannot read out the flash memory. It just returned zeros here But now I will start up my firmware extractor that I have here on the table and The laptop now connects to the firmware extractor Yes, from extractor does all this experimental debugging stuff and Tries to read out the memory from the device on a test and as you can see here The first bytes are already being read and just to verify it I also put some human readable strings into the memory that are currently appearing here. So I will now Stop the attack and as you can see here We really can read out the contents of the protected flash memory and for the common chips This can be done in a few minutes or up to hours. So this is entirely possible And so we were also able to break our DP level one Thank you And the reason why this was possible is that we have insufficient permission enforcement and RDP level one debugger communication So that was our first attack and now mark will continue and show us another attack Okay, so I'm going to talk about an attack that we actually presented last week at the wood conference So this project started because I was reading a data sheet from my stm32 microcontroller and then at some point stumbled upon features called PC Rob and I thought okay.  I've never heard of about this feature and At first I thought it's some countermeasure against Rob, you know return oriented programming, but Turned out. It's actually the proprietary code readout protection So that's a feature that shall protect Your firmware on a microcontroller against other developers working on the same system So the basic idea is that you imagine you develop the library Let's say a motor control library or stuff like that And then you deploy this on your microcontroller and then you hand over your microcontroller to a different developer And this developer deploys the main application on the microcontroller and in the end The developer locks the device and the firmware on the device is totally safe and at the end you have your product So let's say a robot. That's quite cool, but During the development process your firmware is not protected right as we've seen in your harness lights So if you have access to the microcontroller via the debug interface you can easily read out and reverse engineer the code on the microcontroller and Here's where PC Rob comes into play So PC rope allows you to deploy your firmware on a microcontroller and then lock it into a so-called execute only memory and then again you hand it over to the developer to the other developer and This other developer can still use your library, but it's not able to read it out anymore or to modify it and doing a research you found out that That's not actually only implemented by SDM 32 microcontrollers, but also on kinetics devices from nxp and some device from text instruments So we analyzed all of these devices you can read out read the details in the paper We found also some interesting hardware bugs and these devices Okay, so how does this work? This is a simplified schematic version of a microcontroller on the left hand side You have the flash memory which is connected through a bass matrix to SRAM other peripherals CPU and in the right hand side You have to debug interface so the basic idea behind execute only memory is that You deploy your library on the microcontroller and then mark a certain region as execute only memory and From from there on it's not possible anymore to read out the code It's also not possible to modify the code only instruction fetches are allowed So you are able to do instruction fetches because you still need to be able to execute the code, of course Okay, so This from a protection or protect you against developers on the microcontroller the problem is that as a developer I've had have basically access to the entire system except for the execute only memory, right? So as an attacker I can execute the instructions in the protected code area and Can observe the effects of an instruction in the other components? So let's say I execute an add instruction and execute only memory then I can see that the register in the CPU core changes and If you do this and see all these these Difference in SRAM and CPU you can basically here recover the code that's actually protected and execute only memory and and thereby dump the entire code and That's what I will show now Last week we presented a demonstration on the STM32L0 and so we decided yesterday, okay Let's use a different microcontroller this time So for this presentation We use the device from Texas Instruments to the TM4C123 Okay, so What I'm doing now is I connect this microcontroller to my computer and And the first thing is I establish a debug connection to the microcontroller and Okay, let's see Okay, so let's connect to the microcontroller and there's a Library on the microcontroller that flashes the LED, right? so this is our library we want to protect against against readouts and reverse engineering and This library is Placed on this memory address and it's for the for the for instructions So that's that's the library we want to protect so without execute only memory you can simply disassemble this code So that's quite easy So let's Oh, you can use Yeah, let's enable execute only memory for this memory region Think this Yeah, okay Okay, so now execute only memory on this memory region is enabled and now we try again to To disassemble this memory region, okay doesn't work So all read attempts to this memory area are blocked and generate a bus fault, but When we use Okay, so let's do it again So we say that our tool should Recover instructions on this memory area and in this case for the for the two instructions and we also do a post posting step and Then we can see that we can actually recover the code and If you come if you compare the left and the right side, you can see actually be recovered the entire We can recover the entire code So the left on the left hand side you can see the recovered code and right hand side actually code It's inside the execute only memory and when you compare both sides. It's actually the same code. So here we go Execute only memory doesn't protect you from Okay, so We found vulnerabilities and microcontrollers. So what we do now, of course we do a coordinated disclosure process with the manufacturers and In theory, this looks like that. So you start your research You found the vulnerability then you inform the vendors and provide technical details of the of the vulnerability And then of course the vendor come confirms immediately that you found the vulnerability and everything is correct Then you write your paper Submitted to a conference and in the end you present your paper and your papers published So that's a theory in practice in practice. This Isn't almost all the case. Oh I forgot to mention sorry that for hardware security for hardware security bugs we provide the vulnerabilities or Provide information about vulnerabilities Usually 120 days in advance before we publish a paper to give the vendors some time to Mitigate or in some cases implement countermeasures if possible Okay, so now let's come to the first example here of vendor a So we started our research and soon afterwards we discovered our first vulnerabilities here And of course we wanted to inform the vendor. So this took a little bit more time because In the hardware area some vendors don't have something like a third where you can Write to the people that want to collect the vulnerabilities and want to fix them So it was a little bit difficult to get the email address of the right people But then we started our discussion with them But it somehow slowed down after a few days and weeks because we wanted to have phone conferences But they just didn't join them or they didn't have time on that and at some point They didn't even we spare on to our emails at all anymore So they basically ghosted us here so unfortunately There's nothing really we can do here. So we thought well, perhaps they don't receive our emails, but I Had a look into this and they realized we got a few a couple of Out-of-office replies. So the mail server Definitely received our emails and they just didn't want to respond to us anymore So since we want to proceed with our scientific approach here We wanted to publish our results nevertheless So we waited some time then the conference came around and we Submitted it to this conference. So then the time started where we have to wait for the review So our paper could be accepted or could be rechecked it in this case. You were lucky our paper got accepted And the conference program got published But then something very interesting happened They contacted us again and send us an NDA So well, they don't really like the idea of an NDA due to several reasons first of all I don't need an NDA with them. I want to publish these results. I want to have an open discussion That's no Nothing from my side. I really want to protect with an NDA here and also from the side of the vendor They don't need to tell us anything. We just want to talk to them what we have found. Okay, perhaps Discuss a few questions and that's it So we don't need an NDA from a technical point of view and there's also another reason where I also got into Contact with one of our Institute lawyers and he really said well That could be a really bad idea to send an NDA like two weeks before the conference where we want where you want to talk about Results your findings that you had so really check that this idea of signing this NDA and just said well We can talk nevertheless. We don't need this NDA here Then they're caught of course. They got quite again this trick of them Let's say didn't really work out here. The paper got published We got the CV got assigned and so on and yeah That's it for the vendor a Finally, it worked out. It took a little bit more time than the 120 days, but all in all it was quite successful in the end Okay, so let's see how to disclose a process one with when the with vendor be so again You start your research and then you discover the vulnerability and this time you have direct Contact with the manufacturer because they have so-called product security and incident response team So they have an email address on their side and in some cases in BGP keys and stuff like that So you have contact to the manufacturer So everything is good and then they started to deny the vulnerability So it'll provide them technical details and they say oh, yeah, we don't think that's a vulnerability Please read the datasheet and you will find out. That's not a vulnerability So, okay, so we read the datasheet again and we sent them again an email and said, okay We still think we found the vulnerability and they said again. Oh, no, we don't think you have This is a vulnerability. Please read it read the datasheet again and of course we read it again and Then we sent them another email and said, okay, we still think that's a vulnerability and tried to even more explain Why we think that's a vulnerability and they said again, no, that's not a vulnerability. Please read the datasheet and then then suddenly this happened and so Made a big big progress for the disclosure process any idea what happened here We sent them a proof of concept exploit so with that exploit source we were able to dump the entire code in less than a second and The funny thing was that of course we read the datasheet and again and again, and then we found an additional bug So with that hardware vulnerabilities possible to bypass execute only memory directly you don't need to recover the code Okay, so and then they asked us for a telephone conference and then they confirmed all the vulnerabilities and Quite good. So looks like a straightforward disclosure process from now unfortunately, and we sent them the our paper and then they asked us to We remove some sentences to rewrite some sentences about specific things They also asked us to add some reference to the to the datasheet which is quite okay. We did this But they also asked us to remove an entire section from our paper and Because it was too easy to understand so So this was a section about how to exploit the hardware vulnerability and We've refused us because we think that's important for the reader to to know how this works because then The reader and customers can assess on their own How how vulnerability this product vulnerable this product is and so we refuse this and Submitted our paper anyway. So unfortunately it was rejected. Maybe some of the manufacturers were happy because they have now a bit more time So we reworked the paper a bit and then publish it again and Submitted it again, and then it was published actually Okay So I mentioned that it's important for us to Describe things in our paper so that everybody can assess on their own how this works and The problem is that hardware issues usually not fixable So microcontrollers if you have a bug in a microcontroller you cannot fix it You have no microcode to update it like on on bigger CPUs You have no usually no software to to work around so if you have a hard hard work on ability that that's really bad and even this potentially potential damage for for Customers and and manufacturers on the other side We want to do a reproducible research. So we want to publish everything so that everything can verify our results So that's the reason why we included all details on the paper and also if you have the all the information published you can implement mitigation and counter measures on their own if possible and also with this information you can verify other products for similar vulnerabilities or Even the same vulnerabilities and other products. So for the last project execute only memory project We decided to keep all the information on paper But on the other hand we did not just we did not disclose the code I showed you So and also other code to to exploit the hardware vulnerabilities So here what this was our trade-off to say, okay? We put this information in the paper, but we don't publish the code to exploit us Okay, so we had four cases For all disclosure process. So the first one was the one that Johannes explained So what was there? What was the outcome of this process? So unfortunately the data sheet of this product was not updated nor the radar sheet So there's no information about this vulnerability in the in the product Description and the vendor also did not Request the CVE so we did this instead On the other hand communication with the with another manufacturer was quite good they even requested the CVE for their products and Also updated the data sheet. So now you can read in the data sheet. Okay, this security feature is vulnerable You shouldn't do shouldn't use this anymore So for the third case It went entirely bad because there was no communication at all We used the context that we had already from beforehand, but also again this case In this case we got no reply so far. They also of course did not request a CVE here And what's even worse is there was no update in the data sheet or a data So there's no official document by them telling that this feature that they are promising in the data sheet That's not really work out as it's described in the data sheet So in the last case D the communication was quite good unfortunately the vendor refused to request CVE on their own so this was done up to us because they wanted to take communication with their customers And users into their own hands. So there was also no data sheet update so far So that much about communication here, but they published an errata that in my personal experience is often Just overlooked if a chip is used So all together here in this hardware security Coordinated disclosure approach. We only have One case where this really worked out quite well in two cases. It's didn't work out at all in one case It's just very questionable And what's even worse here is that if you look at this row of data sheet update Despite the features are indeed broken only one or four Cases the vendor decided to really Add some information or pull this information from the data sheet in the other cases It's still the same text in the data sheet. So there would not be any Documentation that's easily accessible that this feature does not work as promised. So in our opinion, that's like the Yeah, this outcome is bad like three and four cases because there's no good documentation on that So now the question is is it really that bad? No, it's even worse Yeah Okay, thank you. So the problem is after we published our first paper on that I got a few emails from other researchers that are very interested in hardware security. So They told me well, I'm Quite interested in this trip. I think I found something there But how can I report this without endangering myself? so I also verified some claims of one guy and it's really interesting so other people also discovered very interesting flaws in some microcontrollers, but They were they did not know how to report them correctly and then we found out there's a lot of fear of reelection that the vendor could take so and that Leaves them at taking one of two options on the first Option they can just anonymously Do a full disclosure put this vulnerability on pay spin So there's no warning for the vendor or for the users at all and that is something that is very unfavorable And that's something we don't want and also it's not good for the vendor and for no one here And then there's a second option that appears just as bad and that's no disclosure because if there's no information Available about such vulnerability it can be exploited by the people that have found it and Perhaps the same vulnerability will be found in the next microcontroller series again And then when it will ability becomes public Several series of microcontroller will immediately become very weak and the protection can be broken so there must be another way here and that is the coordinated disclosure and That is something that is still not that good to achieve because There's still this that fee of legal action here. So we need to change is here on the one side. We need the vendors they need to cooperate with us researchers. So That we get the support so that we get responses at least that I've read our emails said they take them seriously And then on the other hand on the legal side, we need an international legal certainty So that we don't get sued here So that is something that's quite dangerous and there were cases like in the software security Where there have been lawsuits also in Germany against researchers who try to public published vulnerabilities and By this if we create this legal certainty here Then there's the chance to create an enhanced security by the collaboration of researchers and vendors So that for example firma cannot be extracted But also your secret data your keys that you might store in your microcontrollers remain secure here and researchers It's not just the scientific researchers here a research is everyone who is just interested in microcontroller security So every one of you can be researchers in this field Just get a microcontroller by a evaluation board have a look at this and then try to find out which Which security claims are really true, which are not true But to have this future where this can be just done and discussed openly and freely There we need this new developments and I hope that we are on a good way to that when we all also want to like Bring this forward also by this talk here to say we need the vendors For that we are not against them beyond on their side We also want to enhance the security of the products and on the other side We also would need some more legal certainty here and that could be the way to Yeah, better security for microcontrollers here. Thank you Johannes mark. Thank you so much. We have some time for questions We have a microphone angel over here We have a microphone angel over there if you have a question go find a microphone angel or perhaps the internet Finally has some questions Does he know yes the internet has a question? As security researchers, what would you recommend microcontroller vendors? Do you to increase the security of the security features? Well, that's a quite general question here. I think security must be Done from the very beginning. So if there's a product already on the market, it's mostly it's too late So it's more like There needs to be some analysis of the initial concept because often when we come across Some things like for example what mark has explained with a piece of rub that's something After we read the data sheet we thought to ourselves. Well, that cannot really work. So if someone got Got a hold of this data sheet before production or even in the very early development They could have warned the vendors So security is something you have to put in at the very beginning of the product So security is an essential part of a product nowadays Also some hardware vulnerabilities we found what were actually quite easy So one vulnerability is basically you use a different bus to access the protected code So if you Had some pen tester in the company or something like that you would have found this this one ability probably I See some questions over here microphone Now That's gonna be a quick one. Do the colors on the graph of disclosure timing have meaning to them Colors on which slide? Vendor A and vendor B Yes on this one Do they have particular meaning? No, no, okay. Thanks Next question Thanks for a talk Are there any vendors hardware vendors which have security bug bounty programs and Second question. Oh, well, what one question? Okay Does anyone have a bug bounty? I Don't know. I don't think so. I also don't know anyone at least in the common commercial microcontroller area, but also This security bounties care bug bounty programs can also sometimes counteract an open discussion of vulnerabilities because I've read some of these Guidelines or at least for software and it was often like If you report and use this about a bug bounty program, you may not publish these results elsewhere So the question is even if there were those bug bounty programs, would it really contribute to microcontroller security? So I think we have only enough time for a very very short question and first I'm gonna see is there a short question from the internet No, okay, then you are the lucky short question to ask her. Okay Very interesting presentation. I was wondering if any of the vendors actually updated their hardware to fix the issues No, not yet I think it's too early to say because the paper was published like last week basically and the other vendors I have talked to it's like more like well the new series will come out So I'm not informed about it yet, but it would be very interested if they came forward to us and told us well We fix it now. So would be interesting also for us, but as far as I know, it's not being the case yet So Johannes Muck, thank you again so much. Let's hear it


That concludes decision time. We are now moving to members' business. Members should leave the chamber, should do so quickly and quietly. Members' business debate on motion number 14804 in the name of Kevin Stewart and Marshall Square. The debate will be concluded without any questions being put. We invite those members who wish to speak in the debate to please press the request of sweet buttons now or as soon as possible. I invite Kevin Stewart to open the debate. Seven minutes please, Mr Stewart. First of all, I would like to thank colleagues who signed my motion for allowing us to have this member's debate on Marshall Square today. I would also like to welcome reject Marshall Square development campaigners to the public gallery this evening. I think that it would be fair to say that almost every Aberdonian was pleased to hear that the former council headquarters St Nicholas's house was to be demolished. It was regarded as a monstrosity and I saw a blot on the landscape. Many hoped that its demise would lead to a sensitive development of the site and the construction of a city square to complement the iconic Marshall College and the historic province scheme's house, which has been hidden from view for decades. Alas, that was not to be. The Labour-led council has pushed on with a scheme that is about as popular as a visit by King Herod to the Bethlehem nursery. David Hurt, a contributor to the reject Marshall Square development Facebook site, talks for many when he says, When the old St Nicholas's house was demolished, we could finally see Proviskeen's house and Marshall College and all their glory. The people of Aberdeen are crying out for this to be an open space, a civic square, but those who are meant to represent them are not listening. He goes on. Why could this be? What financial millstone have these councillors draped around the people who live in Aberdeen, who work in Aberdeen and are proud of Aberdeen? Fellow objector, David McLeod, said that the scheme is an architectural disaster, perpetuating its predecessor and imposing a financial burden on council taxpayers for many years to come. Many feel that the planning process was flawed, that the full impact of the scheme did not become apparent until 3D imagery of the development was produced by pinnacle visualisations, and it would be fair to say that folk were extremely disappointed that the Scottish Government did not call in the application. However, I do not want to concentrate on the planning aspects of this today, but instead I want to focus on the perceived lack of openness and transparency of the financial deal that Aberdeen City Council has entered into with Muse and Aviva. The reject martial square development campaign group has been assiduous in trying to get to the truth about the deal, and Mr Bill Skidmore has been at the forefront of those investigations. In a freedom of information letter to the council, Mr Skidmore asked for a copy of the business plan for the scheme and received a reply from the council that said, There is no business plan at this time, and yet, according to the campaigners, in the worst case scenario, Aberdeen taxpayers will be underwriting the risk of underoccupancy of the development by guaranteeing £175 million to Aviva shareholders over 35 years. It has been said by a great number of folk that it is somewhat ironic that Aberdeen City Council are willing to take on a risk that a multinational insurance company is not prepared to underwrite. In recent days, campaigners have managed to acquire two pages of the summary of the bids for the martial square development, and I will hand a copy of those pages to the minister after the debate this evening. I will also be sending those documents to Audit Scotland for their perusal. Yesterday, Mr Skidmore wrote to all Aberdeen City Councillors about the content of those documents. In his letter, he says, I got the impression when reading the summary bid information that the author was trying to steer councillors away from news. Too many unquantifiable risks, the need for a full life costing, a risk fund and a sinking fund to limit the damage of unquantifiable void periods over the full life of the lease. Instead, councillors were taken in by the prospect of £2.6 million income from the property, or nearly £100 million over the 35-year lease period, for a fully-led scheme. This is undeniably a bad investment decision, he said, and one that represents worst value for the city when compared with the other bid proposals. Of course, all of those grand plans, schemes and strategies were drawn up at a time when the oil price was high, when Aberdeen was booming and when property was at a premium. Sadly, the outlook has changed, but has Aberdeen City Council's Labour-led administration changed its business plan to manage the new risks that have appeared over the horizon? No, because as we've already established, they don't have a business plan. No business plan, but the council is required to upkeep, manage and maintain the building according to the summary bid information. The document says that those costs can generally be recovered from tenants, but what if there are only a few tenants? The document goes on to point out a number of other pitfalls, which, unfortunately, I don't have time to go over today, but hopefully they will be poured. I'll certainly give way. I would like to commend the member for achieving his debate, but I can't stay for full debate. I'm very struck by what you've said and what the group has put forward in their documents. I've read of strong parallels with things that have gone wrong in our Gylan but in my own area. I wonder if the member would also reflect and the minister would reflect on the need for greater supervision of local authorities, or at Scotland to say the least doesn't appear to be well-equipped to deal with this type of lack of democracy. I agree with Mr Russell on that point, and I know that he has been working assiduously in trying to deal with some of the problems in our Gylan but, and there are certainly similarities between the two situations. As I was saying, I hope that the documents that I'm going to provide to the minister and Audit Scotland will be poured over and that they will look very carefully at them. I'll leave the final words tonight to Kathleen Patterson, whose words reflect the feelings of a great many Aberdonians. She says, the heart of the beautiful city of Aberdeen is being gradually murdered with every brick that is laid in this awful development. How can the councillors sit at their desk listening to the work going on and the knowledge that they are imposing something horrendous on their town? Something that will more than likely cost its taxpayers dearly and which, given the current and predicted economic climate of the north-east, will surely stand half empty for years to come. She says, open your eyes and ears Aberdeen Council, admit mistakes were made and rethink this project with the help of all those concerned, bewildered, angry and heartbroken citizens of your time. Thank you so much. I now move to open debate. I call on Lewis MacDonald to be followed by Mark MacDonald. Thank you very much, Presiding Officer. I welcome this debate, congratulate Kevin Stewart on bringing it, and I welcome the desire of all concerned to support regeneration of the city centre of Aberdeen. Marshall Square has its origins in the decision taken by a previous administration to relocate Aberdeen City Council's headquarters from St Nicholas's house to Marshall College. That was a large-scale and ambitious proposal. That divided opinion. That indeed was the financial millstone that left the city council substantially in debt. Leasing Marshall College from Aberdeen University entailed a debt of £60 million. The demolition of St Nicholas's house has cost several million more. I'd be delighted to. Mark MacDonald. I recall from my time as a member of that administration Lewis MacDonald and his colleagues saying that the Marshall College project would cost the council over £80 million. It cost the council less than £60 million. Surely he welcomes the fact that it was brought in so heavily under the budget that he assumed it would cost. That's a remarkable contribution. Mr Stewart has just talked about the financial millstone that has led to the Marshall Square development. Mr MacDonald wants to boast that the financial millstone is a little lighter than it originally looked as if it was going to be. I will in a moment, I'm sure, but let me make some progress. Mr Stewart will recall that he was convener of finance on the city council at a key point in that process. He urged fellow councillors not to forget the multimillion-pound asset that is St Nicholas's house. The value of that asset could fund the costs of Marshall College. That is, of course, precisely what is happening now. Despite the controversy, no party or group on the council has brought forward proposals to leave the site of St Nicholas's house undeveloped, because doing that would simply not pay the bills. After some debate, the city council chose to demolish St Nicholas's house and enable new development. As we have heard, it has now sold the site to a pension fund on a leaseback arrangement with the right to buy it all back at a nominal price after 35 years. That is clearly a better deal for city taxpayers than the long lease of Marshall College, which generates debt rather than income. However, as the campaigners have rightly argued, it comes with a degree of risk. The lease of Marshall College is an extremely good deal, over a 175-year period. Beyond that, the foresight of the previous administration saved an iconic Aberdeen building. Can I ask Mr MacDonald if he thinks that the buildings that are currently going up will be classed by any Aberdonians as being iconic? I certainly think that it will be a lot easier for Aberdeen City Council to recover value from the Marshall Square development than from Marshall College, which is clearly simply a drain on revenues for the council. £60 million of debt, as Mark McDonald has said, will take quite a lot of income in order to pay off. However, there is a degree of risk, and that has rightly been said. A report from Accountants EYES commented on the remarkable resilience of the Aberdeen economy over the last year in the face of a low oil price and large-scale redundancies. We must hope that that continues. However, there is, of course, a risk that that resilience will fail to prevent recession, and there is consequently a risk only there that the council's income from Marshall Square will fall short of the annual rent that is committed to pay under the leaseback arrangements. It is worth noting in that context last week's report from the Parliament's Local Government and Regeneration Committee, chaired by Kevin Stewart, which said that local councils should work with pension funds to secure infrastructure investment. Mr Stewart and his colleagues urged councils to take a less cautious approach. They said that without some degree of risk taking, innovation will not happen. Well, that is quite right. Audit Scotland has looked at the innovative financing arrangements for Marshall Square. They concluded that the risks had been well understood and managed, and they advised the council to continue to manage its financial exposure to mitigate those risks accordingly. I hope that the council will heed that advice, but I also hope that it will heed the advice of Mr Stewart's committee not to be unduly risk averse. Aberdeen City Council can clearly demonstrate a proactive approach to the wider risks to the regional economy. Its proposals for a city region deal, which are with ministers, have cross-party support. Now, Opportunity North East is bringing together public and private sector partners to strengthen and diversify the regional economy with generous support among others from Surrey and Wood. They recognise that investing so that the local economy continues to grow is the best way to ensure that Marshall Square does pay for Marshall College rather than simply adding to the existing debt. I commend the campaigners who are here today for asking difficult questions. The project that they did not want, as they will know, is now well under way. I suspect that, in spite of what we have heard so far, they will not hear any actual proposals this evening that would change that. I hope that they will nonetheless maintain their commitment to our living changing city. I hope that they and all of us will continue to strive for Aberdeen's future success. I want to pay tribute to the campaigners, in particular to my constituent, Bill Skidmore, who has sent a great deal of information to MSPs in advance of this evening's debate. It is certainly made for some interesting reading. I can assure them of that. My colleague Kevin Stewart has very helpfully focused on the issues around the business plan or lack thereof and the questions that arise off the back of that. I want to look at some of the wider impacts and risks that I think that this development poses, but I cannot allow some of the things that Lewis MacDonald said to go unchecked and unchallenged. First of all, I think that most people would accept and agree that the redevelopment of Marshall College has been a fantastic benefit to the city of Aberdeen. If Lewis MacDonald's view is that any capital expenditure should be viewed as a millstone or a risk, then it is a wonder that anything ever gets developed in the city of Aberdeen, such as new school buildings, for example, at tens of millions of pounds. If Lewis MacDonald believes that we shouldn't be making tens of million pounds of investment because of the potential debt that arises now, I have more to come to yet. Then Lewis MacDonald turns around and says that the local government committee has spoken about using pension funds for infrastructure investment. It is something that I have spoken about as well, particularly public pension funds and especially public pension funds. The idea that pension funds who invest then recoup their word over time rather than simply transferring the burden of risk for that investment on to the local authority itself, which is what is happening in those circumstances. Then Lewis MacDonald says that the local government committee has said that councils should not be overly risk averse. There is a fundamental difference between not being risk averse and being essentially blind or ignorant of risk. That appears to be a dividing line that the Labour-led administration in Aberdeen has fallen off of quite spectacularly. Lewis MacDonald? I am grateful to Mr MacDonald. Clearly Audit Scotland has not regarded the handling of this as either blind or ignorant, but if Mr MacDonald is suggesting that in some way Aberdeen City Council should cease to seek an income from Marshall Square, can he tell us how else he would have Aberdeen City Council pay off the debt accrued at Marshall College? One of the things that Aberdeen City Council ought to have done first and foremost is to have had a much more open and transparent process from the beginning, looking at the views of Aberdonians around the options that they wanted to see being developed and then examined how those could have been delivered. I am pretty sure that what is currently being developed would not have been top of any of the considerations. One of the other things that Aberdeen City Council did erroneously was to vote against the wishes of the group that I was a member of to demolish the building itself and incur the costs around the demolition of St Nicholas's house to the council with no guarantee of what would come after, therefore taking an upfront cost with no guarantee of future income. That was another example of carelessness in the face of risk assessment. I want to look at some of the wider issues here in terms of wider impact and risk, because Union Street, the flagship street in the city of Aberdeen at the moment, needs support, it needs investment, it needs a specific strategic approach. What I fail to see at the moment coming forward is any sign of such a strategic approach. Indeed, it seems to be that development and proposed development in and around the city centre is designed almost to prevent the recovery of Union Street, rather than to assist the recovery of Union Street. In Marshall Square will be another part of that problem in relation to Union Street, because that is a financial impact as well. The opportunities are coming to the council, and Lewis MacDonald, as he is now so keen on Aberdeen City Council not being risk averse, I am sure will join with the calls that have been made by my colleague councillor Jackie Dunbar for Aberdeen City Council to look to use the new powers that are being given to it in relation to business rates, to look at a targeted approach to business rate reduction on Union Street to encourage independent retailers on to Union Street. That should be coupled as well, I believe, with a view of looking at how the upper levels of Union Street buildings could be utilised better, for example conversion to flats and other properties, which would enable, first of all, provision of accommodation in the centre of Aberdeen, but also reduce the space of buildings that are being let to retailers and enable those smaller independent retailers who exist in areas such as Rose Street and Thistle Street, for example, to perhaps be encouraged on to Union Street with greater exposure and greater football. That is the kind of approach that we want to be seen being taken in our city centre, not what is being done at Marshall Square at the moment, which is an opportunity only, it seems, for chain retailers who do not have a local presence to come in, set up shop in Aberdeen and potentially divert business away from some of the smaller independent retailers rather than an opportunity to enhance and promote them. That, for me, is one of the great shames about this. I am pleased that Kevin Stewart has secured this debate, because it allows us to discuss some very real concerns about the Marshall Square development and about the planning system in Scotland today, particularly about public engagement in the process when a major development proposal is being considered. I will focus on that. At this point, I should declare that my husband is a committee member of Aberdeen Civic Society, but neither he nor I had any direct input into consideration of the proposals to develop Marshall Square in Aberdeen. I would also like to acknowledge the very detailed briefing material that was sent in by the reject Marshall Square development campaign group ahead of the debate, most of which, unfortunately, I do not have time to deal with today. However, that raised many issues with the process that was followed by the city council, including the financial process. Later, it has been thoroughly investigated by Audit Scotland, however, and I think that at this stage we must accept that financial due process was, in fact, followed by the council. Marshall Square is a site of major importance to people in Aberdeen and far beyond, neighbouring, as it does, two of the city's most historic buildings—Marshall College and Provis Keane's house—with any development there having a major impact on their setting. With the removal of St Nicholas's house widely seen as a blight on the landscape of the city centre, there was an opportunity to do something iconic with the space that was opened up and to develop the site in a way that is sympathetic to Provis Keane's house with showcases and compliments of Marshall College, giving space and attracting people to the area. The development that has been approved and is now under construction has shocked many Aberdonians by its sheer size, scale and density, already obliterating the imposing granite façade of Marshall College. At a recent summit, it held to discuss the effects of the downturn in the oil industry on the economic future of the north-east and the steps that are required to secure it going forward. It was stated that Aberdeen needs an attraction that not only brings visitors to the city but also shows people from other parts of the world with the skills that we need to attract. Aberdeen is a great place to live and offers an excellent quality of life, but there is widespread feeling across the city's communities that the opportunity to develop an iconic attraction has been lost with Marshall Square as it was just a few years back when proposals to develop Union Terrace gardens were rejected by the council. That was before they reached the planning stage, but that would have been a catalyst to the things that Mark McDonald was mentioning about Union Street. Public opposition to the Marshall Square development has been intense, with residents who have never before been active taking to the streets with placards and loud-halers to protest against it. Even at this late stage, I am asking the Government to call in the planning application, seeking a moratorium on building until the public engagement exercise can be rerun. That is because they feel that the public's voice has not been listened to as part of the planning process, leaving them feeling totally disenfranchised from it. The Marshall Square development has exposed some fundamental problems with our current planning system. The public does not understand the process. When they turn out in large numbers at pre-application hearings and other public consultation events, as they did in the case of Marshall Square, they think that they have registered their objections. Unaware that, to be valid, those objections have also to be formally submitted to the planning authority within the time allowed. In this case, the many hundreds of objections expressed resulted in only 44 formal submissions on the planning application, and, understandably, people are outraged that their views were therefore not considered by the council. In my opinion, this simply is not good enough in 21st century Scotland when we are encouraging community involvement in all aspects of life. When important major developments like this are at issue, the process really needs to be changed to enhance community input. I urge the minister to consider this as a necessary and an urgent improvement to the planning system that we have currently in place. Alison McInnes, to be followed by Graham Dey. Let me first look and congratulate Kevin Stewart for securing this important debate. I was happy to support his motion. I have received many emails and letters from my constituents on the Marshall Square development, and all of them are against the scheme. Not one person wrote to me asking me to publicly support it, and I completely understand their concerns. I too pay tribute to the tenacity and the determination of the campaigners. In my opinion, the scheme is utterly uninspiring and lacks any vision. It does nothing to improve the area aesthetically. It detracts and overshadows an iconic building, and it is a missed opportunity to do something distinctive and reflective of the architectural heritage of the north-east. A series of planning decisions have left the city centre fragmented, and there was a chance to use this site to create a civic heart that the citizens could be proud of. I am not saying that Aberdeen should not have a new development, and I am not saying that the city should remain as it is. What I am saying is that this development should have been much more ambitious. How many more shopping walls does the city need? The debate is not about aesthetics, and truth be told, but it is about the financial responsibility of the city council in approving the bid by news. I am very much aware that the building works have already started, but it is important to reflect on the mess and what has got us here. We have already heard from Kevin Stewart about the lack of business plans. We have also heard about the financial risks involved in the deal that Aberdeen City Council has made with the developers, and we have heard about the secrecy surrounding the deal. We have to reflect on the fact that the Labour-led administration has regularly showed contempt for the city's resident that the design going ahead was never subject to a proper public consultation. Labour's finance convener sought to either mislead the public or was simply incompetent when he claimed that cancelling the scheme would cost £100 million in fees. Those are important matters that deserve our attention. Mews have previously stated that they hope that a big name oil company will lease off of space in the new development. Unfortunately, the last year or so has shown us in the north-east how volatile the oil and gas sector is, how quickly opportunities fade, and how too much reliance on a single sector can damage other areas of the economy. Does the member also agree that it is unlikely, given the developments at, for example, Prime 4 and the developments at ABZ by the airport, that oil companies are going to seek city centre locations when there are other locations that will be located more advantageously for the airport and the western peripheral route that will be available? Mark McDonald made an absolutely fair point on that. Employment, retail and hospitality sectors have all been impacted. The City Council, above many others, understands the peaks and troughs of the oil industry and they know that we have to deal with that. The reality is that, just now, most oil and gas companies are looking to cut down on staff and on their space. The reality is that Aberdeen City Council and Mews agree on this deal when the city was in a better financial situation than it is now, but Aberdeen City Council should have had a robust business plan for the project and they should be able to show proof that they have contingency plans. They should be able to assure everyone that this new building will have a purpose and will be financially viable, even in the toughest of times, and yet they cannot. Those assurances are currently missing.  I support Kevin Stewart's motion. Graham Day, to be followed by Richard Baker. I think that there are others who have contributed already. I rise to speak as much as an Abaddonian is an MSP. Even though I have lived longer in the constituency that I represent here in Parliament than I did in the Granite City, it will, in many respects, always be home. It pains me to say this. Aberdeen City Centre has been destroyed by the planning decisions of successive local government administrations, with Union Street a deathly pale imitation of what it once was and indeed ought to be. Along came a wee glimmer of hope in the shape of the demolition of the blight that was in Nicholas House. A chance to create an open space, a chance to let Proviskeen's house breathe, an opportunity, more than anything, to allow Abaddonians and visitors alike to view Marshall College and Greyfriars Kirk in all their glory. I managed fleetingly to avail myself of that opportunity when I was home in the summer. I have driven up Upper Kirkgate many times over many years. For the first time ever I travelled those yards able to gaze upon the magnificence of the Marshall College. It was a genuine wow moment. A magnificent piece of granite architecture, at long last freed of obstruction, enabled to be viewed as it ought to be viewed. But not for long, of course, work was already under way to construct Marshall Square, so let's consider what Marshall Square is offering. 173,500 feet of grade A office accommodation and associated car spaces, like there's no shortage of available office space to be found within the granite city. 26,500 square feet of retail and restaurant space will forgive me, but aren't the St Nicholas and Bonacord centres located within a couple of hundred yards of this spot offering just that? Isn't it the case that we already have the Union Square development enticing shoppers away from the retail heart of the city? A 126-room hotel? I thought that Aberdeen was pretty well served in that regard. I think that over recent months it's seen a 30 per cent under-occupancy rate. But in terms of the shopping element, don't just listen to we the politicians, let's consider the views expressed by Mary Portas, who I'm told is an expert in town centre retail. As she tweeted on a recent visit to the city, Aberdeen council are letting a shopping building Marshall Square, while Union Street is so like dying, what? Or a beautiful granite stone building on Union Street being left while money pumped into a new bill by Aberdeen council, madness. To be fair, the development does allow for 14,500 square feet of civic space in front of the historic Proviskeets house. Only whilst you will be able to gaze on the splendour of that particular construct, you won't be able to see Marshall College because, barring a narrow passageway, it will be completely blocked out by some of the buildings hosting these retail, restaurant and hotel facilities. But it's the missed opportunity represented here that's so sad. The chance to say enough is enough to these sorts of developments to turn the spotlight on the beautiful buildings the city already has and in retail terms concentrate on reviving Union Street. Then of course we have the financial aspect to the deal with Aviva Investors and Muse Development Ltd, whereby Aberdeen taxpayers are underwriting the risk of under-occupancy of the development by guaranteeing sharehold as £175 million over 35 years. That financial arrangement, I think, creates a potentially significant problem for the council beyond just the threat of having to fund an underutilised Marshall Square. Doesn't this arrangement potentially place councils in a rather difficult position when it comes to deciding upon future planning applications if Marshall Square is under-occupied? Won't it potentially weigh them open to accusations if they turn their applications for significant-size city centre, retail, restaurant or office developments that they are doing so in order to protect Marshall Square and the council's financial exposure there? Perfectly valid and justified decisions could be called into question on these grounds. Legal challenges could be mounted claiming that councillors may have been predisposed to rejecting such applications because of the possible implications for council budgets if they grant it. If that project isn't a rip-roaring success, it could create all kinds of difficulties for future council administrations over the coming decades. That all comes down for me to one simple question. Can Marshall Square be justified on any grounds? The answer, I and many others believe, is no. No, Colin. Richard Baker, after which we will move towards his speech to the minister. Thank you, Presiding Officer. I also begin by congratulating Kevin Stewart on securing this debate because the future of Aberdeen city centre is an extremely important issue and rightly excites strong opinions, including from the Marshall Square campaign group who we welcomed to Parliament this evening. People care greatly about the city centre. They're concerned about its current state, as we've heard from a number of members. They know its improvement is vital for our local economy, particularly its greatly challenging times for oil and gas industry. The Marshall Square plans have been, as we've heard, a centre of very heated debate. As before that were the plans for Union Terrace gardens. As someone who supported the exciting plans that have been previously for a new contemporary art centre to be paced in the gardens, I'm disappointed that ultimately they did not go ahead. But amidst of all this debate on Marshall Square as well and much disagreement, there is a consensus that our city centre must change and must be improved. I know Aberdeen city council is absolutely committed to making that change happen. The Marshall Square plans are part of that. But, of course, on an even wider scale, there's ongoing work on the city centre master plan, the strategic approach to which the administration is committed. And whatever views there may be on the plans for Marshall Square, I think we should all be able to agree that the new development will be a significant improvement on St Nicholas's house, which had stood in that site for so many years and, as Lynette Milne said, was not a building that had been widely regarded or cherished by the residents of Aberdeen, Mr Stewart. I thank the member for giving way. It's interesting to hear him now come out in favour of the Marshall Square development because he wouldn't do so in the run-up to the general election where he was a candidate. But I would disagree with Mr Baker and I would ask him for the proof of where he thinks folk think that the new development will be better than the St Nicholas's house situation.  The great majority of people I speak to in Aberdeen, no-one's expressed to me the idea that this will be detrimental compared to St Nicholas's house. I actually expect that even some of the speakers in this debate who've come with a view not in favour of Marshall Square hold the opinion that Mr Stewart's just expressed. We know that there are people who do not support those plans. Of course I accept that. There are other people who want to see this kind of environment for retail and leisure in the city centre, which Marshall Square will provide. Union Square has already proved highly popular. Indeed, it has plans to expand. I haven't got time, Christian. I do apologise. There is an important element to new finances that will accrue to the council through the Marshall Square project. Given that our city council receives significantly lower funding than other local authorities, that's got to be a key consideration for the administration as they seek to protect funding for services. While concerns have been raised tonight in the matter of the finances scheme, I point out to members that Audit Scotland report on the financial plans found that good practice had been followed. On the issue of a business plan, I understand that there was no business plan for the Marshall College scheme as well. Presiding Officer, the work on Marshall Square is proceeding but doubtless that wider debate on the future of Aberdeen city centre will continue because it is such an important issue for the future of the city. On that, we can all agree. I know that there is also broad agreement on the need for an Aberdeen city region deal. That's important, given that infrastructure investment is a key element of that deal, offering third opportunities to develop our city centre. It's good that the city region deal bid offers that opportunity for transformation of the city and that it's supported across parties, across Governments and, of course, by the two councils as well. Aberdeen city centre can be the attractive and vibrant place we all want it to be, helping to bring more people to visit, work and live in Aberdeen and enjoy all our great city has to offer. That's the goal that should not only lie at the heart of the work of our council but should be a common endeavour for all of us who represent the city. I hope that the minister will confirm his support for that vital work at the end of this evening's debate. I now move the closing speech from the minister. Mark will be agi. Seven minutes are there by a minister, please. Thank you, Presiding Officer. This is clearly an important issue, as we've seen from the debate here. I say that not just as local government minister but I would say it to the member as one city centre MSP to another. The key questions that are triggered here of heritage of finances, how to plan the best use of a short supply of space in a city centre are big questions and feelings will run deep. The evidence of that is clear from Aberdeen street protests, one led by the member leading the debate, participants in the thousands, even as Graham Day highlighted Mary Portis weighing in. We've seen a sustained campaign to influence local decisions and I'd just like to say in the spirit of recent Scottish politics where we are being willing to commend people's willingness to get involved with debates, regardless of which side we are there on. I would commend the willingness and energy shown by the citizens of Aberdeen who have become active citizens engaging on this. Whichever position you take, the determination is a thing to behold and we would as a society benefit if more people engaged so actively with local issues. I correct the minister because I didn't lead any of the protests. The protests have been led by the citizenry of Aberdeen and I think that shows the groundswell that there is. My substantive point though is, does the minister think that the community empowerment act can make a difference in allowing folks the opportunity to have their voices heard unlike this current situation where they have been ignored? I think that I was using the word lead in a purely physical sense based on a photo I had seen. Yes, I do think that the community empowerment act is really important here and that was actually what I was about to comment on. Some of the wider issues raised here before homing in on the specifics and the community empowerment agenda is all about tackling not just the inequalities of wealth and income that we have in this country but inequalities of power and influence. We have only, sadly, 22 per cent of people in Scotland feeling that they can influence local decisions and that has to be higher. There are a whole series of initiatives in community empowerment to try and get away from adversarialism and focus on positive suggestions and partnership working. We have participatory budgeting, which we are rolling out to get people directly involved in spending decisions. Perhaps crucially for this question, participatory planning issues such as charrettes, we have funded 31 of those since 2011, there are an intensive way of getting communities proactively involved at the start as Mark McDonald highlighted to provide that vision of what people want. In July we committed £300,000 more for 2015-16 and as ever we received more applications than we could fund but the appetite for this form of empowerment is very clear. The minister may be aware that a charrette was undertaken in my constituency in relation to the grand home estate and that charrette predated that process in relation to Marshal Square so the process of charrettes ought not to have been alien to the council when it was undertaking the Marshal Square project. I think that the member has made his point there. Clearly a charrette has been around and they represent one particular way of doing a very intense participative planning but the principles are good practice that can be deployed through all kinds of other methods in planning. We have to answer the point of Nanette Millan, an independent panel reviewing the Scottish planning system at the request of the cabinet secretary and its membership includes Petra Beiberbach of PASS, formerly planning aid for Scotland and its identified community engagement as one of its key issues. The call for evidence closed on 1 December and the report is expected in May with any changes based on the recommendations to follow after that. All of that is the generality here but there is the specific. There is no doubt that this is a crucial issue to Aberdeen and it brings home that we shouldn't treat council elections lightly. Local authorities are responsible for vital services for emotive decisions and for £16.5 billion in gross expenditure every year. Local democracy matters and local democracy gives councils a mandate and a way of being held accountable for decisions not supported by their electorate just as we are in this chamber. Local democracy matters. Alison McInnes in her contribution said that only 44 submissions came in against the planning but many hundreds were out in protest. The council ignored democracy. There is clearly a debate on going. People from all sides are having their say and we will have all kinds of opportunities through the electoral and democratic processes to have their say as well. As a Government believes in local decision making, we intervene in extreme cases and have only powers to direct in specific circumstances. We have no power to generally direct local authorities and, frankly, long may that remain so. Any power we have goes through the statutes passed in this Parliament and in limited cases. In that respect, Martial Square lies beyond any reach of Scottish ministers at this point. Planning permission has formally been granted by the local authority so it cannot be recalled by ministers and we must act in respect of that decision. Nor is there any evidence that the council has failed in a statutory duty under the 1973 act, which could trigger powers as well. Audit Scotland has concluded that relevant transactions have been appropriately accounted for in its 2014-15 annual audit of Aberdeen City. Appropriate processes have been followed in a financial sense. The Scottish Government's power to direct following a recommendation by the Accounts Commission therefore will not be engaged on grounds of best value. Although there have been criticisms of Audit Scotland this evening, they are our established independent body and the Scottish Government must have regard to them and indeed the powers are only triggered when through their work with the Accounts Commission they would recommend something. I would return to where I started on this. Audit Scotland did look at the finances but this is a political decision. There are issues that are much wider than the finances, the opportunity cost, the other uses of the square, the advisability of investing in one project over another. All of those are within the scope of reasonable local political debate and it would be understandable for people to come to different conclusions about the advisability of the plan just as it is within the scope to view administrations positively or negatively. Planning permission was passed in a close vote of councillors. The Muse deal was passed in a close vote of councillors. This has been an issue of controversy and I expect that controversy to continue. The member has brought that debate here and is to be commended for acting on his views as a local representative and giving that debate more space to take place. This Government is subject to constant attacks from parties over there and indeed over there about centralisation and being called on to intervene in local decisions on everything from planning to social care. The minister believes in local democracy but let me restate to conclude clearly what my predecessor said to Kevin Stewart last year. That is that our actions do not constitute giving approval to the proposal or agreeing with decisions taken by the council. We are merely acknowledging that it is in the council's area of responsibility and just as we want to see empowered communities we also want to see responsive democracies. The first without the second will only lead to cynicism and disengagement. It is only when all levels of government are truly realising the Christy principles of prevention, performance, people and especially partnership and participation that we will have flourishing village towns, city centres and everyone able to look with pride on the place that they call home.


Hi, and welcome to the session. Let's discuss the following question. The question says write the first five terms of each of the sequences in exercises 1 to 6, whose n-th terms are, fifth part is a n is equal to minus 1 to the power n minus 1 into 5 to the power n plus 1. Let's now begin with the solution. Given n-th term is a n is equal to minus 1 to the power n minus 1 into 5 to the power n plus 1. Since we need to find the first five terms, therefore we will put n as 1, 2, 3, 4 and 5. By substituting n as 1, in this expression we get a1 is equal to minus 1 to the power 1 minus 1 into 5 to the power 1 plus 1. Now this is equal to minus 1 to the power 0 into 5 to the power 2, minus 1 to the power 0 is 1. So this is equal to 1 into 25 and 1 into 25 is equal to 25. By substituting n as 2, in this expression we get a2 is equal to minus 1 to the power 2 minus 1 into 5 to the power 2 plus 1. This is equal to minus 1 raised to the power 1 into 5 to the power 3 minus 1 to the power 1 is minus 1 into 5 to the power 3 is 125. So this is equal to minus 125. By substituting n as 3, we get a3 is equal to minus 1 to the power 3 minus 1 into 5 to the power 3 plus 1. This is equal to minus 1 to the power 2 into 5 to the power 4 and this is equal to 1 into 5 to the power 4 is equal to 625. So this is equal to 625. By substituting n as 4, we get a4 is equal to minus 1 to the power 4 minus 1 into 5 to the power 4 plus 1 and this is equal to minus 1 to the power 3 into 5 to the power 5 minus 1 to the power 3 is equal to minus 1. So we have minus 1 into 5 to the power 5 is equal to 3125. So this is equal to minus 3125. By substituting n as 5, we get a5 is equal to minus 1 to the power 5 minus 1 into 5 to the power 5 plus 1. And this is equal to minus 1 to the power 4 into 5 to the power 6 minus 1 to the power 4 is equal to 1 and 5 to the power 6 is equal to 15625. And this is equal to 15625. Hence, the required terms are 25 minus 125, 625 minus 3125 and 15625. This is our required answer. So this completes the session. Bye and take care.


But how does that defence work when President Trump now says this? I was asking a question sarcastically to reporters like you just to see what would happen. So he claims it was all a joke, Mary Lambie. Yeah, and the fact that the reporter he was referring to wasn't even in the room when he said it apparently. But I think the great news to come out of this is that all the Trump voters will inject themselves with disinfectant, which would be not a bad thing. Look, I'm just trying to stop that text machine from blowing up, Mary, thanks. Because generally when you mention the name Trump... Yeah, look, I mean... He's a fool, he's borderline insane. So let me jump in with that one, which is that I wouldn't want anyone to follow his advice. That would be hideous. What I would rather... Trump, no, no, no, no, the hardcore Trump voters, you do want them to... No, no, I want them to see the light. I want everyone to see the light, there's nothing wrong. We were talking about, sorry, there's nothing wrong saying, you're sorry I was backing the wrong horse. Even Pierce Morgan said that he used to be a Trump supporter and he no longer is now. So I don't want anyone to follow...