Hello everybody and welcome to the DMTV special. It is really a great pleasure and honor to have with me tonight Batul Said and Arielle Coran. Batul is working as a content strategist at Amazon and Arielle is a multilingual founder of respond crisis translation working at Google. They have both been working closely together to organize the campaign no tech for apartheid. They're a part of a large group of employers of Google and Amazon that are fighting against the contract project Nimbus, $1.2 billion contract that the company signed with the Israeli government to sell them cloud space and dangerous technology that they can then use against the Palestinians in the future. So hello Batul and Arielle and thank you for being with us tonight. Thank you. Thanks for having us. Okay so for people who maybe don't know, can you please tell us how this campaign started and also most people that knows the companies Google and Amazon, they think of Google as a search engine and Amazon as a thing where we go shopping. So they wouldn't closely link these companies to the military and the Israeli government and the whole thing about using these engines for military purposes. So can you tell us in a way why are these technologies so dangerous and in what dangerous ways can they be used in the future and why did you as workers in your companies decide to start this now because as we know Google precisely has been of course using the technologies in lots of ways to surveil people and stuff like that but why was this the moment when you said okay we don't want to be a part of this. Sure I guess I can get started and Arielle please jump in as well. So we kind of started the specific initiative actually back in May of this year when the Nimbus contract was signed. The contract was signed at the same time in May that there was a real surge in violence by Israel against Palestinians specifically in Gaza where we saw hundreds of Palestinians killed and injured and lots of destruction in the area. So that was really a horrible time any time is horrible for this contract to be signed but that coincidence is what led a lot of employees at each of the separate companies to realize that we had to do something so those of us at Amazon and the workers at Google we both kind of separately led initiatives to ask our companies to recognize what was happening to Palestinians to commit to donating to Palestinian organizations different things like that but one of the asks that was in both of the letters that we sent to leadership specifically around the project Nimbus contract but more largely was asking the companies to commit to not doing an ethical business well I'm sure we'll talk about this later but both of the companies do have principles around what type of business they do they have Google has their AI ethical AI principles Amazon has human rights principles so all of these things that we knew that this contract doesn't fit into and that the contract is really in direct opposition to the company's own publicly stated values but of course also to our values as workers so that's really where this all started from once we led those two separate initiatives at each of the companies and I will say that we had over I think over 17 1800 workers who signed on to those letters back in May we got together as workers REL and I and several others that came together to really try and figure out how we could make this larger since Google and Amazon are two of the largest companies in the world we felt it was really important that we take some type of action and hopefully set precedents in the future so that other companies don't do this business and recognize that workers will continue to kind of rise up and make our demands heard to the companies so that's how this initiative started the larger initiative that you mentioned no tech for apartheid that was created by two organizations JVP and Empower Change Jewish Voices for Peace and Empower Change which are two organizations here and they saw what we were doing as workers and wanted to join in as well so they also they started the no tech for apartheid campaign which I think at this point over 50 other organizations have also signed on in support of that as well so yeah that's kind of I guess a long summary of how the initiative started I guess I can pass it on to REL to talk about kind of some of the other things around what these companies are known for but and how this relates to that so REL feel free. Yeah I mean everything but we said that these contracts were signed the exact same week that we saw over 260 people in Raza murdered at the hands of the Israeli military and that to you know exactly the way but we said it it would have been really scary for us to see our technology being used in this way at any time but the fact that this was the timing that was chosen doesn't seem like a coincidence to us one other thing that I would add is the fact that the contracts themselves actually include a clause that explicitly basically disallows employee activism to actually lead to the contracts being rescinded so the contracts in them themselves protect against any sort of action from the companies to rescind the contracts in the event that employee activism emerges from the existence of these contracts and the contract actually explicitly allows the Israeli government including the Israeli military and the Israel land authority to use the services however they would wish without the companies having any sort of right to regulate the way that the services are being used and so as workers in addition to having this kind of end goal that our companies will rescind these contracts one of our goals is to emphasize that you can't enter into a business contract as a company that doesn't allow for the company itself to regulate the way that those services are being used that is completely it's unethical and it's dangerous right and as workers one of the things that we're pushing for is our right to transparency when we're putting our labor into building out services how do those services get used it's our right to understand that and to have transparency and one of the things that frightens us about Project Nimbus specifically is that it almost feels that it's serving as a sort of testing ground for Google and Amazon's ability to fulfill military contracts where employees have no voice so we don't believe we know that this isn't the first time that a contract like this is going to be signed this has happened before and we know that it won't be the last time and so our organizing you know really seeks to show that tech workers absolutely need to have a voice in the way that that technology is being used yeah and it's very interesting that you are not because of course many labor movements they ask for like you know better working conditions better salaries but this is maybe the first time that there is a huge movement that asks for transparency for what the company does like not not for yourselves as workers but for the other people that are influenced by your work so that you do not want to be a part of this kind of using of technology that you work with which i i think is really great and can i just add to that that is a working condition and that's one of the things go through this and i think to your point a lot of people still don't realize that the the the clients that companies take on and the business that companies engage in and the types of contracts that companies sign into those are working conditions and we would really ask folks who are watching to imagine how it would feel to be a Palestinian employee at these companies right now to be a Palestinian employee within amazon or within google and to essentially be expected to use your time and labor to build out technology that is literally very likely to be used to systemically harm your own community to surveil your own family and your own community and then just to be expected to show up to work and not say anything about that that is a working condition yeah yeah just just to add one more thing to that we do have so you know rl and i have been public about this and we've had one other person who has also been public about this and you'll notice that none of us are Palestinian that being said we do have many Palestinian workers who have been organizing with us but who have a very real fear that their exact involvement in this will do exactly what rl has said in that have repercussions beyond just workplace repercussions but that the technology that's being built that will allow for further surveillance um and and you know all of these issues that we've talked about that that happen to Palestinians at the hands of israel will happen to their families that are still in Palestine so there's really you know a connection there as well that although workers um are being forced you know to work on these things as employees of the companies there are um consequences to that and their involvement in speaking out against that goes beyond just them or other customers but really affects their family um and people that they know in these places and what's we just asked when we did that as well like we are asking our companies please do better by Palestinian workers because as Batoul said Palestinian workers have have led this movement they have been leading this movement for a very very very long time and yet they do not feel safe right now in our companies to speak out because they are forced to fear that their working conditions will become worse that there will be retaliation that there will be limited job mobility limited access to promotion and even you know fire being fired within the companies and then even worse that there could be material um impact on the quality of life of their own communities and their own families and google and amazon and every tech company has a responsibility to live by their stated values when they say you can bring your full self to work and allow Palestinian employees to feel affirmed that they can engage in this sort of activism openly vocally publicly and be safe and be protected and that right now is not the case and that is the reason that we're the ones here right now and not the Palestinian workers who have been leading this work for so long and did you the two of you well the three of you that are have been public since may with the whole story did you have problems in your companies and your communities were you faced also with with some kind of challenges because you are a part of this campaign and also can can you tell me how many people until now have signed signed the no tech for a part-time campaign and how is the situation in your companies at the moment did anybody contact you did some directors call you did you get any kind of response to this activity that you have been doing and as you said in the contract it said that the activism is not allowed in the way so what what were the reactions for the two of you precisely with the whole thing yeah we've actually seen in a lot of ways a lot of support that has come out from us being public so we've had people that work at at the companies that we don't know that have reached out and have sent messages of support have asked for ways that they can get further involved have joined in on the work that we've done so since may the groups internally have grown a lot larger that feel comfortable talking about and organizing around this issue i think also i mean we've been as workers as part of this campaign have been inspired by workers that have been part of past campaigns at both of the companies that are very similar you know talking about contracts that have been done with the u.s. military with police departments with the chinese government different all of these different contracts that are similar in the sense that they violate our values and workers have always been a part of leading campaigns against those so in the same way that we were inspired by all of those groups i think that we have also kind of allowed other workers to feel comfortable having these discussions at work you know these are things that we can talk about because our work our labor is involved in how these companies obviously make money like we really are the reason that the companies are able to do what they do is because of the workers and i think workers are recognizing that they are able to talk about it and take action and all of those things which has been really great we have had over 1100 or 1200 workers that have signed on internally but we've also had through the no-tech for apartheid campaign externally we've had over 20 000 signatures that way as well who have reached out so those 20 000 people have essentially reached out individually to leadership at both of the companies and we've yet to hear anything back from leadership regarding this campaign we haven't heard since may so we don't know where we stand there so it's like complete silence from them yeah yeah and so what are your further actions concerning this will you try to reach out to them in some kind of a way or will you just continue doing the campaign and hope that it will have an influence what is happening at the moment with with project Nimbus what is at this point like now in December well we are asking our companies please you know please heed our call to action we're we're still waiting on that response and yes it has been radio silence from leadership in spite of the fact that like what we said 20 000 people have written about this that is a lot of people who are deeply concerned about this crisis of conscience so we would just really call on our leadership to please listen to those 20 000 people externally and please listen to the over 1000 workers who have signed this petition we're going to continue to escalate this we're going to continue to speak up about this and we're going to you know it's not just us as workers the public is really concerned about this as well and so folks from the public are going to continue to speak up about this until we hear something from our companies and from leadership and of course we we know that these how google can be used and we also know about how artificial intelligence can be used in lots of ways to discriminate people to surveil we have been seeing that in the west we have been seeing that in china and your people that work in technology most people have no idea how these things can well how these technologies can be used in dangerous ways of course you have no idea what the israeli military will use they use this for but why why do you think these technologies are so dangerous just to explain to people what can happen to the palestinians at the west bank and gaza in what what ways can these technologies be used in the future and well that is precisely why you you are fighting against this project because they are selling them cloud space but they are also selling them the technologies that they can use for lots of types of surveillance in the future yeah absolutely i mean one of the things actually that you just mentioned is one is something that we've been really focused on is that they're they're they're selling cloud space they're selling this technology this data infrastructure but beyond that the the contract has a clause arielle mentioned the clause that doesn't allow for the contract to be cancelled based on workers you know rising up around that the other clause that we do know about is that this technology can be provided basically to any part of the israeli government or military and more importantly that the the companies that are providing this infrastructure don't have any oversight so israel can really do absolutely whatever they want with this technology we know of course that the israeli government has used technology and continues to use technology to profile palestinians at checkpoints to surveil palestinians in gaza push palestinians out of their homes maintained segregated roads all of these things that have been happening and will continue to happen will only be further strengthened by technology like this and that's you know i think it's really critical to kind of you ask this at the beginning as well sort of we know google and amazon for certain things and this is not necessarily something that we associate with those companies but we really in a sense kind of have to reshape what we think of as you know quote-unquote weapons like how now in the 21st century are these things being carried out by oppressive regimes and this technology is really allowing for all of that to happen and it's really from the company's perspective it's a disturbing pattern we've been saying of militarization where these companies are engaging in business with organizations and institutions that have been known and really have been found by even the leading you know for example in israel by the leading human rights organizations they have found and they have done invest investigations of apartheid in in israel against palestinian so you know there's a huge concern there of how expansive this technology will become this is a i believe a seven-year contract that has provisions to be expanded for another 20 plus years and we have no idea how the technology can kind of evolve in the next even in the next year and what israel can do we've seen um you know of course we don't know in depth sort of the exact ways that this will be used but we know that israel has used drones and uh artificial intelligence technology and surveillance we saw a lot of the attacks that happened in this past year and of course in all of the years past um that have happened and our question is really like how can we allow our companies to continue to be complicit in whatever happens in the future we don't know of course what that'll be but we know what has happened and um and that that will happen again so that's really our largest concern uh and i will do have something to add or i think but thul said it all i mean i think essentially that is essentially it and this isn't only happening in the case of project nimbus is the thing you know that we could add that we have seen workers speak out whenever we see that our companies are engaging in potentially unethical and harmful military contracts right that's happened from workers at amazon that's happened from workers at google and we've actually seen these companies pull out of contracts before in response to work or organizing when workers say hey this is unethical we cannot you know be people of conscience working at these companies and allowing our companies to engage in these contracts without saying anything we've seen that work before we've seen companies rescind these contracts and we know that it can happen again if it's happened before one example is project maven this was an ai contract with the pentagon um it was essentially worth around 50 million dollars it was between google and the pentagon and it was designed to help the united states military identify objects from drone another aerial footage which of course workers were extremely concerned about there was immense amounts of employee outcry and employees rising up and saying to the company this is not okay and google actually dropped project maven right and so and another example is project dragonfly which batula alluded to um this was a contract with the chinese government it was essentially designed to build out a censored search engine with the chinese government when employees stood up and said hey this is wrong google also dropped this project so google has done that before we know that that that can happen again with project nimbus but unfortunately the ai principles that we have that are designed to protect against this sort of systemic human rights violations that can happen when tech companies do business with militaries you know those principles are being skirted and google is continuing to develop new cloud infrastructure and technology in order to continue to pursue these military contracts and so you know as workers we have to continue to really assert our voice and our right to have a say in the type of contracts and business that our companies are engaging in and do you think that this time is it's going to be different than the previous times when when there were contracts that were that have been able to to be in a way blocked do you think that this time it will be different because it is the military that is involved or not because why do you think this time specifically they did not even answer to you for how many months since may you know why do you think it's different than the the previous times now or or not or do you just think they need more pressure of more more workers or do you think this is a specific situation and that it will be harder to to do something with this contract to make them stop it i don't know if we can know that i don't know it's hard to say our hope is that we're going to hear back and i think i would imagine it's typical that when you know workers start to speak out and the public starts to speak out you really need to reach a critical mass in terms of this we have been we have been crying out for a long enough time we have put enough pressure we have continued to escalate so i guess we have to continue to apply pressure continue to escalate and for anyone who's watching like please you know write to google write to amazon understand that to the same extent that we as workers have a right to speak up you as consumers right you also have a right to speak up as well but i'm sure you have some stuff to add as well yeah i mean i think it's important really that this is a you know we remember that this is a long-term contract and there is still the option for the company to pull out later you know they haven't responded now but there is still time and we still hope that that'll happen and of course as ariel said with the continued pressure that we really encourage everybody to participate in and actually i don't think we've mentioned this yet but on that note anybody who's watching can go on to notechforapartheid.com and you can read more about the campaign and you can also sign on and and kind of see what other actions you can take but yeah i mean it's really going to take this kind of sustained and continued effort we have seen i mean in the case of amazon one of the campaigns that had inspired us there was led by workers against facial recognition technology that was being used by the immigration authority here in the u.s the cbp and and by police departments and amazon was selling this facial recognition technology but after you know constant and again consistent worker requests and demands for this technology to stop being sold amazon actually initially put a one-year moratorium on selling facial recognition technology after that one year was up and keep in mind this campaign started in around 2018 and the more moratorium began in 2020 so that was already a couple of years right of these efforts in just this past summer the one year moratorium expired and amazon actually indefinitely extended the moratorium to no longer sell facial facial recognition technology to these agencies which is really a testament to what worker power can do when it is sustained for the long term and i think that's what we recognize when we started this is this is something that we're going to be working on for a really long time and there's always an opportunity for the companies to actually heed our requests and commit to doing ethical business and do you as workers think that there are other options that you can maybe in the future if they do not react to these kinds of calls and to this kind of like an open invitation for them to communicate with you on this team do uh are you ready to go further with it like maybe ask for some kind of a strike or maybe boycott in a way or ask for boycotting the companies or do you think or do you have what kind of strategy do you have in the future if this doesn't work do you plan on doing some other actions yeah i mean who knows right like as Ariel said that there's so many kind of unknowns about what will happen in the future and how we'll respond to that i think for now we're really just trying to continue to get the word out and get more workers involved and we invite any workers that may be listening to this to reach out to us and i think there's a lot of creative ways that workers have done things in the past and new things that can be done and you know we may have to continue to revisit the strategy and what the best way is to reach out to our leaders and to the companies but at this point i think we really we really don't know but it'll be something whatever it is we'll kind of continue to be working on this and and the public is is angry as well about this it isn't just workers and so a lot of this is all it's it's led by workers but it's also led by users right the consumers because the consumers or the users of these companies also have the right to speak up here right and you know this past week on the International Day of Solidarity with Palestinians, Palestinians mobilized and actually organized a campaign where they were giving you know bad ratings to Amazon and Google on mass organizing tons and tons of people to give the lowest possible ratings to Google and Amazon and we're going to see more of that absolutely because when when a when a business or a company does unethical business that isn't transparent either to the workers or to the public obviously both workers and the public are going to rise up and so there's absolutely going to be a lot more that that is yet to come and have you been connecting to other uh big companies that use technology for unethical stuff like Microsoft and Facebook have you been in contact with their workers and do you plan on making this like a broader thing not just this specific thing as using technology for unethical things but also a broader thing of using technologies in lots of ways that are like surveillance and mass surveillance that combining yeah I mean I think one of the great things that we've seen in this past year actually is the way that tech workers at various companies have been standing up you know against all sorts of things and I guess actually I should correct myself and not not just this past year although that there's kind of been an increase in that but really the past several years there's been workers across all companies there was again kind of going back to some of the past initiatives there was the we won't build it campaign which was a part of a lot of the facial recognition technology actions that I spoke about earlier and that was really built out of workers across Microsoft, Salesforce, Amazon all of these different companies that are involved in this type of work we've now seen workers recently at Netflix organize a walkout against things that they found against their values so there's lots of actions that are happening and I think that all of these you know whenever we have even the way that I guess that Ariel and I got in touch and that the organizers for the Project Mimbas campaign as workers got in touch was really because we saw that we were both doing this and we saw that there's an opportunity now for us to work together and I think that's what's been happening and what has been really great about doing things like this and being able to speak like you speak to you and everybody that's watching this is that it gives workers from other companies a way to see that this work is being done and that there's ways that we can connect and collaborate and work on things further in the future and it has been really encouraging to know that we can work together and although our companies are different and may do different types of work the unfortunate connection is of course this like kind of connection that they have in doing unethical business but this is a way as workers that we can join together and hopefully at some point in the future we'll see that they will actually listen to us as they have in the past you know and in these instances that we've mentioned where they have listened to the demands of workers but this will be an opportunity for companies potentially in the way that we as workers came together against Project Mimbas perhaps Amazon and Google can come together as companies and pull out of Project Mimbas right so there's all of these ways that we can kind of work together and that's really what we hope for in the future as well is is really making this larger and setting the precedents as workers from two of potentially the largest companies in this space that we can make these demands and that the companies can in exchange listen to us and make change in the industry as a whole. And I also do think part of the historic nature of this particular campaign that we're working on is the fact that we're not working in company silos Google folks and Amazon folks are coming together and we're working every day together to make these demands and to organize this so as Batul said I really do hope that we're kind of setting a precedent for future work or organizing across company lines where we can organize people you know tech workers and workers across the board working in different tech companies and you know around the world as well and to come together because ultimately like Batul said these are different companies but the problem is the same right the same root problem is this kind of almost arrogance that I can enter into this contract and deny employees the right to have a voice in what I'm doing and deny employees the right to speak up and say hey I want to have transparency about what kind of business my company is is getting involved in and so the more that we can come together and really enforce like let's work together on this we do have a voice as workers I think the better and the stronger will be moving forward. And did you at some point I don't know how long have the two of you been working in your companies how many years? A couple of years for me two to three yeah I've been yeah six years six years did you at some point think of leaving the companies like I'm you know I don't think that there is a chance that I can do that I can manage to change this huge corporation that has its way of dealing with things or do you there's always a dilemma what what to do you know or do you think that it is very important that employees at this company change it and within do you think that the system can actually be changed in if the initiative goes from the workers sometimes we think it's it's you know it's in utopia but it would be perfect to imagine the world where you know workers can really influence the companies they work and mostly these huge huge companies that we know that are mostly oriented towards profits. Yeah that's a great question I think you know it's really both that are important we've mentioned in this case specifically that we've had all of the workers that have been organizing and then we also had the public that came together kind of naturally and through the organizations that got involved I think both of those things in all of the cases that we've seen in history are really critical to companies making any sort of change and what's you know in in these specifically I think with google and amazon what's interesting is that we all are users right like who who isn't using google who isn't searching things who doesn't have a gmail account and who doesn't have isn't buying things on amazon or you know all of these things right so these are companies that are really part of our daily lives and consumers that most of the public is going to be consumers of these companies and customers of these companies and then of course as workers you know we have a different lens kind of from that internal view so I think it's very important that we work together and we continue to work together as both the public and as workers internally I think you know one of the things that in a lot of the conversations I've had with different workers who are engaged in this kind of activism in the workplace one of the things we have in common is we feel like as workers it's almost impossible for us to not speak up when we see these kinds of things happening and we find that commonality amongst workers that speak out on any you know you mentioned earlier kind of more of the kind of common things that workers speak out against in the workplace and all of these things are things that we feel completely compelled to talk about it's almost like every day when we go into work we know that these things are happening and that we can potentially be complicit in the results of the business that the companies we work for do and to kind of counteract that in a sense we have to speak up we have to do whatever we can in our power as workers to be able to actually make a difference within the company and that's what really drives a lot of us to continue to do this work despite any kind of fears of retaliation or negative feedback we know that and i think this is also important for companies to recognize is that even if we leave the companies and we're not doing this work and we as in like the two of us or any individuals this work is going to continue to be done it's really not we're not the first ones to do it we're not the last ones that are going to do it and workers are going to continue to make demands of their companies until we feel like those demands are met so this is really something that is um is not going to stop you know i think people are always you we open the letter that was sent um in october the letter was kind of opened as we are employees of conscious and conscience and we think that that's you know there's always going to be those workers um so it's important that we as workers that continue to work at this company and continue to make these demands along with the public as well and the customers of these companies uh and um you were talking Arielle also about um transparency and how important it is to for all for these huge companies to be transparent about what they are doing and what they are uh at the end using your workers for you have to know at every time what you're working on uh did it happen um in the past that you were not aware of uh some uh contracts they they were making or some uh jobs that you were doing and not not being aware what it was used for and also uh were there any whistleblowers in uh amazon and google that uh that revealed some information that you were not aware of in in the past well yeah i think some of the the the organizing efforts that both Batul and I were mentioning are examples right project maven um with the department of defense the cvp contracts on the amazon side project dragonfly which was a censored search engine and um you know beyond like whistleblowers it it's about workers really organizing right workers coming together and saying we don't know what is happening here this is not fair and these contracts do not have any sort of you know adherence with these publicly stated values that our companies have right and so i think that's what it's about and just going back to some of the stuff that Batul was talking about um you know speaking to your question around do we ever think about leaving the companies or do we think that organizing is the right thing to do to remain within the company and really push the company and drive positive change or speak out for you know hoping that our companies will behave in a way that makes sense i think it's important for companies to know that workers absolutely do question whether or not they can remain in these companies as a result of this behavior because when when a company states publicly these are our values these are AI principles or we're committed to to protecting human rights we're committed not to building um artificial intelligence that could do harm right when a company states that publicly and you agree to go work in that company and you sign a contract to become a worker to become an employee you are owed from the company that the company will actually live up to those values because that is the that is what you're agreeing to be a part of those publicly stated values right so the companies actually have that responsibility to workers and when companies are not behaving ethically in the way that they do business and in their contracting they are violating that contract with the worker and that's why we're really trying to emphasize the fact that the people and the organizations and the governments and the institutions that our companies do business with and the way they do that business it is absolutely a working condition right it affects the experience of workers and it makes us complicit we become complicit like but to have said we then become complicit in these human rights violations and that is not fair and as workers that is why we're speaking up right now and did you want to say something but yeah yeah just to add one other thing I think you know the workers the the company sorry should also be concerned about how this will impact talent that that wants that previously wanted to work at these companies and no longer wants to because of the type of business that they're doing and the I think Arielle mentioned this the kind of the arrogance that they have around like you know we're so big we can do this it doesn't matter when it really does matter we are kind of seeing and like you know we've said there's kind of a shift in tech workers that kind of are more willing to take part in kind of this larger labor movement and I think that's also kind of a generational shift that we see that people now that are coming out of college and looking for jobs they don't want to work at companies that are not committed that are not actually committed to to doing ethical business and are just kind of saying that they really are they care about kind of what the work that they're doing may be a part of and that will impact the types of people that you know work at these companies in the future really caring about how the way that their laborer will be used so just wanted to kind of add that as another thing that I think a lot of future workers or workers now that may have wanted to work at these companies previously but potentially no longer want to because of these sorts of things and we've seen that really in I think a lot of cases too like places like Facebook and others where they've been involved in a lot of censorship that there's Palestinian workers I mean this is kind of an anecdotal thing that I can share friends that I have that have worked at Facebook and are Palestinian and in the past couple of months have been very very kind of adamant about finding other jobs so that they no longer work at Facebook because they don't want to be a part of that kind of work and that's something that we've seen in a lot of places I think people either choose to continue to stay at the company and then take part in this kind of activism or they they say that you know I simply can't be a part of this any longer and it's completely against my values and I won't you know my labor will not be used for this type of work and they leave the company so companies should be fearful of how this will affect the people that that are working for them. Yes I think this is very important what you just said that the situation and the climate is I think changing and I think the political situation and the situation in society is changing and that more and more younger people do not want to spend their precious time working with things that they do not believe in and I think that this is in a way a specific moment where this is the thing that is rising and that I think will influence all of these companies to think twice about doing the things that they are doing so I also wanted to ask you because the the past two years have not been normal in a way because of the whole pandemic crisis and I think that the technologies and of course your companies were very much the ones that had most profits in a way of the whole situation Amazon for well in Google also and I think in this way that these companies probably grew in a way and most people have been spending lots of times at home with their devices and so my question is first do you think that this is a specific moment in history what you are but will saying where people are becoming conscious of the problems that we are having in our working place because most of the people started working at home had more time maybe for themselves and started thinking okay if I'm going to live this way you know I do not want to work and live this way and to feed myself with these kinds of things do you think that this was maybe the situation where specifically that is going to maybe change things for the better and maybe make people more conscious of the situation that they have been of course living in for a long time not the last two three years yeah definitely I mean I think the like you mentioned the pandemic this whole pandemic time has been a very unique situation where you're exactly right that workers are recognizing what they want and what they don't want and we've seen I think especially in the US we are kind of in an interesting place in terms of labor in general we don't have the necessarily we don't have this super strong unions and culture of workers organizing and protesting and walkouts and all of these things that are common in Europe we don't really have that in the US especially now that culture has kind of dissolved in some sense but I think in the past couple of years we're seeing that that is coming back and workers are becoming more engaged both kind of workers as we think of in the traditional sense like warehouse workers at amazon that have tried to create unions we've also now seen union efforts from companies like starbucks here in the US that are trying to unionize and we're really just seeing kind of an overwhelming I would say amount of workers that are recognizing what they want and what they don't want out of companies and most importantly understanding that they are the ones who can ask companies for these things and it's really through workers now that are making demands of companies that there will be hopefully ultimately change at the companies and kind of the culture in general of work I think people are recognizing that we don't have to just go into work every single day and sit down at our desk and just do our work and not talk about anything else and not kind of look into what our companies are doing and keep our heads down we don't have to do that as workers and we shouldn't do that as workers we really have the opportunity to ask questions to have discussions in the workplace about things that are happening to talk to each other and we should feel safe and protected to do that at work and not have a fear of retaliation that a lot of us unfortunately have where we feel like if we say anything then something bad is going to happen and it's not just that something bad's going to happen now but now oh my gosh I'm going to be at this risk if I ever try to get a job in the future I'm going to have to talk about this and all of these things right but we shouldn't have that fear at all we should really feel kind of this free and openness to be able to have these discussions and importantly make these demands and have the demands be met so I think it's definitely changing I think a lot of us are recognizing the things that we can do and it's kind of it's unfortunate that it had to take a situation like this to kind of show us that we don't have to just do work in kind of the traditional sense and that we do have options but I think that that is something that will have a lasting impact on the future and the way that labor is used and I think it's very important to what you said previously that if the two of you left even the companies that the idea would stay and not just the two of you but anybody else that in in these companies talks about these very important things and reacts to the working conditions as you said the idea has to stay and in that way I think that what you were also saying that we are all very much we are using technologies on a daily basis we are of course using google we're using amazon we're using social media and boycotting completely all these technologies would be impossible or it would be possible but I don't know how so I think that the idea the perfect idea would be to hijack these technologies and to hijack these companies you know that give us the tools we need but to use these technologies in the sense they're supposed to use in an ethical way in a way that is good for humanity like in Star Trek not Star Wars so yeah I think that this action that you you are doing is in a way for me it is this kind of an action where you as workers are in a way demanding to be a part of these companies not just as workers and not just as employees but as people that can influence the companies the same way as the directors the heads the CEOs and everything else can influence absolutely and I think you know to your point around what what role did the pandemic play in this kind of like public consciousness it's natural to become really angry when you see that the pandemic happens and and and people are suffering people are dying and people are losing their jobs and they're losing their stability and you see you know tech companies and the executives within those companies becoming bigger and wealthier I think that's part of the anger right and I think you know but we'll talk about the unionization efforts that are happening across the industry I think those efforts are really important on the google side you know as a google worker I'm a part of the alphabet workers union and I think the existence of this union is evidence that tech workers across the board are starting to realize that we are workers tech workers are workers and we absolutely need to take a stand as workers and especially those of us who are full-time employees need to take a stand in solidarity with the folks who are contracted by these companies and with the folks who are directly impacted in a lot of different ways by by these companies you know and so I think that's one of the biggest changes that we're seeing you know this this awareness that tech workers are absolutely workers and and that is something that I think is really exciting when we look towards the future and the kind of impact that both workers and also the general public are going to be able to play especially the more that that kind of the consumers and the users and the workers can really come together and organize and what what would you say now approaching 2022 what would you tell other workers and the other and users also what can they do in the new year to improve their own companies and what are you planning to do in the new year of course you will continue this campaign do you at this moment have some new actions or will you just continue to do the things as you have been doing and what would your message to the people that are watching be for the new year what they can do to maybe make the world a better place yeah I mean I think really as workers one of the things that we can do going into the new year is really simple and that's just having conversations with our co-workers I think a lot of times even when it comes to things like wage disparity or things like that in the workplace we ever know that these things exist until we talk to someone and then we find out that it does and that we may be having the same problem and and that there's ways that we can work on it together potentially and we're always stronger when we come together right and that's something that we've definitely noticed as this group that has been organizing against Project Nimbus is that there's a lot of power that comes from coming together and working together and so I think it's you know it's something small that we can do is just continue to have these conversations talk to people that you work with around of course we would love for people to talk about this issue and kind of organize this issue but really anything that's happening in the workplace or that the company is that people work for are taking part in to start having those conversations and really together through that we can figure out ways that we can make changes and really kind of one of the things that we've said in the past is one of our ultimate sort of goals is really make these companies heat our demand that technology should bring people together and work for the common good and not cause harm and it's really a basic basic message when you think about it so that's something that that I would encourage everybody to kind of talk about and think and brainstorm different ways that we can actually ask our companies to do that and that's definitely something that I'll be doing I think also like we mentioned for workers specifically interested in asking Google and Amazon to drop project Nimbus as we are to look at the notechforapartheid.com campaign and see other ways to get involved there and for any Amazon and Google workers that are that may be watching to get in touch with us and continue to work on this together. That's real. Everything that was we just said please go on to the website for this particular campaign notechforapartheid.com you can actually send a letter to the executives at both Google and Amazon tweet at them use your social media email you know you can send them letters also email your local government representatives and ask them to send letters as well because you know being able to apply pressure from the public sector is also important so I think like you just knowing that you have power you can talk about this with folks you can talk about it publicly you can send a letter I think is really powerful. Thank you so much and we will put of course all the links below so that the people can join. Thank you so much Ariel and Batul for being our guests it was really a great pleasure and I think that this what you are doing is very important and I hope you will succeed in the next year and I'm sure you will. Thank you for being our guests. Thank you so much. And also for our viewers have a merry Christmas and happy new 2022 and if you want to put something in your new year resolution it can maybe be to join the M25 our movement that is trying to improve the world and trying to influence the society to think in a different better way. Thank you very much and see you soon.


For more videos on People's Struggles, please subscribe to our YouTube channel. On June 6, 1944, over 156,000 troops from the UK, the US and a number of occupied European countries landed at six spots in France to officially launch the Western Front against Nazi Germany. These were known as the D-Day landings. This year, on the 75th anniversary of these landings, massive celebrations were held in the UK and France with representatives of 15 countries participating. Missing, however, was one country who the Allies seemed eager to forget, Russia, which resented the Soviet Union and played the single most significant role in defeating fascists. On June 22, 1941, Nazi Germany invaded the Soviet Union and during the course of the Great Patriotic War, nearly 23 million soldiers and people of the Soviet Union died. As the country's leadership and people, the sheer will slowly rolled back the German war machine. Compared to the Asian Theater and the Eastern Front of the War, Western Europe and the United States suffered only a fraction of the civilian and military losses in casualties. The Eastern Front was the largest conflict in human history. The Soviet Union lost more than 13% of its total national population. One of the Nazi wartime strategies was known as the Commissar Order, which sanctioned the shooting at sight of all known Soviet political officers. Soviet prisoners of war death rates were as high as 45% compared to the 3-5% part. The Order aimed at the breakdown of the political and tactical unity of the Eastern European Allied Forces and was reflective of the Nazis, seeing Communism as a major enemy. Many anti-fascist resistant friends across Europe were led by Communists with tactical and military support of the Soviets. One of the most important events in the whole war was the defeat of the German forces at the Battle of Stalingrad after a five-month conflict that led to the deaths of nearly 2 million. Other key moments, such as the Battle of Kursk in 1943 and the breaking of the 842-day long Siege of Leningrad in early 1944, saw the Soviets advancing and pushing the German forces out of their country. Around 70% of German military deaths were from fighting the Soviets alone. As far back as August 1942, the Soviets had requested the U.S. and the U.K. to open the Western Front, which could have greatly limited the extent of the Nazi rampage in the East. But the Western Front was only opened with the landings on Normandy in June 1944, more than a year after the Axis forces began to retreat. Many historians even believe that the Second Front was launched only out of the Western Allies sphere that the whole of Europe would fall under communist influence. The erasure of the role of the Soviet Union is not something new. From official celebrations such as D-Day to popular culture, World War II has often sought to be portrayed as a battle for freedom waged by the West against the Nazis. A key part of this has been the portrayal of the Normandy landings as a turning point in the war. The term D-Day speaks for itself. Thus it is that the annual D-Day celebrations have become the byword for marking the victory against Nazi Germany, whilst Stalingrad and the Great Patriotic War are forgotten. This year, the official account of the British royal family put out a tweet with the video of Queen Elizabeth greeting leaders of allies. One of these allies, however, was German Chancellor Angela Merkel. Meanwhile, Russian President Vladimir Putin was not even invited to the celebrations. The celebration of the Second World War has thus become more about pandering to current political realities and promoting the US narrative of itself being the reason for the defeat of the Nazis. Incidentally, most of the troops and carriers which took part in the D-Day operations were British and Canadian rather than American. Russia announced on June 6th this year that it would address the United Nations to declare the victory in World War II as a heritage of humanity while also making the monuments to those who fought against Nazis as part of a global memory. Clearly, it is time we get out of this hegemonic narrative and acknowledge the sacrifices of the men and women of the Soviet Union who fought valiantly to liberate the world from fascism.


Good day everybody and welcome to the webinar on educational mobile apps. My name is Aga Palalas. This webinar is to help you determine the key benefits and uses of mobile apps inside and outside the classroom to identify the main issues to be considered when selecting or designing mobile apps. What are mobile apps? Basically, they're software that is designed to run on smartphones, regular cell phones or any handheld devices. Most of them would have a rather narrow focus, which often turns out to be a positive aspect of these programs. Before we focus on the various benefits of mobile apps, let's have a quick look at the background information and the statistical numbers across the world. Let's start with app downloads globally. Yes, there is a plethora of apps out there for those who have the right technology to support those mobile applications and those who actually need to use apps. In the particular context they're starting learning in. According to Gartner, in 2012 approximately 57.33 billion free apps were downloaded onto mobile devices. And by 2017 the download figures for free mobile apps are projected to reach 253.91 billion. At the same time into 12 approximately 6.65 billion paid apps were downloaded via mobile devices. And by 2016 download figures for paid apps are projected to reach 13.49 billion. So we've been experiencing a rapid growth in the area of app development and usage, but not equally so in all parts of the world. Whereas in North America almost every undergraduate student reported to be using mobile devices in various aspects of his or her life, the numbers for Asia, for example, vary greatly. This slide illustrates the number of mobile apps regularly used in some selected Asian countries in 2012. Thus in 2012 in Korea and Singapore smartphone users had the largest number of regularly used apps. The numbers of mobile apps used in Asia are obviously greatly influenced by the proportion of smartphones versus future phones in the hands of users. And for example in India only about 10% of the phones were smartphones in 2012, while in Korea almost 70% of the handheld devices were smart. According to Jeffrey and Company by 2015 the majority of mobile phones used in Asia will be smartphones. So as smartphone ownership continues to increase, using apps to access the internet or social networking platforms is also on the rise, as is the usage of mobile apps. Games seem to be the most popular app category across the Asia Pacific region, with the exception of Indonesia where music and social networking apps are being favored. In reality mobile learning is gradually getting popular and most of its share in popularity is related to the affordability and accessibility of mobile phones. Now to better understand the context in some developing countries, let's take a closer look at India as an example. According to the latest statistics there are 51 million smartphone users in urban India today, an 89% increase from 2012, when there were just 27 million users. The biggest spike is in the youngest age group between 16 and 18 years of age, where the numbers have gone from 5% in 2012 to 22% of people using smartphones this year, a four fold increase. This growth is largely driven by the low cost smartphones that were introduced by both local and international players in India in 2013. As far as the apps, the five categories dominating in India include cricket, music, news, videos and games. Now Facebook, Google and WhatsApp lead in terms of the social network apps. Future phones with internet capabilities also help the apps and edu games ecosystem to grow. And future phones will continue to play a role, a very important role, as they continue to maintain a substantial market share. So when designing for developing countries we always have to keep in mind what type of devices are in the pockets of our learners. We can clearly notice the rise of app culture, but considering how many apps are available across the various mobile platforms, we might be surprised why they are not useful learning and teaching as often as, for example, other online learning tools. There is a number of reasons for that rather slow adoption of mobile educational apps, especially in formalized teaching. But at risk statement that one of the main reasons would be the fact that not too many of the apps available in the app stores today are designed by expert instructional designers aiming at any specific learning outcome. Another significant reason would be the fact that mobile apps are designed to be a personal tool, therefore it might prove to be a bit challenging for a teacher to select an appropriate app and incorporate it in curricular activities for the whole classroom. The good news is that there have been a variety of customized educational apps developed at various educational institutions and other organizations. Research reports that many have been successful, used not only for teaching and learning, but also for performance support, administrative functions and other learning supports. With mobile devices connected to the school system and to the learning management systems such as Blackboard, for example, students can use such custom-made in-house designed and developed apps to access learning materials, assessments to look at their grades, to access new projects, collaborate as well as find and read books at their convenience from any location. Now with quarter of a million educational apps waiting to be downloaded, there is a lot to choose from, but over 25% of the downloaded apps are opened only once, I guess they were opened only once because they turned out to be not exactly the tool that the user was looking for. So it's crucial that students are given opportunities to use appropriate tools for appropriate learning activities and learning outcomes. We have to look at if the learning takes place in the classroom, outside of the classroom, mix of both spaces, if it's formal or informal learning that we are trying to support with the app. Are we aiming at synchronous or asynchronous communication on anything in between? These are spectrums that are very important to consider when we are looking at selecting or designing the right apps. Also is this app meant for individual learning activities or are we aiming more at collaborative learning? And then let's consider the various degrees of transactional distance as well. There is a myriad of apps to choose from. There are quite a few categories that we can look at. These are not exclusive categories, there are many more, but the most valuable ones to our students are those that help them access resources. For example, an in-house built mobile library app, those that support coordination such as Twitter, communication using Facebook apps or simple SMS based apps, collaboration by access to social networking platforms and apps like Google apps for example, those that help students capture and integrate data starting with a very simple tool such as camera or voice recorder and very popular among students productivity apps such as calendars, organizers, campus maps, notifications, reminders and not to forget the built-in tools such as GPS, once again note takers, voice recorders and other various apps. They allow students to capture data, ad hoc, take notes and look up the information that they're looking for. All these are very convenient and students will definitely benefit from using these built-in custom-built apps. And what are the benefits of such mobile apps? Well, first of all, they are a gateway or even a shortcut into a selection of e-learning tools such as Blackbird, Twitter, Evernote or even Facebook. Then there are still long learning tools designed with a specific purpose in mind. They focus on one learning or training goal and often aim at supporting performance in a specific setting or organization often their customers to unique needs and environment. These apps become a dedicated space for the particular learner with a particular interest or learning goal activity. Then they offer improved flexibility and convenience. Easy accessibility allows the learner to get it at the exact moment when it is required. They can provide learning materials and educational content at the point of need with just a few clicks. It's designed for a specific platform and it is even more user-friendly and convenient than other e-learning, online learning tools. Also, apps offer user control over content, at least they should. They should be customizable to the user preferences and needs. Good educational apps also invite user input. They encourage interaction with the content and encouraging learners to create their own materials, their own content. Such apps can offer being personalized and they offer more relevant personalized learning, potentially leading to a higher engagement levels. Users might download a variety of apps, but ultimately they use only those that offer benefits and fun. For example, well-designed learning activities, quizzes and games. In addition, people reach for apps which offer convenience and shortcuts to information and to learning. When asked about what their favorite learning apps are, many of my students would mention apps which remind them of upcoming tests and assignments or apps that help them find the fastest way to the campus cafeteria, for example. People are motivated to engage when they can see an immediate benefit to using a particular tool or a particular app. App affordability would be another benefit of educational apps. Majority of apps in our app stores are available to users in a free version. If they're not, many good apps cost as low as 99 cents or $1.99 cents. This is not necessarily true if you decide to develop a customized app for your organization, though. At the college where I was teaching, we addressed that problem by engaging our own design and IT programming students. As part of their course curriculum, they designed and developed quite a few apps, but for example, as Coventry Hunt app orienting new students into the services and supports available at the college. As far as digital resources, schools may be able to reduce or even with time eliminate the use of heavy books, workbooks and notebooks. Offering savings and convenience for both the organization and the students. Once again, students at our college agreed that they would rather spend money on ebooks than the same textbooks in a print version. Gamification is a separate topic. It deserves in-depth discussion, but I'd like to signal here the importance of incorporating some of the principles of good game design into engaging applications for learning. Research reports substantial benefits to the usage of appropriate gamification elements in the design of educational apps. As long as a designer makes sure to focus the app on the learning objective, not for example on the character development or rich animation. For those that have access to the latest smartphone or tablet technologies, apps can offer a window into the latest mobile developments. App designers and mobile learning content providers often showcase the latest technological solutions which we can then apply to our own designs when the time is right. And finally, I should emphasize the significance of mobile apps in our everyday and formal learning. Considering the development of mobile apps and their design, we will increasingly reach for those tools in our pockets whenever we need to look up a piece of information and ask someone a quick question. Likewise, we will witness an increase in the number of apps, educational institutions and other organizations are going to integrate into the current blend of learning methods. But not all educational apps are designed with true educational purposes in mind. Educators, designers and other users should scrupulously evaluate mobile apps before incorporating them into their learning and teaching practice. Let's not forget that 25% of mobile apps are downloaded and never opened again. Mobile apps should be then assessed for both their overall usability and quality as well as their learning value. Are they the right solution in the cultural and physical context? Are they available and are they affordable for our learners? Currently, there are no common standards to assess educational apps. And although there are some very useful reviews available on the Internet, the reviewers are not able to keep up with the rapidly growing number of apps. So next, I'm going to share with you some criteria for educational app assessment based research into the issue, as well as my own experience as an educator and an app designer. These are the app assessment criteria that I propose. First, educational value and curriculum connection. Is there a learning goal? Does the app offer meaningful reinforcement and extension of learning activities and learning objectives that are part of your curriculum? Can it be seamlessly integrated into your learning setting? Does it fulfill a unique learner need that other tools would not meet equally well? Does it apply any teaching learning framework? Is there a focus on learning or maybe it's just playing a game? Is the content and information validated? Is it free of bias? Does it encourage creativity and reflection or in some other cases repetition or spaced learning? How about the levels of engagement and interactivity? Is it age appropriate? Are there opportunities to interact with peers, content and experts? Are there elements of communications worked into the app? Is there a nice variety of learning activities and an award system built in? Are the graphics appealing and do they enrich the learning content? As far as authenticity, are students engaged in real life learning problems that result in new knowledge or scale creation? Is feedback provided? Is it of sufficient quality and detail? Is the feedback informative and does it teach? Is it constructive and timely? Does it motivate? Are there elements of peer evaluation and self-evaluation incorporated as well? And in terms of user friendliness, is the app intuitive and easy to navigate? Does it provide any tutorials? Can learners use it independently? And can the app be customized and personalized through the settings in the app? Are the settings available that allow for individualized learning experience? And very important, does it monitor progress? Is it easy to use? And does it provide analytics on all the skills and learning objectives being practiced? A good educational app should frequently remind the learner of his or her progress toward the target learning goal. And are there any security and privacy issues with using these apps? These are only some of the questions, but these are the very important ones. There are quite a number of issues to be tackled when considering developing or selecting mobile apps, especially educational mobile apps. I've covered a few of them in this webinar, but other issues to consider would be should I purchase a development app for my organization? Would it be a native app or web-based app? Should I be coding it from scratch or using tools for app development, such as PhoneGap? Should it be HTML5? And quite a number of other considerations that I hope you're going to explore through your in-depth research of educational mobile apps. I hope I've encouraged you to look a little bit in more depth into all the various issues that are related to using mobile apps for teaching and learning.


Let's welcome our next speaker, Tobias, about, and this is Dolk. We've got five seconds, so three, two, one, go. So welcome everybody, I'm happy that so many people are interested in securing existing software, are not afraid of using form verification. Let's start. I think it's not the news for you that there's a long history of security vulnerabilities and still today's software contains many security critical bugs. Here you see a list of bugs which were found in communication protocols and for this talk I selected one vulnerability in FIS on which I want to show you how existing software can be made more secure and how form verification can be used in this case. So FIS is a TLS 1.3 implementation created by Facebook. It is written in C++ and has a focus of course on security. So Facebook used modern C++ methods to ensure that common errors like buff off loss does not happen. But nevertheless, a vulnerability was found. So an unauthenticated remote hacker was able to trigger an internet loop in an application which uses this TLS library. This maybe doesn't sound disservient but with little effort and little time an attacker could be spawned many processes which are spinning in an infinite loop and so you can keep in server with many cores in short time, keep very busy. Let's have a look at a code which was attackable. So this is a part of a parsing function where a while loop was used. In this while loop, a parsing function is called which reads in 16 bit integer from a network packet and this 16 bit integer is then stored in variable code length. To this length later on, static value is added. That's the size of the header. And after that, trim start is called on a buffer object which tells the buffer how many bytes were consumed. What this does is actually we read how long this package is and then skip over this package. After we have this done, then we continue at the start of the loop. What is assumption here? The developed things, of course, the length must be bigger than zero. If this is not the case, no bytes are consumed and so we get back to the beginning of the loop and have the same situation again. So we are stuck in infinite loop here. What does this mean for the value which we read from network package? Then we must have this assumption that the length must be less than two to the power of 16 minus five because the length of the static header is five. That's a very assumption if you look at very TLS record packages because there the length must be much lower than that. So TLS standard says it should be below two to the power of 14 plus 256. But the remote attacker must not obey this rule. So it was just able to send a length which has this special value, two to the power of 16 plus five and then we add five to it and so get an integer overflow and the length is zero and now we are stuck in infinite loop. So I would say the solution should be here that we check if the length is according to the standard. But Facebook sector is not a solution. They just use some bigger integer. So now we have no integer flow anymore and so it works fine even if the package is not standard conform. But how could we prevent such bugs? The usual answer is to keep a good software quality. So the code reviews, testing, fuzzing and so on but that all our measures which Facebook did and they didn't find a bug. So we need some more intense techniques like static code analysis and so this bug was also found. A company called XAML which is now acquired by GitHub used a tool which is called CodeQL which does a variant analysis. What the variant analysis does is it looks for patterns of known vulnerabilities and just search for this pattern in the code. If there's a pattern then we know that is this a known vulnerability. But there we have also the drawback of this. We can only look for patterns which are known to us. If there are any unknown vulnerabilities we cannot find them. So I would favor a more constructive approach and that would be for verification. Where we can really prove while designing the code that there is no unexpected behavior in the program. Doing this on existing applications which mainly you see or C++ this is not really possible as it has too many features. We can do it maybe for a limited set but not for all features which C++ give us. That's the reason that there are especially designed languages for formal education and Spark is one such language. Spark is programming language which is based on Aether. It's like Aether compilable with GCC and LVM and is also very very suited for embedded systems. So we have to customize it with one time and you can customize it in a way that you have only really a minimal one time and then you can also use it on a system with very resource constraints. What Spark also offers is contracts so you can add pre-conditions, post-conditions, invariance to your program and so define with a high detail which behavior a sub-program should have. This is also the basis of the verification tools. They check when you use these functions if all contracts are fulfilled at any time and they do this statically so before really compiling the code or running it. What you can achieve with the verification tools is that you can prove absence of runtime errors so there are no errors like buffer overflows, integer overflows and similar things or you can even show functional correctness so that it really achieves through your specification of your program. Aether and Spark is mainly used in safety critical areas but also in security. Let's have a practical look at Spark. Here I've implemented the attackable code part of this. It's really similar to what we have seen before. We declare a length variable of an integer and then read some 16-bit value from external source. Then we add five to the length like what it was done before and then we use this length variable later on. Spark is different to C++ in that we usually don't use integers which integers which are built in but we always define integer types for with the certain properties which we need in this case. So there are two different types of integers. We can define modular integers which behave like C++ or C integers so they just have in size and allow to overflow at any time. Or we can also use type range integers where we can specify the range which is allowed for this integer and where we also have the property that these integers are always not allowed to overflow. We also use such an integer type here for our length variable and what we get when we now use the verification tools on this code example where we see that the tools will tell us that a range check might fail in line 15. And they also tell us for which value of the length this integer overflow could happen. So we have really nice functionality with Spark to finding such errors but the reality is so that currently usually software is written in unsafe languages like C and C++. Now we can think of using Spark instead of C and C++ but creating existing software to this language just is very expensive especially when we have done it, if you do it manually. But what could we do now? We could think of two options. Maybe we could only replace critical parts of the software. Usually the most critical parts of software is other parts which interact with the outside world. So often these are the communication protocol implementations and if you replace these parts with a verified implementation we already enhance the security. Another option is to use code generation. So do not all implementations manually but using specification and generate code for it. This is what we have done with Record Flux. So Record Flux is a toolset which is developed by Component Lead. This work is also supported by Thio Tristan and it comprises various things. One thing is that it has a specification language where it's possible to specify format of messages in a formal way. And this format specification of messages can then be verified and checked if there are any inconsistencies in it. If there are no inconsistencies we can then later on use the specification to generate parsers and message generators out of it. All code which is generated by Record Flux is Spark code and so we can check or we can automatically improve that there are no runtime errors in the code. Another feature which Spark gives us is that we can statically ensure that only valid messages are accepted and that only valid messages can then also processed. And in the same way it's also ensured that we only can generate valid messages. The source code of Record Flux is available on GitHub. There you will also find some documentation. If you're interested more on the theoretical side of Record Flux you can also have a look in our research paper. So now we have all building plugs to improve the security of existing application. We use as example FISC of course and we replaced the existing parser by a verified parser which we generated with Record Flux. Therefore we had to create a specification of all messages which are specified in TS 1.3 and then use the specification to generate the parser out of it. We have to remove the existing C++ parser of FIS and then integrate our verified parser into it. For a code which we have written and all code which we have generated with Record Flux we are able to prove that there are no runtime errors in it. The code of this proof of concept can be also found on GitHub. Here you see an excerpt of the message specification. In particular you see the specification of a TS record message. Just to give you a high overview what the specification does is on the left side we specify some elementary types like enumerations and integers. And on the right side you see the specification of a TS record message where we specify the message format. Such a TS record message is not that complicated. You have a tag which is the content type. You have a version field, you have the length and you have a payload field. What makes it a bit more complicated is that we here now differentiate if you have a plain text payload or an encrypted payload. When we now check the specification we will see that there's an error in it. There's an inconsistency. As we have two conditions which check if the tag is not equal to application data. And as we have these in two branches there's only two possibilities for encrypted and plain text payload. It's not clear for the parser which path it should take when it parses this message. So the residing parser would not be deterministic in this case. So we have to remove this inconsistency and if we do that and check it again we will see that the truth set us now the specification is correct. And now we can also use the specification to generate code out of it. Now we have created the verified parser and we have to think about how could be integrated as this parser now interface. As Spark and C++ is not compatible with regard to the data structures which they use we have to add some clue code in between. So here you see a Spark function which takes in buffer as input. So it's just a pointer in binary and which gives us results in a record which contains all information of the message which we have extracted. So record in Spark is similar to a struct in C or C++. All functions or types which are highlighted in green here functions which were generated by record flux. So what is done here? The first thing is that we declare a context. A context stores the internal state of our parser for this particular message. As next step, we initialize the result. So we set some default values which we want to have as in our result structure. And then we initialize our context. So in this initialization, we add a pointer to our context and then this pointer is stored inside the context and we can do the things which we want to do during parsing. So the actual parsing is then done by calling verify message. What verify message does is that it checks field by field if this field is valid so that all conditions which we have specified in our specifications are fulfilled and then the result is stored in the context. Later on we have different functions which we can use to use this information in the context. So what is done here is we check if the length field is valid, if this is the case, we are allowed to also access the value which is done for example here with the getLength function. The nice thing of using Spark in this case is that we can prove that the parser is used correctly. So if you would forget to check that the length field is valid but just try to access the value in the length field, then we would see in our Spark tools that the pre-condition of the getLength function is not fulfilled as we did not check valid before. And so we really see if the parser is used correctly and we do not any things or anything which is not supported or which could lead to some error at the end. We need until there to integrate the parsed interface. We, as I already told, this Spark data structures and C++ data structures are compatible but Spark offers an foreign function interface. So we can specify in record and say that it should have convention C and so it has the same binary layout as in struct. So you see an example here for our record and on the left side and on the right side is C struct. And the same is also done for functions. So we have 50 parsed record message where we also define it should we have convention C and we also define the name and on the right side you see this C counterpart. The next thing is then that we have to integrate to parser into the actual Fisk code. Therefore we have also to think about the buffer object. So as I already told in the beginning, Fisk or Facebook used for implementing Fisk some data structures which prevent buffer overflows and this buffer object also offers other features like scatter getters. And so we need to convert this structure into something that we can use on the Spark side. Actually what we need is one pointer to invite array but what we have here is a list of pointers to various buffers. So what is done here on the first lines is that we allocate enough space and then copy all buffers into one contiguous buffer and then take a C pointer out of it. This C pointer can then be used for our parse function. We also have to allocate some memory for the result and then we are able to call the parsed record message function. Then you see we have to move some code this red lines as the code which I've seen before. So this is actually parser which was used for reading the length and we now can just use the result which we got from our parse function and we're added in this case. So we've seen it, it starts functions that we just add to the plain text header size the record length and this is now secure because we check if the length is according to the standard and in standard the value of the length field is much below the 16 bit integer maybe after overflow before. What I forgot here, we also added in between and check if the record which we got from our parsing function is correct. So then we see, we check if it's valid ciphertext because we expect here in Taylor's record with ciphertext in the payload and if it's not a valid Taylor's record message then we throw an exception and terminate the Taylor S connection in this case. We also looked at the performance which we got from our modified FIS. Therefore we created a small HTTP server which just returns a static page and this static HTTP server then used FIS for the Taylor S connections. On the client side we use WRK which sends a continuous stream of HTTP requests and measures the latency and the throughput. We measured the handshake layer and the record layer separately for the handshake layer we just opened a Taylor S handshake for each HTTP request and on the record layer we only opened one Taylor S handshake and then send a continuous stream of HTTP requests over this Taylor S connection. What we saw is that this impact is really small so it's around 1% or 3%. And we also analyzed where this performance effect came from and so that's not the method path which we generate but it's mainly the conversions functions to convert the data structure of C++ to Spark. We only have seen a really simple Taylor S record message but there are more complicated Taylor S messages of course where you have sequences of messages which again can have sequences into it and these are represented in FIS with C++ vectors and objects and they of course are not compatible to Spark. So we need to do some conversion and that uses some performance at the end. So now we have seen it's possible to secure an existing application within formally verified library but we want to even go one step further in the future. We are currently working on Queen Taylor S which is a component based higher assurance implementation of Taylor S 1.3 where we want to implement all critical components in Spark and all these critical components should be also specified with the specification language of record flux and then generated out of it. The current status that we worked mainly on record flux because it's the main building block, we specified all messages of Taylor S 1.3 and we are currently working on designing the architecture and the protocol specification. The implementation of Queen Taylor S will be also available as open source on GitHub. Coming to a conclusion, what we did is creating a formally verified library in this case a parser for Taylor S 1.3. We integrated this verified library into an existing software FIS and we have seen that there are some obstacles so we saw that it's cumbersome to convert these Spark and C plus plus status structures but it is possible at the end. And we have also seen without doing any optimization that the performance impact is really small. So you can conclude that it's really possible to use formal verification to secure an existing software. That's it, so if you have any questions, I'm happy to.