Hello, and welcome to From On-Prem to the Cloud session. My name is Seri, and I will be presenting during the next 45 minutes. What this session is all about. In this session, I'm going to show you how you may get access to the Cloud AD, Microsoft Cloud AD, when you have some sort of access, some level of access on-premises. So that's going to be the path from On-Prem AD to the Cloud AD. And this session will be based on live demo, so you will not see a lot of slides here. Most of the time, I'm going to show you how to do it live. Before I start to show you this, let me say a few words about myself. My name is Sergi, once again. I'm a pentastor instructor conference, because I speak at different conferences like conferences from Microsoft, Headquarter, Global Azure, Security B sites, Wild West Hack and Fast, Here and Adversary Village, and so on. And if you want to contact me after this session, you want to ask me something, or you want to see what other sessions I have, and you want to watch them, here's the LinkedIn. Usually, I announce my other talks. I have a number of certifications and awards. You can see some of them listed. But I hope that's not your goal to listen about me and the whole session. And so let me jump to agenda and let's start our content. All right, so what we're going to cover here. In this session, I'm going to show you first, what is Azure AD Connect and how it may be compromised. So that's a classic way to integrate on-prem AD to the cloud, Azure AD Connect, and how it may be compromised, what may be the bad configuration. Then I'm going to show you a new offering from Microsoft, which is Azure AD Connect Cloud Sync. And we will see how that may be compromised as well. Then we will bypass MFA and authentication prompt and start to enumerate the cloud. But for enumeration, I must also bypass MZ or MSI. And finally, we're going to quickly talk, what should we do to mitigate those problems? All right, as I mentioned before, this session will be based on live demos. So I'm going to switch to demo and let's get started. So first, I want to show you what Azure AD Connect is, just in case if you haven't worked with that before. So Azure AD Connect, that's the tool from Microsoft, free tool, of course. And this tool may be used to synchronize your on-premise AD to the cloud AD. And when you can configure this tool, one of the things that you must do, you must connect to your on-prem AD here. So you will type enterprise admin user name and password. And AD Connect will create an account that will be used for synchronization. So let me show you this because I already have that configured. If I go to the main controller and go to users, so here is an account, msol underscore something, something. And that just the regular user, if I go to member of, just the main user, so nothing special with this account. But that account may have number of permissions, extra permissions if you enable some features. One of the features that we just very popular called password hash sync. If you turn this feature on, account for synchronization, let's this ADDS connector account, will have extra permission. It will have permission to replicate Active Directory. So those permissions, replicate directory changes and replicate directory changes all. Now, let me show you where they are. So in my AD Connect, I enable password hash sync. And by the way, it's very recommended option. So most companies, they enable password hash sync. So passwords, password hash, of course, synchronized from on-prem to the cloud as well. We use that for resiliency. And so that's enabled for many companies. If I go to properties of my domain, go to security, and find this MSL. So here are those permissions. They are delegated. So that's just a normal, typical configuration of AD Connect. Now, where we may have the problem? The problem is if someone can own this account, an attacker, if he or she owns that account, will have those permissions. And those permissions are quite high. So let me show you how I can own this account first, and then what I can do with those privileges. This account, we don't know the password of this account, so we must find the password first. Let me jump back to AD Connect. Let me show you how we can get that password. Let me cancel that. So to get the password, this password is stored in AD Connect database. If I open this table, Management Agent. And let me remove those columns I don't need. And let me just keep a few of them and run that. Now, if I look for credentials, look at this. So it says username is here. MSL underscore something something. And password also here, but password is encrypted. Not that simple, so you will not be able to just take password in a plain text. All right, but there's another way how can we get password? We must decrypt that. To decrypt password, what we must do, we must become the main, no, sorry, not main, we must become local administrator on this AD Connect server. So AD Connect administrator can decrypt this password. Decryption process is quite tedious if you do it manually, but luckily we have people, we have good researchers, and they give us tools and one of the tools called AD Connect Dump. So if you just run AD Connect Dump, look at this. I have a password from this SQL database and decrypt it. So by the way, so you may find this tool on GitHub and you may also find the article from author of this tool and he explains how to do all of this manually if you want to do it manually. But manual process will take a while, so I will not be able to fit into my session. All right, let me copy this password. And now I can do some, now I have now an old user. And now what I can do with this credentials, let me open first command prompt on the different machine. At the same time, I'm going to run this different user. Let's type MSIL user and click okay. It will take some time before command prompt will appear. So let me first check who am I here. I'm a user JDo, let's take a look if I have permissions to enumerate a C drive for the main controller. No, access denied, so I'm just a regular, maybe I'm a local admin, but I'm not the administrator on the main controller, so I don't have the main admin permissions. All right, let's try something else. Let's type who am I here. And this user, this command prompt from MSIL user, let's try to enumerate the main controller as well. Access denied again. So no luck. But we don't really need that at this moment because now we have permission to replicate directory changes. With this permission, I can synchronize, I can replicate information and password hashes of any user in the company, in this network, in this domain. So let me go to see tools. Oh, Mimicats. And let me run where we'll known tool called Mimicats. Now, in Mimicats, what I want to do, I want to say DC, LSA dump DC sync, and I want to synchronize information about trainer, and trainer he is, he or she is the main administrator. So let's see that. Now I can see hash, password hash of this user. Now let's go to... Let's open Mimicats again. Let's run Mimicats here. And let's say, privileged debug. And I will run command, which is very well known, called pass the hash. I will copy this NTLM and base here. And now I have another command prompt. Let's try to DRDC. Fingers crossed. Yay! Now I have access to the main controller. That means I became the main administrator. So when we have... When we have AD connect, when we have AD connect, and password hash sync is enabled, which is quite common, what may happen, this account for ADDS account will have quite a lot of permissions. And so you must be very careful when you delegate permissions, who is AD connect administrator? So please be careful with AD connect administrators. Don't provide these permissions to middle level administrators because they can become the main admins quite easily. All right, so that's the first thing. That's a classic configuration. AD connect, when we install the whole server inside of our network, and so we can compromise like this. There are some other ways how can we achieve this result, because if you Google a lot, you will find some other ways, if you have like a pass-through authentication and some other ways to authenticate and AD connect, how they may also be compromised. So I'm not going to show you all of those ways to compromise AD connect. Just check this one and make sure only the main administrators can manage AD connect. All right, so we discussed the AD connect, how it may be used to synchronize accounts and the more important how we can compromise that and what misconfigurations, what should you not do. Let's take a look on another option, which is Azure AD cloud sync, Azure AD connect cloud sync. Cloud sync, that's when we don't have the full engine on-premises, so we don't install the full server. The actual engine will be in the cloud. But on-prem, we just going to install agent. So let's take a look here. Here, lightweight agent installation mode. So we just install agent on-premises. So that misconfiguration, it doesn't support all the features of AD connect, so nowadays, not that popular, but I guess because that's the new offering from Microsoft, it will have more and more features later on. So what if you decide to switch to cloud sync? How it will look like? Let me just go to the cloud. And if I go to Azure AD, so here we can, in Azure Active Directory, we can find Azure AD connect blade. And under that, there's a managed Azure AD cloud sync. Click here. And so what I must do first, I must download agent and install to one of the servers. If I switch to that server, look at this. So I have a server where I have this AD connect installed. And how can you find this AD connect presence if you go to services, find Microsoft AD connect provision agent. So this agent is installed. And so what you can do here, by the way, don't worry about degradation. It's because my demo environment was turned off for a long time. So if I go to configuration, here in the cloud, I can configure my sync. Also, by the way, I can synchronize password hashes as well. And if we synchronize password hashes, so we may face the same issue that the passwords may be replicated by the account. But the problem here with this cloud sync, not the problem that's like a difference between AD connect and cloud sync. In case of cloud sync, we don't have server. We don't have like user account. We don't have SQL database where this account is stored. So that's a bit different. Let's take a look how it will be configured in case of AD connect cloud sync. If I click on the agent, I can find that the agent is working on behalf of a group managed service account, or GMSA. And so in case of GMSA, there's no password which is stored locally. So that's the account in Active Directory on Productive Directory. And some sort of servers may retrieve password of this account from AD. Let me show you this. If I go to the main controller, here is a group managed service account. Nothing here. If I go to properties. So if you go to attribute editor, you may find here like information about password, password ID, password interval, because this password will be changed by the service account. All right. So now I can see that this account is not typical. But how we can take this account over? Let me go back to my server. I'm going to open PowerShell Let me type one command. Let me just type this. Now it says that this account, there's a principle that allow to retrieve managed password and this principle is agent. So the name of this principle is agent. Let's take a look who, a hostname, not who am I, hostname. And I can see the agent. That's the current server. So if I'm an administrator on this server, which is agent server, I can achieve literally the same. So let me show you a few ways how can we do it. So first way, I can open command prompt, but let me do it as an administrator because I must be a local administrator. I'm going to go to see tools. And here I'm going to run psexec. And in my psexec, I'm going to open cmd as this agent account. I don't need to know any passwords because this specific server may retrieve this password from AD. All right. Now if I open mimicats and run this lsa.dc sync, yes, I was able to replicate information about hashes. All right. That's the most simple way to do it. If you can just locally run that and execute mimicats on this machine. But maybe that's not the case. Maybe you cannot run mimicats here. And we need to do it in a different manner. So let me clear the screen. I also need command prompt as an administrator. And let me open PowerShell as local system. So let's say who am I? I'm local system. So we know that agent can retrieve password. So if I become the machine local system, it means I'm an agent now. I'm a local machine. And so I can try to retrieve password from Active Directory. Let me do it like this. Not the password itself, by the way. It will be hash. And so now I extract password hash. What can I do next? Yes, pass the hash. And so that account will allow me to run elevated permissions. How to do pass the hash here, it is before I don't think I need to show it to you again. All right. So that's two ways how we can extract credentials. And with those credentials, we can get access to the main administrator permissions. But you may say, wait a second, this session is called from on-prem to the cloud. And yes, you use something cloud-based like AD Connect, but you did not show us how to become a cloud administrator. You just showed how to become local admin, I mean the main admin based on the AD Connect installation or AD Connect cloud sync, but not how to elevate in the cloud. Yes, let me show you this. So if you are the main administrator, that means that you can connect to literally any workstation or server in your network, right? Probably yes. So, and let me jump to demo again. Let me show you one interesting thing. When you have your cloud environment, you probably have IT professionals, developers, and they use their tool called AZ CLI. Let me just type it. Let's say AZ account list. And let's output as a table. And look at this. So it shows me my subscriptions. All right. Now let's do the same on the different machine. Let me open CMD. And let me just, let me even copy and paste. Copy and paste. Fingers crossed it should fail. Please fail. Yeah. So it says you must log in to Azure first. But why, when I opened CMD from here, it didn't tell me anything. It just executed the command. The reason is I already logged in here and the token was cached. And token will be cached here. If you go to your user profile, there's a folder called that azure. Subfolder called that azure. So if you go there, if you take all of those files, you may take only a few of them, but let me take all of them except config. And let's say I want to add that to archive. Let's keep seven zip. That's fine. And so here is seven zip archive. Let me copy this to this workstation. Extract that. Fingers crossed. Come on. Come on. Yeah. So now I can see list of subscriptions. Did I have any MFA prompts? No. Any password prompts? No. But this account has MFA enabled and of course it has password. But because we use cached token, we don't need to present all of this. We can just steal token, import that to the different machine, like just copy and paste and you're all set. And you are in the cloud. And so now it depends on my permissions. I can do something. So let's try to do something. Let's say I want to create new user, which is called... I will call this user azurehound. Let's create that. And the password will be quite strong. Don't worry. I'm going to remove this user later on. So you will not be able to use this user. And also let me assign permissions. Reader. All right. So now I have user with reader permissions on the subscription level. So what I can do with this user, I want to enumerate subscription and I will use quite well-known tool called azurehound. So have you heard about this? Azure... Azure... Azure Hound. So you probably heard about Bloodhound, which is like, you know, from premises. Azure Hound, that's the cloud version of Bloodhound. All right. So what I can do with this Azure Hound? I can enumerate. This time I can enumerate Azure. In the same manner I did that in Premiere D with Bloodhound, I can do this, I can do something similar in case of Azure Hound. Let me show you this pretty quickly. I'm going to... find my Azure Hound locally. Let me copy this. And let me... Let me paste that to desktop. Oh, I even have a folder here. Oh, it's already there. So Azure Hound is easier. Now, what I want to do, I want to navigate to it. And let's say import. Import module. Azure Hound. Come on. Azure Hound. And look at this. It says that was blocked by your empty virus software. So I want to enumerate, but I cannot do it because something, some empty virus doesn't allow me to do it. So what is that? That's called AMSI or MZ shortly. And so it's trying to test the PowerShell commands and PowerShell modules. I'm trying to run from PowerShell, or not only PowerShell, by the way, but it's time PowerShell. So what I'm going to do now, I want to bypass MZ. How can we do it? I want to give you all the details about that because that's not a goal of the session. But let me try to show it to you really quickly. So I'm going to open PowerShell. Open PowerShell. And let me run a tool called Frida Trace. And what I need to do, I must tell to Frida process ID of my PowerShell window. So it's 400. Nice. Let's say 400. All right. Now, if I type command like getService that was that was fine. And here I can see output from MZ, let me mean MSI output. And every time I can see this MSI context. So what this context is all about, let me copy this. And this time I want to open WinDebug, debugger. All right. I'm going to attach PowerShell. And so let me just DC into this address. And look at this. So it says here I can see something with title MSI, like header header, MSI header. So if I remove this header MSI will stop the work. How can we remove this header? Let me detail like that. How can I remove this header? I can do 3D debugger or I can even do it from PowerShell. Let me just type something like this. And now if I try to do something like invoke Mimicats, Mimicats it will fail because I don't have this module. But antivirus will not block it. Yeah, antivirus did not block it. All right, let me try to use this bypass. Here. And let's try to import that again. Yeah, that's working. That's working. And so now I just need to run something like invoke Azure Hound. But to do it, I must first connect to Azure AD. So let me say connect Azure AD, Azure Hound and password. So let's keep that first. Now, what I can do, I can say invoke Azure Hound and now it will start to collect information from my Azure AD. From Azure in general, including Azure AD. Of course, it depends on my permissions, but because I delegate permissions to read everything, so it may collect a lot of information. And so the output will be soon here in this folder. So for the second time, let me jump to my Bloodhound GUI. I already pre-create the Azure Hound file. So let me just say upload data. And here is Azure Hound collection. And now statistics here is not very nice if I just close that and run it again. Let's see. Yay, we have, look at this az applications, az devices, az groups, users, tenant, subscriptions. So we learn a lot. Unfortunately, or maybe fortunately we don't have pre-built queries for Azure. So we must run our custom queries. We must run our custom query. So let me run a custom query. Oh, damn it. Let me just first copy here, paste here. And now I can see like accounts I have in my environment and those accounts. And you may say, wait a second, why the hell is that? Because quite hard to understand. Yes, unfortunately currently that is not super friendly, but at least I can build a graph in a similar manner, like Blahound. There's a very nice article you may find here. Azure Hound Cypher Chit-Chit. And here's a number of those queries that I will try to and it will return some data that you want. All right. All right. I hope that that demo convinced you a lot to that you should protect your AT Connect server or if you prefer to use Cloud Sync, you must protect Agent and you should not provide permissions, even to level administrators to manage those servers because they may easily escalate to the main administrators and from the main administrators to cloud administrators. There's a number of ways to achieve that. If you are a cloud administrator using Intune, you may become the main administrator. So when you have Hybrid AD, you must protect both environments pretty well because from one environment you may get access to another and vice versa. So, the last slide here and it will be slide. So what you can do to protect your environment better.  So it means that you should not allow regular administrators management, AD Connect management. Do not allow administrator, server administrator to manage Agent or AD Connect server because they may become the main admins quite easily. So, please use principle of these privileges. Also, by the way, if you use Azure AD Connect Cloud Sync, it may be considered more secure because configuration may be done in the cloud on premise you have only Agent, but keep in mind, you should not allow access to this server, add an access to this server to middle level administrators. When we're talking about credentials, when I can steal credentials, here, good idea will be use previous access workstation and run administration and administrator or run development from the separate workstation, which is not part of those, your infrastructure. So it will have multiple layers of protection. MZ Bypass Here you may audit partial commands and also use PowerShell constraint language. Of course, it's possible to bypass this language as well, but the more you have, the better the more secure you are. And enumeration with Azure Hound in this case, principle of these privileges, that's the best thing you can do because to enumerate, to get information from Azure AD, you must run that command with some sort of permissions. So if you don't have those permissions you will not be able to run it. All right. So that is about mitigations. So whatever, please keep in mind the configuration ADConnect or even ADConnect nowadays, that's quite typical. Quite typical and password hashing also enabled. So make sure you will not become the victim even your users inside the company they may do something like this. Maybe they are not malicious, maybe they are not going to steal data from the company, but at least maybe they want to have more permissions, like middle level admin want to have just in case to have domain admin permissions as well. So make sure that you control access to ADConnect server or maybe cloud sync if you going to use that in the future. Make sure you connect, you configure permissions correctly. All right. So I hope that session was informative and if you have any questions, it's time to ask those questions. Of course you may ask questions during this session as well but now because I'm finishing go ahead and ask them now if you have. If not thank you anyway and the best thing I can recommend you is to check your own environment and make sure you don't have those not the best, not the most optimal configurations. All right. Thank you very much. Bye-bye. Enjoy the conference.


Okay, so hello everyone. I guess we should start now. My name is Piotr Żarowski. I'm from Poland. And this talk, the main purpose of this talk is to convince you that there's a tool that can make it a lot easier to initialize the packaging work of Python libraries. So you don't have to do everything from scratch. This thing will speed up a lot when you want to create a new package completely new one. So PyPI or Python Package Index is a repository of software written in Python, mainly libraries but also applications. And PyPI to Dev was created during DevConf in Hyderabad and it was meant to be a wrapper around SDDev. SDDev is a tool that converts Python packages into Debian packages and it does it really well. If you don't know it, even though it's not developed anymore, I still encourage you to test it. Mainly to use the PyPI install script which will install Python package as a Debian package. So it does what PyPI to Dev does but PyPI to Dev, I wrote PyPI to Dev because I wanted to focus more about converting the whole repository. So in the end I provided also the PyPI to DSP script which does many things that SDDev does but I couldn't extend SDDev that much so I decided to write something new. And PyPI to PyPI to Debian is something that will convert the whole repository. So PyPI to DSP, DSP stands for Debian source package, will create a single one and PyPI to Debian will try to convert a whole repository or a subset of PyPI repository. And the main features of this project is it uses PyPI metadata so all the homepage, outer, description and classifiers not only to get a list of projects but also while converting them into Debian packages. The ones that are not data that is not available in the tarot and it supports all the main interpreters we use in Debian so we'll see Python 2, 3 and PyPI. When it detects Sphinx documentation it will create a new binary package with regenerated documentation. It integrates well with Debian tools with DH Python, I reuse a lot of stuff from Python Debian library. For example if given packages already in Debian it will reuse the name, it guesses build dependencies in the sort of generates build depends field using names from Debian or if given library is not available in Debian it will guess the name which applies to our policy So it generates for example it also generates ATP email so something that Debian developers will be interested in. It doesn't send it so you can review the email and polish it a bit before sending. It's easy to customize, I will talk a bit more about it later. And for Debian Python modules team, something that team members may be interested, it integrates really well. For example initialize the Git DPM repository, it sets all the VCS browser source fields, maintainer and so on. And it even suggests commands how to create a repository on the alley of how to push which branches and so on, two lines that handles everything. So Debian Python module team members may be interested in this tool and so how to use it. The first one, first script that converts a single library, our application that is mainly written in the mind of converting libraries. You can just invoke the script name and library name, it will download the tarbal or the zip file, if it's a zip archive it will recompress it, repack it, so that into a format accepted in Debian into a tarbal it will fetch all the metadata from PyPI and devianize it and create Debian source package. If you want it can build a binary package as well, but you have to add another command. If you already have a tarbal, you can point it to Py2DSP and it will handle the tarbal without fetching the data from PyPI. If you already started packaging and you have sources unpacked, even if there are partial Debian directory present, Py2DSP can take and create everything that's missing. The last example is for Debian Python module team members. The profile option is one of the possible customizations. It will set quite some options in order to produce source package that is in align to our team policy requirements. It will also, for example, create all this git dbm initialization and configuration. The second script PyPI to Debian will try to convert PyPI or any other repository compatible with PyPI into Debian repository. It will convert only fetch all this of projects and convert all of them into Debian source packages. If you want to compile and build them as well, you can point PyPI to Debian into the tool you use to build packages. For example, as build, you can, if you point as build to unstable distribution, it will build all the packages for unstable. If you have a stable chroot or ubuntu or any other Debian derivative, it will build packages for this derivative. If you want to, for example, if you don't want to convert the whole PyPI repository, you can use filters like classifiers here. You can use multiple classifiers. This example will use only packages that are compatible with linux, but you can specify more. If you want to use those who work with editors, you can just pick the right classifiers and fit PyPI to Debian with it. The Python 3 option here will create only Python 3 binary packages. Killed by default, both pools will create a binary package for each interpreter that upstream outer claims given library works with. If it has a classifier that says this package works with Python 2 or PyPI, it will create binary packages for all these interpreters, but if you want to limit it only to Python 3, you can do that with the option as seen in the example. There are multiple ways to customize it. There are profiles, like in the example for Debian Python teams. It's really easy to create new ones. I created one for DPMT, one for Python applications packaging team, and one for OpenStack team, but it's probably older already because I created it like two years ago and the policy probably changed. Another mechanism is overrides. By default, both tools will search in current directory in the sub directory named as the same as the source package name, and you can use that or set PyPI to the overrides path environment variable, where you keep all the overrides. Overrides is meant for overriding settings or options for one package only. If you want to change something for all of them, you can customize team plates. Team plates of Debian control file, Debian rules files, or ITP email, if you want to have a different one, then you can just pick the team plates I created and modify them, and put them in different directory, and the Jinja team plate is used to render them, so Jinja is quite powerful team plate engine, so you can give statements and so on, to modify it and to customize it. Another way to customize it are hooks. There are currently two hooks, pre and post. Pre is invoked before Debian directory is created, so the sources are already unpacked, and the second hook post is invoked once the Debianization is already there, so both are just simple scripts, so if in overrides or in team plates in directory there is a hooks.pre or hooks.post file which is executable, then it will be invoked, and I use it for example to set up a GitDPM repository. If you have a completely different, want to use completely different source repository, like a private company repository compatible with PyPI that you use to keep libraries in your company, then you can point PyPI to that using these two variables, PyPI JSON URL and PyPI XML RPC URL, and PyPI to that will use it instead of official PyPI, so in both overrides, profiles or in team plates, in directories you can put just static files like Git build package configuration or Debian copyright file if it's static, if you don't need it to be changed, if it's the same for all libraries, you can use TPL files or team plates in GINJA, so if you for example know that this tool doesn't detect correctly upstream outer or you want to hard code the upstream outer to some string, you can either use the sticks, context JSON file and put all the values from these fields like outer, build the bands, if not all are detected, you can change the description, home page and so on, there are quite a lot of them, so you can do that either in context JSON file, if you are upstream outer and you want to help PyPI to DSP or PyPI to Debian, you can use setup configs Py to DSP section, it will read all the options from there or you can hard code them in TPL files and pre and post codes are simple shell scripts which get as options when invoked they get package name and version and if you need more the city context JSON files are created as well in the build directory, so you can read them from scripts and use all the detected values from there and if you don't like GINJA, I want to use your own team plate engine or for whatever reason you can just use the detection mechanism and invoke everything else from the script and that's the first part, I will make, we probably don't have time, but I will try at least show you a few examples, but in the meantime if you have any questions please ask, is that big enough? so as you can see there is an ITP email team plate, if the upstream outer add change logs into package description, so why DSP is clever enough to recognize that and remove it and a few more hacks I added to polish it a bit, but it probably needs more work, but anyway the ITP email looks complete, there is a description, there are binary package names and all the fields from ITP email there are examples of detected, so it's the right package, interesting, I will just show you control files, so as you can see detected Python 2 and Python 3 interpreter and there is a separate binary package, upstream outer probably didn't mention PyPI, that's why it didn't create one, but let's try to build it and in the meantime are there any questions? There is an address, the Python binary package has the same name, you can apt install PyPI to that and try it yourself, thanks


I have nieces, I have nephews, I have a son. And even though I feel that I shouldn't have to worry about my son because he's college educated, he's graduated, he has a good job, but he's a black man. And if he gets pulled over, they don't ask about any of that. So just think about that when you wanna judge why these young men are dying because the news has told you that he sold drugs. He had a gun, he was a criminal. You don't know that for sure. You're just going by what the media demeans these young men and make them look like they're criminals and make them look like they did something wrong when they didn't. I'm just asking y'all just to keep my family in prayer. My sister suffers every day because that was her only son. And just think and just lay down when you look at your family that it could be yours. You could be in the same position that we're in. So before you judge, think about that. If you have kids, think about that because that can happen. I have two grandsons, I'm scared to death. They're only five, but I'm scared to death for them to become teenagers. In this world that we live in today, whether police could do anything they want and they already know.  They will never be held accountable for what they do to the citizens. We're living in the, we're living in the, this is Klu Klux Klan all over again. They're lynching people all over this country again. We're a different generation. My son is 25, he said, they're the angry generation. We cannot allow this to keep going on and on in the future. They're exterminating us. And if you don't think so, just read. That's what I do. I read and I researched. That's how I've learned so much about what's going on. And no, I can't say that I thought about this when Marquise was alive because I did, my heart went out to these people, but until it hit my front door, I never thought. So I learned a lot and we're being lynched every day, every day. This year from January to this month, there is 769 murders by police in this country of today. Police are being held accountable. This contract is brewed out. It's destroyed out. It's brewed out.


On October 20th 2019, one year ago from today, a tornado ripped through the northwest, north part of Dallas and into Richardson and Garland. Many of us remember that day a cowboy game was showing on TV. Nothing was said about that, but our Twitter feed started exploding, text messages started happening, and we realized we had a disaster unseen before in Dallas, at least for some time. We realized there was so much damage, but we didn't know where it all was. We didn't know if our churches were destroyed, we didn't know if clergy housing was destroyed, or how many of our church members without places to stay. We didn't know if anyone had been killed because of the tornado. Thankfully, no one was. What we did know as we began to survey the damage, people from all over that part of the county, is that our churches began to respond dramatically. It is amazing over the next few days, several weeks, what occurred. We still see the remnants of that tornado and destruction that you can drive along its path and still see in different kinds of neighborhoods all over North Dallas. It's a reminder to us that we still are not finished, but on that day and afterwards, what happened was, is the people called United Methods did what they do best, and that is we served our communities. It was amazing to see how people from different churches and backgrounds came together to feed thousands of people, to begin the cleanup, to begin seeing how it is that we could help. And I'm still remembering some of those occasions and being present with people about the response that you made as United Methods in North Texas. Gratefully, we've not had a tornado since then. But who would have known that just a few months later, we would be where we are even today with a pandemic and COVID-19, and still not sure about the safety of people who live in our own county. But think about it, from October 20th a year ago till today and into the future, churches around the North Texas Conference are still responding to human needs. And I'm grateful for that. I want to tell you what a great job you have done and you continue to do. No one could have seen what has happened over the last year the tornado and then the pandemic. And there are ways in which people begin to think, how does the church really serve? I'll tell you how you serve. Whenever there is a human need, regardless if that person is a member of your church or a member of the Christian faith, you respond. Whether it was serving meals to people who had no place to stay after the tornado or helping do recovery, whether it was serving meals even during the pandemic or ways in which you responded so many ways, what I've learned is this. No, I already knew it. It just was reaffirmed by you, that you are the church and it's something of which I'm very proud but most importantly, I'm deeply grateful for is the United Methodist of North Texas. They are the church. Whether they're in the building or out of a building because whenever there's a crisis or a human need, you respond as God's healing agents in the world. And really, what is it that the Christ came to do? He came to be a healing of all that was wrong in the world. Thank you for being in the hands and the feet of the Christ and may God continue to bless you.


Our speaker is Jost Meghenda and they are a PhD student in astro-particle physics from the University of Shatel in the UK. Jost is going to talk about going deep underground to what the stars. Please give a round of applause, a huge round of applause to Jost Meghenda. Good morning everybody, glad you made it to your first day of congress. Now physics rarely makes any use. And even when it does, it's often treated as sort of black box, where you pour in money and scientists on one hand wait a while and knowledge drops out. So today in this talk I want to do a little bit differently. I want to give you a glimpse behind the scenes of these experiments that I have been working on for over four years now. First as part of my master's thesis and then as a PhD student. Now right over here we published a design report which is over 300 pages long and contains much more detail about the experiment than you probably want to know. So I'll focus on just some of the highlights in this talk. But before we actually talk about the detector, I'll have to introduce you to the particles we're looking for. And that story begins over 100 years ago with radioactive beta decay. Now in radioactive beta decay you have a nucleus of one chemical element that turns into a nucleus of a different element and emits an electron. Or in our modern language we would say a neutron decays into a proton and an electron. Now after that was discovered there were lots of experiments done to measure the energy of that outgoing electron. And experiment after experiment found that there was some variance in energy but was always lower than expected. And physicists at the time came up with all sorts of possible explanations for what might be going wrong in these experiments. But they excluded those explanations very quickly as well. So after a while physicists became desperate. And some pretty well-known physicists actually thought well maybe we'll just have to give up on conservation of energy. So in this desperate situation a guy called Wolfgang Pauli came up with what he himself called a desperate way out. So in this letter to a group of his colleagues which he addressed as dear radioactive ladies and gentlemen, Pauli suggested that maybe there's another particle created in this beta decay. And Pauli originally called this particle neutron. But of course two years later the particle we nowadays know as neutron was discovered. So Pauli's particle was renamed neutrino. Now you might be wondering well why didn't they observe this particle already? And the answer is very simple neutrinos are like ghosts. So what I mean by that is they can quite literally you know go through walls or through your body. And in fact we can do a little experiment right now to try and detect neutrinos. So to help me with this experiment please give me a thumbs up. Everyone? Okay. So there's two things happening right now. First of all you're giving me a massive confidence boost. But you know more importantly somewhere out there the sun is shining. And it's producing a lot of neutrinos in nuclear fusion. Now these neutrinos are flying to Earth through the roof of this building and then through your thumbnail. And right now as you're listening to me around 60 billion neutrinos are flying through your thumbnail. 60 billion neutrinos flying through your thumbnail every second. How does that feel? You don't feel any of them? Right so that's how ghosts like neutrinos are. And of course physicists are clever and shortly after Pauli had this idea some of them estimated how often neutrinos interact with normal matter. And they found that there is no practically possible way of observing the neutrino. And that remained true for over 20 years afterwards. So now that I've introduced you to neutrinos. Let's talk about building a detector to actually detect them. And the original motivation for building this detector was something a bit different. I talked about beta decay and over the next decades physicists slowly discovered more particles. They discovered that protons and neutrons are made up out of quarks. And in the 1970s theoretical physicists came up with some grand unified theories. Basically precursors to string theory. And these theories predicted that the proton should decay as well. So of course we built detectors to look for that. And a group in Japan built a detector near the town of Kamioka which they called the Kamioka nuclear decay experiment. Or Kamiokande for short. Now they didn't observe any proton decay. But shortly after they built it somebody had a suggestion that if we changed just a little bit about that detector. If we modified just a little we would also be able to detect neutrinos with that. So they modified the detector switched it back on. And just a couple of weeks later they actually observed neutrinos from an exploding star just outside our Milky Way. And that was the birth of neutrinos thrown at me. And for that the then leader of the experiment received a Nobel Prize in 2002. Now after over a decade of running physicists were basically hitting the limits of what we could do with a detector that size. So we needed to build a bigger detector. And that one was very creatively named Super Kamiokande. And it's about 20 times bigger. Started running in 1996 and is still running to this day. Now Super K did not discover proton decay. But did detect a lot of neutrinos and made very fascinating discoveries. For example they discovered that different types of neutrinos can change into each other back and forth as they travel. That's like you buying a cone of vanilla ice cream and then as you walk out it suddenly turns into chocolate ice cream. That's really weird. And for that discovery just a few years ago they received the Nobel Prize again. But today we are again hitting the limit of what we can learn from a detector that size. So of course the next step is to build an even bigger detector and we're calling it Hyper Kamiokande. By the way Super and Hyper mean exactly the same thing just one is Latin one is Greek. So we're currently getting ready the plans to build Hyper Kamiokande and we will start construction probably in the spring of 2020. Details of the Nobel Prize are still to be determined. Now I said that 60 billion neutrinos go through your thumbnail every second. Of course Super Kamiokande which is running right now is much larger than your thumbnail. There's not just 60 billion but 10,000 billion billion neutrinos passing through every day and only 10 or 15 of those get detected. So let's look at what this detection process looks like. Now this is a water inside Super K and there's a bunch of electrons in there but I'll show just one and there's neutrinos flying through. Not just one not just a few but loads of them and most of them go straight through without leaving a trace. But every once in a while we're lucky and one of those neutrinos will actually hit the electron and give it a little kick.  Still slower than the speed of light in vacuum which is the absolute cosmic temple limit but faster than the speed of light in water. And then you get basically a sonic boom but with light which is this cone of light. And let's just show the animation again. So you've got this cone of light and as that hits the wall of the detector you see this ring, this ring of light. And we've got very sensitive photosensors all over the inside walls to detect this flash of light. And from how bright it is we can tell the energy of the neutrino. And we can also tell you know just like with billiard balls we can approximately tell what directions the neutrino came from. Just based on in which direction it pushed the electron. And that's the basic idea of how we detect neutrinos from the sun. Now let's talk about what's actually like to build one of these detectors. So this is a drawing of hyper cameo candy. And you can see it's you know 78 meters high, 74 meters in diameter. And on the top left there's a track kind of for comparison. But maybe a better size comparison is to compare this to buildings which you're familiar with. Like the entrance hall which you just came through this morning. Or you know the Statue of Liberty. And it doesn't quite fit in there, the arm still looks out. But you could drown the Statue of Liberty in this detector. Which nowadays is probably some sort of political metaphor. So this is a giant detector. And what's more we're building it inside the mountain. About 650 meters underground. So that all the rock on top will act as a natural shield. Against all sorts of other particles that are raining down on our atmosphere from outer space. So that all other particles get stuck and only neutrinos can make it through. Now of course to build such a huge cavern inside the mountain. That's something that we physicists can't do on our own. So we need to talk to geologists who look at the rock quality. And tell us you know what's a good place to build this cavern. Where is the rock stable enough to do that? And to figure out the rock quality they drill boreholes. In what's actually called a boring survey. Now during my years working on this experiment I had to listen to several hours of talks on these geological surveys. And I can tell you that name is quite appropriate. Though of course there's a reason I'm not a geologist. So take this with a grain of salt. But okay let's say we talk to geologists. They told us where we can build our detector. So next step is we need to actually excavate the cavern. And something to keep in mind is that we are building this somewhere in the mountains of Japan. Pretty far away from any major city. So we have to think about stuff like the local infrastructure. Like what's the electricity supply like? Do we need to add a power line? Or what are the local roads like? And do they have enough capacity for dozens of trucks every day to transport away the excavated rock? And by the way where do you store all that excavated rock? Because we will be moving something like half a million cubic meters of rock. You can't just store that in your backyard. You need to find a place where all that fits. And of course if you've listened to or watched a lot of the rings. You'll know that it's dangerous to dig too deeply, too readily. So we're going to need a ball rock early warning system as well. But okay, let's say we've got all those. And we managed to build our cavern. And now we need to fill it. And as detector material we use water. Both because it's actually pretty good for detecting neutrinos. But also because it's cheap and there's lots of it. So you can afford to build a detector this size.  But even with water you hit limits of how much you can get. So to fill hypercomucanth you need about as much water as 5,000 people use in a year. And that's for drinking, for showering, for washing their car, and so on. Now that's easy if you're near a big city. But we are not. We're somewhere in the mountains in Japan where the next biggest town has far fewer than 5,000 people. So how do we get enough water to actually fill our detector? And we could use rivers nearby. We could use springs. We could wait for the end of winter and for the snow in the mountains to melt. And use that to fill our detector. But if you use melting snow to fill the detector you can only fill it once a year. So even where do you get the water is a pretty important question that you need to solve. And then we're not just using any water but we will build our own water purification system. So that we don't have any traces of radioactivity in there. Any kind of dust and stuff in there. And let me just tell you just how pure this water will be. So this is my supervisor who when he was a PhD student worked in the detector on some maintenance work. So he was working on a boat doing the work. And then at the end of his shift he leaned back in the boat and just a tip of his long hair fell into the water. Which he didn't notice, didn't think about too much. Until at the end of his shift he went home, went to bed, fell asleep and then woke up in the middle of the night with his whole head itching like mad. Now what had happened there? The ultra pure water had sucked all of the nutrients out of the tip of his hair and then through osmosis over time those had sucked the nutrients out of the rest of his hair and then his skin. So that's how pure that water is. Now I said all over the inside walls and here's kind of a photo of the inside of the detector and all these kind of golden hemispheres those are what we call photomultiplier tubes or PMTs for short and those are basically giant, very sensitive pixels and we will have 40,000 of those lining the inside walls of the detector. Now in smaller detectors you could just have from each PMT one cable leading to the top of the detector and then have your computers there to analyze the signal. With a detector this size you just can't do that because you would need 40,000 cables some of which are over 100 meters long that wouldn't work. So we have to put some electronics in the water to digitize the signal and combine signal from multiple PMTs into one and then use just a single cable to bring that up to the top where we analyze the signal. But that means we have to put electronics into the water so that creates a whole bunch of new problems. For example we need these electronics to be watertight and I'm not talking the level of watertightness you'd expect from your smartwatch where it survives, you know, you're standing under a shower for five minutes I'm talking below 60 meters of water for 20 plus years. These electronics also need to be very low power because we can't heat up the water too much otherwise these pixels, these photomultiplier tubes would become noisy and this would kill our signal. And then also because we don't want one defective cable to kill a whole section of the detector we need to implement some sort of mesh networking to introduce some redundancy. Now each of that by itself is not a hard problem each of these problems can be solved. It's just a lot of additional work you suddenly have to do because your detector is that huge and it gets even worse. This is what one of these PMTs looks like it's about 50 centimeters in diameter and inside that glass bulb is a vacuum. So it's under a lot of pressure plus we add 60 meters of water on top of it which adds additional pressure. So you need to make absolutely sure when you're manufacturing those you don't have any weak points in the glass. And they don't just have to withstand that water pressure but there will probably be some PMTs that have some weak points some air bubbles or something in the glass or some structural weakness. And the neighboring PMTs don't only have to survive the normal water pressure they also need to survive one of their neighboring PMTs imploding and sending out a pressure wave. And that's not just a hypothetical. That actually happened 18 years ago sorry 17 years ago in Supakamyokande and that was in seconds killed more than half of the PMTs we had in there and it took years to restore the detector to full capacity. So lots of problems to solve and one group, one university can't solve all these on their own. So we've got this multinational collaboration with over 300 people from 17 different countries marked in green here and across many different time zones. So right now here it's about just before noon in Japan people have already had dinner going to bed soon. In the US people haven't even got up yet in the morning. So good luck finding a time for phone meetings which works for all of these people. So that's kind of a glimpse behind the scenes of what it's like to work on this detector and to actually build it but now I want to talk about what we use the detector for. And I've got two examples but of course there's a whole bunch more that we do which I just don't have time to talk about today. So first example, why does the sun shine? That seems like such a simple question, right? And yet it turns out it's really difficult to answer. So in the days of the Industrial Revolution when burning coal and steam power was all the rage people thought that maybe it's a giant ball of burning coal but when you do the math it turns out that would burn for a few thousand years maybe. So that definitely doesn't work. A bit later physicists suggested that maybe the sun is just slowly shrinking and shrinking and it's that gravitational energy which is released as light and that would give you a lifetime of a few million years but then you've got pesky geologists coming along and saying no, no, we've got these rock formations or I don't know fossils maybe that are more than a few million years old on Earth. So the sun has to live longer than a few million years and the arguments from the 19th century between Lord Kelvin and the geologists back then are just amazing to read if you find those somewhere. But of course nowadays we know that the answer is nuclear fusion and here's a bunch of reactions which lead to the energy generation in the sun but now the question is how can we check that? How can we check that this is actually what's going on and the answer is neutrinos because many of these reactions produce neutrinos and we can detect them. So the one we typically detect in super and later hypercomucandes is the one on the bottom right here called boron 8 neutrinos because those have the highest energy so they're easiest for us to detect and the rate of various of these processes depends very much on the temperature. So by measuring how many of these neutrinos we see we can measure the temperature inside the core of the sun and we have done that and we know that it's about 15.5 million Kelvin plus or minus 1%. So we know the temperature in the core of the sun to less than 1% uncertainty. That's pretty amazing if you ask me. And I said that we could detect the direction that neutrinos were coming from so we can actually take a picture of the sun with neutrinos. Now this is a bit blurry and pixelated and not as nice as what you'd get from an optical telescope but this is still a completely different way of looking at the sun and what this tells us is that this giant glowing orb in the sky that's not some optical illusion that actually exists. Okay. So onto our next topic exploding stars or supernovae which is what my own research is mostly about. So supernovae are these giant explosions where one single star like in this example here can shine about as bright as a whole galaxy consisting of billions of stars and the rule of thumb is this however big you think supernovae are you're wrong. They're bigger than that. And Randall Monroe of XKCD fame had this excellent example of just how big supernovae are. So he asks which of the following would be brighter in terms of the amount of energy delivered to your retina? Option one a supernova seen from as far away as the sun is from Earth or option two a hydrogen bomb pressed against your eyeball. So which of these would be brighter? What do you think? Yeah, you remember the rule of thumb we had earlier? The supernova is bigger than that. In fact, it's a billion times bigger than that. So supernovae are some of the biggest bang since the original big bang. They also leave a neutron star or a black hole which are really interesting objects to study in their own right. And the outgoing shockwave also leads to the creation of lots of new stars. But maybe most importantly supernovae are where many of the chemical elements around you come from. So whether it's things like the oxygen in your lungs or the calcium in your bones or the silicon in your favorite computer chip life as we know it and congress as we know it could not exist without supernovae. And yet we don't actually understand how these explosions happen. And while we... I have no idea what's happening. Okay. So life as we know it could not exist without supernovae. And yet we don't actually understand how these explosions happen. And even observing them with telescopes doesn't really help us. Because telescopes can only ever see the surface of a star. They can't look inside the core of the star where the explosion actually takes place. So that's why we need neutrinos. And we've served tens of thousands of supernovae with optical telescopes. With neutrinos we've observed just one. This one in February of 1987. And we've seen two dozen neutrinos which you see here on the right. That's what we know. So we know basically that many neutrinos are emitted during the first one second or so and then fewer and fewer for the next 10 seconds. We know that neutrinos make up most of the energy of the explosion of the supernova with the actual energy of the explosion and the visible light making up just a tiny fraction. We know that the neutrinos arrive a few hours before the light. And that's all. That's all we know. And still about these two dozen events, these two dozen neutrinos, more than 1,600 papers were written. That's more than one paper week for over 30 years. So this gives you an idea of just how important this event was and how creative physicists are. Or I guess you could call desperate, but, you know, I prefer creative. In fact, this one supernova we observed was such a big deal that 30 years later, February of last year, we had a conference in Tokyo on supernova neutrinos and we had the 30th anniversary celebration. So there we were, about 40 or 50 physicists looking over the skyline of Tokyo, having dinner. There's the now leader of the super-kamiokande experiment, who was a PhD student back then when it happened. And in his hand, he's holding the original data tape with the events that he himself analyzed back then. So there we were. And at one point that evening, we actually started to sing Happy Birthday. Um... So it goes, you know, Happy Birthday to you, Happy Birthday to you, Happy Birthday dear supernova 1987. Eh... You know, it absolutely doesn't work. But it was still amazing. So that's all we know. And then there's what we think we know. And most of that comes from computer simulations of supernovae. But the problem is, those are really, really hard. You know, it's one of these extremely rare situations where all four fundamental forces, gravity, electromagnetism, and the weak and the strong nuclear force all play a role. You know, normally, in particle physics, you don't have to worry about gravity. And in pretty much all other areas of physics, you only have to worry about gravity and electromagnetism. Here, all four play a role. You've also got non-linear hydrodynamics of the gas and plasma inside the star. You've got the matter moving relatively at 10 or 20% of the speed of light. And you've got extreme pressures and extreme temperatures that are sometimes beyond what we can produce in the laboratory on Earth. So that's why these simulations, even in 2018, are still limited by the available computing power. So we need to do a lot of approximations to actually get our code to run in a reasonable time. But that produces some problems. And in fact, the week I started my PhD, one of those groups doing these supernova simulations published a paper saying that there is a long list of numerical challenges and code verification issues. Basically, we're using these approximations, and we don't know exactly how much error they introduce. And the results of different groups are still too far apart. And that's not because those people are dummies. Quite the opposite. They're some of the smartest people in the world.  In fact, in many of these simulations, the stars don't even explode on their own. And we don't know whether that means that some of these approximations just introduce numerical errors, which change the result, or whether that means that there are some completely new physics happening in there which we don't know about, or whether that is actually realistic. And some stars in the universe don't explode, but just implode silently into a black hole. We don't know. We just don't know. So take any results of simulations with a grain of salt. That said, here's our best guess for what happens. So we start out with a massive star that's at least eight times the mass of our Sun, and it starts fusing hydrogen to helium and then on and on into heavier elements until finally it reaches iron. And at that point, fusion stops because you can't gain energy from fusing two iron nuclei. So that iron just accretes in the core of the star while in the outer layers, here in orange, nuclear fusion is still going on. But as more and more iron accretes, and that core reaches about one and a half solar masses, it can't hold its own weight anymore, and it starts to collapse. And inside the core in nuclear reactions, you're starting to form neutrinos, which I'm showing as ghost emoji here. Now let's zoom in a bit. The core continues to collapse until at the center, it surpasses nuclear density. And at that point, it's so dense that the neutrinos are actually trapped in there. So even neutrinos, which literally can go through walls, cannot escape from there because the matter is so dense. And the incoming matter basically hits the wall because the matter in the center can't be compressed any further. So it just hits the wall and bounces back. So from that collapse, you suddenly get an outgoing shockwave. And in the wake of that shockwave, suddenly you get a whole burst of neutrinos, which escape the star quickly. Now that shockwave moves on and slows down. And as it slows down, the matter from outer layers still falls in, and in this kind of collision region, while neutrinos in the center are still trapped, in that collision region, neutrinos are being produced at a relatively steady rate. And the shockwave has pretty much stopped and just wavers back and forth. And we see some neutrino emission. Now after about half a second, maybe a second, neutrinos from the center are slowly starting to escape. Most of them are still trapped, but some are making their way outside. And some of those actually manage to leave the star, while others interact with matter in this shockwave layer and give that matter a little energy transfer, a little push, and heat it back up so the shockwave gets revived and the star actually explodes. And all of that took just one second. And then over the next 10 seconds or so, the neutrinos remaining at the core slowly make their way outwards and then travel away at the speed of light, hopefully to Earth, to our detector. While that shockwave moves much slower than the speed of light, it slowly makes its way outwards, and only a few hours later, when that shockwave reaches the surface of the star, do we actually see something with telescopes? So remember earlier, the neutrino signal we saw was something like a bunch of neutrinos in the first second, and then fewer and fewer neutrinos for 10 seconds. Not a lot of detail. But what we might see is something like this. A brief and intense burst when the matter hits the wall and is thrown back in this first shockwave. Then as the shockwave stagnates, we might see some wiggles corresponding to the shockwave sloshing around aimlessly. Until the shockwave is revived, the explosion starts, and then over the next 10 or so seconds, we would see fewer and fewer neutrinos as the star cools down and as the neutrinos escape. So if we have good neutrino detectors, we should be able to watch millisecond by millisecond what exactly happens inside the star. Now luckily, we've got many more neutrino detectors by now. Probably the biggest one is Super Kamiokande up in green, which would see about 4,000 events from a kind of average supernova in our Milky Way.  And some of these detectors are part of something called the supernova early warning system or SNUZ. And SNUZ is meant to act as a wake-up call to astronomers. So when these detectors observe neutrinos, which are probably from a supernova, they will send out an alert to astronomers to get their telescopes ready to be able to see that supernova from the very beginning. And then of course, just in the past few years, we've also had rotation wave detectors like LIGO in the U.S., Virgo in Italy, and in just a few years we will get another one which is located in Japan, actually inside the same mountain as Super Kamiokande. So they're literally next door neighbors. And then we might get another detector in India, maybe one in China, in the future. So that's three completely different ways of looking at supernovae. So when we observe a supernova, it will be headline news. And now you know what's behind those headlines. So I've introduced you to neutrinos. I've told you a bit about what's like to work on such detector and the challenges of building a detector with scale. And I've showed you how with neutrinos we can observe things that we can't directly observe otherwise, like the interior of exploding stars. And with that, I want to thank you for your attention and please let me know if you have any questions. Thank you, Jost. Thank you for using talk. We have plenty of time for questions and there are two microphones. Microphone 1 is on the left side of the stage. Microphone 2 is in the middle, so queue up. And we're going to take some questions. First question from Microphone 2. Yeah, thank you. But I do have a question. I come from a mining area and I just looked up how deep other mines go and I'm wondering why do you dig into useless rock if you can just go to some area where there are mines that are no longer used. In my area, they go as deep as 1200 meters, I think. I just looked up and was surprised that the deepest mine on earth is almost four kilometers in South Africa, an active gold mine. So why don't you use those? So part of what we're using in that particular location is because we used it for Super-K and for Kamiokande before and the mountain that Kamiokande was in actually is a mine. So we had some previous infrastructure there. And then there's I guess some trade-off between the benefits you get from going deeper and deeper and the additional cost. I think. Thank you. We have a question from the internet that's going to be narrated by our wonderful signal angel. Hello internet. So the question, I didn't understand the whole question but something about earthquakes. Okay, does the earthquake affect the detector? Or there's two parts to the answer. Part one, I'm not a geologist. Part two, I think the earthquakes are mostly centered on the east coast of Japan and we're about 200, 300 kilometers away from that. So the region we're in is relatively stable. And in fact, we've been running for since 1983 and we haven't had problems with earthquakes. And during the Fukushima earthquake our detector was mostly fine but we've actually had so in addition to what I was talking about we're also producing a beam of neutrinos at an accelerator which we shoot at the detector. And that accelerator is right at the east coast. So the only damage from the Fukushima earthquake is to that accelerator not to the detector itself. I hope that answers your question. Next is from microphone too. Hello, thanks for an interesting talk. Do you or does have science, any theory if the neutrinos who hit the electron affected themselves from this hit? Are they like directed in a other direction sort of energy itself or just hit the electron and pass? True. So conservation of energy and of momentum still holds. So they would lose some energy as they give the electron a little kick. Thank you. One more question from Mike too. Hello, thanks for your talk. My question is you said that the only supernova where we detected some neutrinos from is from the 80s. So what is so special about that supernova that with all the new detectors built there was never another detection? So the special thing about that one is that it was relatively close. So it was in the large magnetic clouds about 150,000 light years away which is on cosmic scales our next door neighbor. Whereas as a supernova which we observe can be millions of light years away. We can easily see them at that distance but we can't detect any neutrinos. Okay, thank you. And we expect about between one and three supernovae in our Milky Way per century. So we're in this for the long term. Okay. Thank you. Microphone 2 again please. Hi, thanks for your talk. My question is you said changing the water once a year is not often enough? How often do you change the water? How often do we change the water in the detector? Yes. So we completely drain and refill the detector only for repair work which happens every depending on what we want to do but typically every couple of years to ten plus years. And apart from that we recirculate the water all the time to purify it because there will always be some traces of radioactivity from the surrounding rock which make their way into the water over time. Thank you. And that would be all that was a wonderful start to the congress. Thank you.


Ladies and gentlemen, please welcome Chairman and CEO Joe Tucci. When you stand up here, you see the size of this audience, the size of this screen, is one word comes to your mind, wow. And another word comes to my mind, welcome. I'd like to welcome everyone to TMC World. We have a great event scheduled for you here, and we really, really, really appreciate you attending. I'd like to thank our customers for your confidence you exhibit at EMC, the business you do with us, our partners, we couldn't be successful without you, and all my colleagues at EMC from around the world, thank you too for being here and doing everything you do every day of the week. I'm really excited about this event, and hopefully you will be too. We've got, and I'll give you some statistics in a bit, but it's, we've got quite an event planned for you, and we'll all have some fun. But this focus on this event is primarily on you, our customers, actually totally on you, our customers. And you might know that the genesis of the EMC squared logo was the four names of our founders. We had a Egan, a Merino, a Connolly, and a Curly, and of course they did the playoff of Einstein's theory of relativity, and that's how we came up with our name. But back in 2001, when we had to transform ourselves for probably one of the first times, and rebuild our business after that collapse at a dot com, we changed what EMC meant. And it meant that everyone in EMC makes customer calls to get closer to you, to get more intimate to you, to find out your problems, your needs, and how we can fulfill them better. And this program has worked great. As an out shooter to this program in 2001, we had our first EMC world, which we called EMC Wizards. And at that event, we had 1381 customers. Today we have about 10,000 customers. We had 31 sponsors. Today we have 120 sponsors. There was 128 sessions. There's well over 500 sessions and 5,000 online sessions. So you could see how we've grown over those 12 years. So who was here, by the way, on that first EMC Wizards conference? Anybody here? Now stand up. Quite a change, huh? Thank you for being here for 12 years. When I saw this screen yesterday, I got incredibly impressed. And I asked them to go back in the archives and I said, can you dig up the first slide I used to welcome everyone to the Wizards conference, first EMC world in 2001. And lo and behold, they found it. And this was it. And by the way, you can see it was on February 12th of 2001. And by the way, I said, do me a favor, put that slide up in the exact size screen that we used. There it is. So not only has the conference grown, the screen has grown. Now, what we did here is we inlaid in American football field. I had a lot of pressure from head of marketing Jerry Burton to put a proper football field as he puts it.  But anyway, this is an American football field. And you can see just the size of this screen and how things have changed from that original Wizards conference to today. So hopefully that will give you, we'll live up to that breath in the sessions you have and the interactions you have. And again, I believe that we will. And this kind of guide is the theme. How many of you, be honest now, raise your hand. How many of you does this guy creep out? Okay, I'm not the only one. I think we should have a contest. Let's have a contest. Whoever comes up with the best, I mean, we've got another pitcher at this guy. Maybe this is a better pitcher. So we'll have a contest. This is totally unrehearsed. But trust me, we will not be cheap. We will get a good prize. So I want everybody to tweet or whatever you do. And let's see if we can get a name for this person. So before the conference is over, we'll announce a winner and we'll have a nice surprise for whoever names this individual. But I'm really glad I'm not the only one who creeps out. But I do think, as much as I picked on Jeremy, he's done a phenomenal job. And this is a great theme for the conference. Because transformation is happening all around us on a global economy front transformation everywhere. And of course, IT is transforming. And I'll go into that in a second. Businesses are going to transform. And I think one of the challenges we wanted to lay out here for us, and that means all of us, is how do we transform ourselves to be more relevant to pick up on the opportunities that this new world and this transformation will put forth? So again, I think this is a great theme and we'll go through this. So what I'm going to do here is use a little bit of my age and take you through how much IT is transforming. Now this is an old slide. We used this last year. Might have even used it the year before. And it shows that transformation in IT is not new. And I think I was a fortune reporter years ago called this Waves of Change. From mainframes to mini to PC microprocessors to client server to now IT as a service for cloud computing. And again, as depicted here, this cloud computing wave, I see and I truly believe. And the only benefit of being as old as I am is you actually live through all these waves and saw it. And I'm still going. And I just want to take you a little bit through to show you some of the factors on how everything changes in IT. Everything as you go from wave to wave. So what I did is I simplified this a little bit and I brought us back to my roots. I started in 1970. I actually started as an assembler programmer. There's one other in the room. And this is what the two others in the room. So anyway, this is what the world looked like. There was about 20 companies that played in the mini and mainframe era. 20 that had an American cap of over a billion dollars. And trust me, a billion dollars was a lot of money back in 1970s and early 80s. A lot of money. So anyway, every one of those companies had their own... If you looked at the chipset, they had their own custom LSI chipset. Most of those companies had their own fabs. If you looked at the topology, the architecture, it was all monolithic. Everything kind of came together in one big box. Memory back then was measured in thousands of bytes. The network was all proprietary.  Storage, we were just moving from tape to disk, bound in pro closer to the application. The data model back then that just came into vogue was index sequential. So now using these great disks, I can now use index sequential to go right to the data I wanted, which allowed online processing. They came out with a programming language called Colbal, which mere models could program. And again, we had a boom of online processing. And of course the applications in that way that were computerized, as they said in those days, were the financial applications, the general ledger, accounts receivables, payables, billing, et cetera. And then of course the cost of these was very high. Very high. So let's fast forward, and what I want you to note is how the time we got the client server, not some of the things changed, everything changed. No longer was every manufacturer making their own chipset. There was fewer chair risk chipsets, right? The technologies had changed in words like clustering, racking, scale up, were in vogue. Memories instead of were now in millions of bytes. The storage model was all disk. Database model changed from ISAM to relational database. Language went from Colbal to C++, Java. And what were the killer applications, the iconic applications at that age? ERP, CRM, HR applications, supply chain applications. And again, the end user device changed from proprietary terminals to Windows PCs. For years, our standard in EMC was every three years you get a new Windows PC. No matter what you want, that's what you got. Sometimes you got a laptop, sometimes you got a desktop, but that's what it was. And again, the cost went down, became more affordable, and computing expanded beyond our wildest imaginations. But as the saying goes, you ain't seen nothing yet. So let's fast forward now to where we are now. And again, I'll submit to you, everything is changing. The chipsets in cloud technologies are x86, multi-core technology. The topologies now are virtualized scale out. Memory is now measured in terabytes. Networking is now moving to IPv6. Storage, it's disk, and flash. The data models, new data models are emerging, and this will happen over the next, you'll see, because these waves are long waves. You'll see over the next ensuing years that data models to things like a dupe, and those SQL and others will come into Gavogue and great use. Languages, we're moving to frameworks, like Spring, like Rails, like nodes.js, like Python, et cetera. What's the killer app going to be? I'll predict that anybody here, and I'll give you some odds, that the killer apps are going to be all around real-time, real-time predictive analytics. Those are going to be the killer apps. The end-user device, we're in a post-PC era. Yes, it's PCs. Yes, it's virtual PCs. Yes, it's tablets. Yes, it's smartphones from many different vendors, many different operating systems, whether it be Android, whether it be iOS, whether it be Windows, and others to come. Costs, again, much more affordable. Computing will be much more pervasive. So, again, I'm saying, when you look at this, what causes a wave shift? Well, the first thing that causes a wave shift is technology. And you can see now, hopefully, as I gave you three comparisons, you can see that we've had that technology wave shift. And you're going to get unprecedented levels in this cloud wave, IT as a service wave, unprecedented levels of automation and affordability, unprecedented levels. The other catalyst for change of IT transformation is businesses themselves or governance themselves. And they're ever-ending quedge for better productivity, more intimacy with customers, better control of their supply chain, and, of course, more and more agility. And they need this to happen at a faster and faster pace to stay competitive. So a little bit of how business transformations and IT transformations are playing together to create this wave of change. Again, why we picked this topic for our agenda. So, again, welcome everybody to Cloud Hour. We're here. The technology is here. The business mandates are here. And it's going to be quite a future. And just like all of these wave changes, of those 20 companies I mentioned that started out in the mainframe of minicomputer, the only one left is IBM. The others are either gone from existence or those companies have gone to do different things in life other than information technology. On the other side, look at all the great companies that were born since that mainframe and minicomputer wave. You know, companies like Microsoft, companies like Cisco, companies like EMC. And this goes on and on and on. So tremendous opportunity. So what we need to do and why I believe this is a great topic for this forum and summit is because we focus ourselves on how do we transform.  Well, which cloud model are we in? Will it be private clouds or public clouds? I absolutely think it's a silly, silly question. Let's look at what we believe and then I'll give you some data points. We firmly believe, deeply believe that there will be hundreds of thousands of private clouds and thousands of big companies and new companies will stand up public clouds. So it's a world of both is what we believe. Again, these are some of the companies, and I said some of the companies that we've been partnering with that are standing up public clouds so that you can find a partner you trust and do the best of both worlds, the benefits of a private cloud and the benefits of a public cloud. The power of end, not war. Now, when asked by Gartner and IDC what customers are planning, the way you or somebody in your company or government agency has answered this question is, yes, 78% have solid plans for a private cloud and 77% have solid plans for a public cloud. Pretty good demonstration that is a world of end or a world of both. Now, we call this world of both hybrid cloud computing where you will big instances of private clouds and then of course when a peak comes in a load in one of your workloads, you can then instead of having to buy more and more equipment just for that little peak, you can then use workloads and capacity that's been put up in public clouds of vendors that you trust and there's a whole other set of reasons to use them. So again, using this will give you the best cost and the most efficiency. Now, I talked a lot about technology. Let me go back to the business side of this and the business transformation piece. If you think about a business, and this is true for a government agency too, if you think about a business though, that is critical and it's a lasting asset of that business. Well, it's got its brand and its reputation, right? Government is more of a reputation, business is more, we talk about it as a brand, which is everything in life. That's how you get respect, that's what customers trust, that's what they deal with. Obviously, from a strictly accounting point of view, it's not listed as an asset, but I'll tell you running a company, the best asset you could possibly have is your talented, dedicated people. The way you serve your customers, the way you work, say you're the most efficient you could be, is you set a whole set of business processes and a set of applications that support those business processes. That's a critical asset of a company. And then of course, I'll submit that the information that a company has is also a critical asset. And as I said, this works for a government or not-for-profits, same thing, words might change. If it's a military, they might substitute brand with mission. People stay the same, they'll have mission processes, they'll have applications that support them, and of course information is critical in that kind of instance. So it really does hold water, and it's true no matter where you're in a company, a not-profit, governmental, or any entity whatsoever. Now let's take a look at the business process and application information, and let's start with information. Obviously for years we've been focusing, as I said in Wave 2 when the relational database technologies really came into their own. We focused a lot on structured data, but also what this clearly tells us is we have to focus more than we have been in the past on unstructured data. It's five to seven times larger than a company or entity's structured data, and it's growing three times faster. And of course you want to use both for business benefit. If it's not going to give you benefit, why do you have it? So the question is how do I get benefit out of both kinds of data? But that's a small microcosm of the world. That's kind of the world that was addressed in the client-server era. The world we're addressing today has a much bigger piece of data, and that's data that's available publicly or through our partners. We call that the digital universe. So you have your structured data, you have your unstructured data within your own entity, and then there's this massive, I mean it would be this big compared to this screen, the amount of data you have in any one of your companies compared to what's available in the digital universe. So the question is how do I tap into that data, either publicly or my partner's data, plus my data unstructured, plus my data structured, in real time to give me business benefit and competitive edge over any of my competitors. That's the challenge for tomorrow. That is what's going to make the business of tomorrow successful as opposed to the business of yesterday. Exciting world, opportunity for everyone in this room. Now let's use an example and have a little bit of fun. So you go back and I can remember as a young child, even back in kindergarten days, I used to sit there, one of the things I used to love to do is sit there and I'd help my mother clip the coupons out of Sunday paper to go shopping. And of course it's still done. This is from a modern paper, I think Starsky, they tell me, I don't know this factually, but I've been told it's a grocery chain on the west coast. People are shaking their edges at me. And again, so you still have that method around. But let's look at the digital universe and how we can change things in the shopping experience. So first let me introduce you to our handsome and capable head of marketing, Jeremy Burton. Jeremy, that was really quick. So I want to share you a day of Jeremy shopping. So Jeremy's a modern kind of guy and he has, as a matter of fact, I'll declare his favorite device. It's anything Apple and he loves his iPhone.  So he's allowing that information that's publicly available or in a partner ecosystem, namely Jeremy's exact location to be shared with the star grocery. That's a fictitious grocery store, I hope. So we've shared that with star groceries. And then what they do, knowing Jeremy's British, they sweet the Jeremy, or they come back with Jeremy telling him, hey Jeremy, today's British day at star groceries and all the products from the UK are on sale. That excites Jeremy, he goes into the store. As he enters the store, they know exactly where he is, what Ily is in, from their structured data. They know what Jeremy has bought in the past and what his likes are. And they know that Jeremy happens to love Hobnobs. Now I personally have no idea what Hobnobs are, but Jeremy likes them. Jeremy just shot it up, it's a biscuit. There you go. So rather than have to clip a coupon, they used positioning and information from their own database, public source, again Jeremy opted in, and they pushed a coupon to Jeremy right then. Jeremy gets excited, they can be told exactly where he is.


Here's how we took one of our students, Tanya, from going from barely passing her exams to getting A's consistently in her courses. Number one is we made her realize she really didn't have a study system at all. While most students like Tanya think that a variety of methods and resources count for a study strategy, it really does. Instead, we transitioned from this mosaic of study strategies and resources as something that was simple where she knew exactly what she would be doing before lecture, during lecture, and after lecture to master that material. Number two is that we predictably scheduled her first, second, and third pass of the material. Just a few days, Tanya had a system where she knew, within this many hours, I need to review the lecture the first time, within this many days, I need to review the lecture the second time, and within this many days, I need to review the lecture for the third time before a quiz and test. And finally, and most importantly, we increased her study efficiency by making her study last. If you're interested in the full breakdown and strategy that we gave Tanya to be able to make this transition, as well as seeing all the results, learn down below how you can get access to our free case study and exactly how we helped Tanya go from a C to an A student. And if you want more tips and tricks to help you on your medical journey, succeed with less stress, make sure you hit that like, subscribe, and follow for more content just like this one.