So first of all, please a round of applause for Adam our sex player And if you pay drums or bass, please contact him would be great to get a band here Maybe next time but all right So I am Juan Antonio Sirio Robles or us. It's a little easier and Adam young again our sex player and Yeah, we're gonna talk a little bit about Oslo policy Did you a little bit about access control? How do we use it in open stack? How to write policies? These are very basic talk. We're not assuming that you know anything, but hopefully it will teach you a couple of things so Yeah, where's there you go? So why? Right, so why are we even doing this? Why is this not just a live gig of Adam? I Don't know. I don't know. No chances are everybody's deployment is different chances are the default policies are not enough for you and It's very probable that you're already changing the policy, but Are considering that it might not be enough? So we thought it would be appropriate to start teaching folks more about it Given the docs are quite extensive, but it's just nicer to have somebody teach you, right? So we'll try to keep it simple. We'll try to teach the basics So yeah Oslo Oslo as some of you might know and here we have the PTL as well. Hey Ben Is the set of libraries that are coming for open stack they try to enforce Standards and common practices and Oslo policy is just one of them. It does access control and Oh access control So who can do what right? Usually you assign roles or attributes to your users or to whoever had wants to do something in a system and You'll have rules to define Who can do what right? so these rules are enforced and we call this authorization and That's the gist of access control. You can search more in Wikipedia, but for our purposes. This is the main thing of it so let's take a very simple example just a bakery and I live in Finland, so it's all Finnish names Those are Finnish pastries I'm a bit hungry But yeah, let's say Kim is a baker. He can bake bread and it's all good. He has the his Baker certification he can manage Food and and it's all good Bill V is a cashier and she manages money and Deals with customers right given that Kim is a baker. He's not allowed to be with the He's not allowed to deal with customers to deal with money and given that bill V is not a professional baker She's not allowed to bake so This is access control in a gist right a User has a role and can execute an action on a target object. This is what is our main concern now You could have several shops, right? So Kirstie is the owner of the shop and Kim works for Kirstie, right? Eric is the owner of the Norwegian bakery the competition and all the works for Eric so even though Kim and all they are both Working for a bakery. They cannot work for the competition So this is scoping right you can you scope the work of all of it towards the Norwegian bakery so The one that authorizes All the end came to work at the specific bakeries is the owner so Yeah, one important thing to note and that usually people get confused by is that authorization is not the same as authentication authorization is Who can do what are you allowed to do it while authentication defines the identity of The user or whoever is trying to do something So access control in OpenStack. Let's talk a little bit about it. Let's take a sample request We have our rockstar here that wants to just list the servers of their OpenStack deployment and In order to do it he needs to be allowed to do it so the first thing that he's gonna talk to is Keystone Keystone is the identity service for OpenStack, which you might know and First of all, you will authenticate to it and it will give you back an access token or a bearer token With that token you can now try to do operations in your opens like installation. It could be Neutron It could be Nova. Let's say Nova.  There's also a bunch of more like Stuff for audit and whatnot but in for our case is Keystone middleware the important one and That piece of middleware is just this small piece of software that whose only role is to talk to Keystone verify that The token is valid and get user data, right? So it'll talk to Keystone give it the token. Hey is this token valid or Has it expired or I mean can I use this?  What are the roles? Which is a very important thing. What are the roles for that user so all of this is Filled up by Keystone middleware. So now we get to Oslo policy, right? Also policy I put a lot of information there, but it's a small library that all of the OpenStack services use And it provides several things right it is a small library. So you're usually Well, it allows you to write your policies So you will write your policy in a language that is Yamal or Jason. It doesn't really make that much of a difference it's very similar in both ways and It allows you to do enforce the rules to specify the fault rules and to read the rules Right. So the fault rules are usually stored by the project in in code So you would need to know a little bit of Python to actually be able to read it nowadays It's called by the service. So the service is responsible for coding the calls to enforce policy It's not a piece of middleware. It's it's a library. Hey Oz. Is that true everywhere? It's not true. It's not true. Everybody has done policy in in in code It's something that's happening. You'll see it in a lot of the projects But not all of them and that's one of the gotchas There's a lot of gotchas here, which is I guess that's why we're here Why we're here, but uh, but yes keystone does it in code Barbican does it in code Neutron still doesn't do it in code yet There's also another gotcha when you're updating your policy Usually some services just read the policy automatically. So they will check when the policy was last modified and Automatically refresh it. So that's very nice because you only need to change these etsy nova policy that Jason are etsy Barbican policy that Jason however Not all services do this for keystone. For example, you need to refresh So it requires a lot of tribal knowledge about which project does what we are trying to standardize, but There's still a lot of gaps Where your tribe? But it's in process. We're trying So access control how do we map access control from The abstract concepts of the bakery to Oslo policy, right or well now open stack, right? So again a user has a role to execute an action on an object Kirstie is an admin. So that's the admin role and can create that's the action Users which is the object, right? So in Oslo policy, we have three main concepts, right? We have the credentials which describe the user so Credentials contain the username it contain the domain, but it also contains the roles So that's the credentials the rule is the rule name. So Get servers create or list projects and whatnot. So that's the rule and the target is Information about the object. So what type of object is it? What project does him belong to? domain information and whatnot so that's the target and Another gotcha a lot of open-stack projects define the target in non-standard ways, right? So barbecue and for example fills it up in a very different way than Nova for instance, which is also something we're trying to standardize I'm gonna go really quickly towards the language of policy But I mean it's it's a really simple language You don't need to dig too much into it and we're gonna go through examples, which is the main thing So that's hopefully how you're gonna learn it But as I mentioned, it's a very simple language. It's just a key and a value. So then the name of the rule or the target Rule target and the implementation, right? So you can have lots of different things one of them is hey always allow like this operation is very safe No problem always allow anybody to do that There is another one if you really want to Restrict users from doing certain operation. You can always deny, right? Which is this exclamation mark? as any other languages you have your and rules or or rules you have you can negate a rule You can group them with parentheses. We're gonna see them a little bit more in the examples, right? And you can also specify a default rule Let's say that somebody tried to do something that the service is not really acquainted with you can deny by default for example This is not very common nowadays, but it used to be Roll checks, let's check that for the compute get all The role of the user that tried to do that is Lister You can specify aliases in order to make your rules a bit more readable, right? Role admin or creator now you have a rule especially for that and you can do external checks. So you could also write your own check that We'll receive the data and just return the string true So this is very specific, but you can do that and also policy itself is also extendable you can do custom checks as well and In a subsequent talk Lighting talk lightning talk actually today. I I'm gonna talk about how I did an open policy agent check for Oslo policy And yeah, finally for example, you can check with a With a specific string but one important thing to note for example the last one is Project ID equals project ID that is the format of how you check a The credentials with the target, right? It's not very intuitive, but it's explained as well as in the in the documentation The left would be the project ID for the user the credentials and the right one would be the target So, yeah, that's all for the theory while there's still a bit more coming, but now is Adam's turn.  Is this stuff like dry's toast? Board are you men's? It should be I mean this stuff really should be bread and butter And we seem to be on a bakery theme here. I think we were hungry when we made this presentation this is Obviously at the heart and soul to me. This is what open stack is all about open stack is a way of scaling your operational capacity and Your technology can scale Hugely it can scale to you know millions of nodes doesn't matter if your organization doesn't scale and that's what policy is there to do It's to make it possible for you to take what works in a small group and Duplicate it and clone it in a larger group well, what works is You have a set of roles and we talked about those before our Baker role or our admin role or our member role and then you have a scope and open stack works in this So the policy language that Oz just described. It's actually a generic rules Engine there's very little in it. That's that's open stack specific probably the only thing I would say that is Specific to open stack is the role check because a role is kind of an open stack II concept But really you could use also policy to do any sort of yes. No check you needed to and Neutron has done some stuff like that What I want to talk about now is what it means to do this within the context of open stack and This idea of the scope being separate from the role and that the two need to vary independently what the scope is is They get that right yeah, all right What's the scope the scope is a really foul tasting mouthwash that you want to go and get the green one because if you use scope is the Label that you use to say who owns or not who but what owns a resource how many people here have heard the term project How many people have here have earned the word tenant Okay, how many people know that they're actually the same thing How many people here know that I'm to blame for that? Okay, good at least somebody yeah, there's like there's a standard thing which is keystone sucks And it's all my fault and by my I mean me Yeah, so when we're talking about scoping for the primary thing that we're talking about is that project or tenant ID And project is the standard term for it by the way, and you can blame NASA for that who of course is no longer really contributing to the project Just to confuse the term so the project ID is is a label that's on every resource And I think every resource in open stack has a project ID ID on it Users do not they're the one things that are different We'll talk about those in a bit maybe some of the credentials and barbara can do not have project IDs Those are owned by individual things or owned by domains Everything else and for talking neutron networks images and glance Whatever they have in Sahara, I'm assuming some sort of wild animal they're all scoped to a project what you can do is based on the role that you have and And Yeah, as I said a couple things are not owned by projects and those are things are usually owned by users And but they're still scoped is scoped to an individual user So understanding that those two things that should vary the role that you have and the resource that you're talking to and so Let's go through what the policy looks like for a neutron network. Okay, so specifically we're gonna talk about a subnet Just to pick one Concrete object out of the bunch and so if you create a subnet you make some web call And it's gonna resolve down to making this policy call here create subnet rule admin or network owner Now you remember before where Oz said that we could have aliases. What do you use rule like that? That's basically saying look elsewhere in the file for the actual implementation of it And so this admin or network owner is really just a string at this point It's supposed to be descriptive. This is an attempt to get somewhat self-documenting in our code so Rule contact is admin or tenant ID percent network colon that's that format that Oz was just talking about before, right? So we have two distinct things The tenant ID and what's missing here. We don't really have a rule check. Do we? Okay, so let's talk about it with a little bit more proper scoping here first of all We're gonna say we have this thing rule admin and this is a fairly common pattern I don't know that I would continue this but this should be unsurprising to people who've looked at our policy files That rule is defined that either you have some magic is admin flag passed in from neutron and that does happen That's usually something that said in a config file. It exists. You should know it exists. You really shouldn't count on it Or you have the admin role And and the parentheses are important here those two are together and that whole thing is ended together with the scope check so we have two parts here now in our admin check which is the role matches or Excuse me the role matches and the project matches now network owner is this new Rule that we're adding in there. You can see that those are ordered together in our bottom level rule Rule member role, which is the same kind of rule that we saw before You know there was a roll colon member and the tenant ID matches so The thing that I've cut out of here and this shows that I really should have my slides better trouble shot Is that rule member role actually can include the admin role as well? And that's a way that you can build up more complex roles and in fact, I think we see that later on So if you look here This one right here. I have a little note here This shows bug 9 6 8 6 9 6. Okay How many people know what is bug 9 6 8 6 9 6? Okay? How many people know me? Okay, that's why nobody knows 9 6 8 if you know me you know that I know this bug by name This is the oldest bug in the bug tracker for just about every project Okay, if you go and you sort by like oldest to newest or numeric ID in Nova Nova and neutron and keys and all that you're gonna see bug 9 6 8 6 9 6 and What this bug is aside from being you know kind of alliterative and easy to say and all that Admin anywhere is admin everywhere and this is an error Propagated from the myths of time where we did not properly scope If if a policy rule checks only that the role is admin That means it doesn't matter what you've had admin assigned to you from whether it was a project or whether it was a whatever it is It will pass the policy check this means you can and We're not really too good on saying okay. This is only used for certain things this rule admin is everywhere So this is something that we need to fix so as we go through these next to this example I was working through here You can see that We want to make sure that when we check that you have the admin role that it's also on that project Or you have some other magic way of saying it's the right one and there's a mechanism that's coming for that But the important thing is just to say your role needs to be on the project and if it's the admin role And it's on the admin project or it's It's not scoped to the right project that the policy check should still fail does that make sense Okay, I hear muttering that's good. That means you're talking about it either that or you know if you're going is this guy nuts And I need to get out of here This is one of the most important concepts when you start writing your own policy files to make sure you have right Okay, that you're properly scoping your your checks Okay, so Why do we have roles so you can differentiate who can do different things you can see that we have two different checks here the The get subnet here is going to use the rule member or will share or rule reader. I don't know where shared came from Member says that you have the member role reader says that you have the reader role But what you could have let me see if I do that on the next slide now adding a reader role Okay, so You might have certain apis such as get subnet which are okay for you to do as a reader This is kind of a a non side-effect causing role basically gets when we're talking HTP Yes, if you look at our earlier example We were creating a subnet and there we're saying we want you to at least be a member or the network owner, right? You have the member rule here was saying to get the subnet just to read that That's okay to do as a reader and these are the distinction of the two different types of example Policies you need to implement in order to do a reader role. You always need to check scope. You always need to check what? What oh God you got it. Okay scope.  Okay Let's go back a little bit to slides go back to slides. Yes, so the the way that currently you can fix this is using this checking for the scope in the policy and That's true for most releases There is work on going to define the scope inside the policy encoded However, as we mentioned before not all projects take that into use yet So it's gonna take a while so right now. This is the way to fix it right now Checking scope in your policy. Yeah, probably worth mentioning is when you're looking at the policy files and trying to figure out How to customize them if it's doing a scope check? Leave it alone make sure that that's still done You're not gonna be able to get that more correct the part of the policy file the part of the policy rule that you should be adjusting is What role is allowed to do something and that should be what maps your organization a good example is going back to our network Things there might be a class of users that are allowed to use Networks they can create virtual machines and attach them to networks, but you don't want them messing with the networks themselves So you might take all the Nova APIs and say member can do that there You might take most of the the majority of the neutron APIs and say you have to have some special Network role in order to be able to do that and so those are the kind of customizations You do with the policy file to enforce who can or cannot do operations that that one the example right there is one that actually dream host who I have been a Customer of for many years. They they actually do it that way. That's that's not an unusual policy All right, nice. So where did we get this policy from? Okay, so If you go back in the midst of time each project had an Etsy directory on a project in this case, I'm I should say services each of the various Sub projects under OpenStack such as noven all that had an Etsy directory in their code repository And you see a policy.json file in there and at some point they disappeared a lot of people like where do these things go? Well, a lot of them went into code a lot of them are annotations on the The the the various APIs and say okay, this is what the default policy should be So if you don't have any policy.json file, there will still be something that's enforced. Okay, also policy generator with the With with the flags that you see here. So say service name in this case would be identity or compute It's not Keystone or Novitz identity compute and so forth the the good names That will show you what is the default policy file and you can generate and you can actually pass in another parameter Well, which will say do it as json or yaml and then if you want the really really verbose one that gives you Documentation I think we see that in the next slide Yeah, so here's the example with Keystone and You can see that you will get a Description of the API in there. So this one it says, you know list ports or interfaces It shows you the API's you're actually going to call it's it chops off the host name and all that kind of stuff because that hasn't been Precalculated but HTTPS colon Keystone 5000 block or in this case neutron to be able to do that And you can see the the squiggly braces in there around server ID Those are template values. So those would be the actual server IDs that you would be passed in This is the format that the internals of the Python code uses to generate the URLs And then at the bottom you see the same policy rules that we were talking about earlier At that's the final step and so there'll be a stanza of each of these within the the generated file okay, so You got a customized policy How do you make sure you've got it right? You don't want to just do this on a live server and you can spin up dev stack or spin up a server like that and Test against it and you probably should but there's an easier first step When we were doing this we quickly identified that we wanted to have the same check Performed when we made a change as was going to happen in the code without having to run a live server And so we built the the Oslo policy checker and this is a CLI tool that is inside the Oslo policy library and you use Various parameters to figure out how you're gonna run it if you just pass in the access file This is basically a snapshot of that token data you do a Keystone token get dash dash debug and you'll see what that token data really is and it's a You know a JSON blob that has your rules and all that in there So you cash that in a file and you can cash two or three or four different versions of that and you can run your policy Against those and see okay. This is what an admin token would look like this is what a member token would look like this is what an admin token would look like on project X versus project Y and so forth and You can say okay. I'm really just checking the you know create and subnet Rule let me pass in a flag that says just check this rule or if I leave that off It will check the entire Neutron API whatever is in that third flag Well, excuse me in that first like that dash dash policy It would check all the rules in there if you don't specify and then you cause who is as I'm sure is clear by now Slightly smarter than me. I was saying okay. I need to be able to check Oh, I also want to be able to vary the project ID and he's like I need to vary a lot of stuff So this is brand new the dash dash target To be able to build that target object that you're going to pass in to say hey This is what different neutron networks look like or this is what different Barbican Secrets look like thank you. I should know that better this is what the target looks like for the The resource that I am controlling and so if I wanted to switch out the project ID Well, then I could switch it in that target file And so I might have three or four different target files for a given resource to say hey This is what it looks like and I want to do it where the project IDs match and don't match and see that I get the right results and then in order to test it What I find is I do these last three steps start off with the vanilla one start off with your original one and run it and Send the output to a file and the things that I've learned is you sort it Because you want to make sure if you make any changes that you always do a diff between two things that the roles are The rules checks are the same and then you make your changes and you do the same thing and use diff And that will show you hey in the last time it passed this time it failed That's good. The last time it passed this time it passed you see no diff You should see a diff you know that you haven't gotten your rule correct and it seems simple But this little workflow right here iterated Adnazium will get you to the point that you have policy the way you want to in fact We're working on building a Something for triple O which allows us to do the same kind of thing in the in the larger larger sense Okay, I think we're up to the question slide What do we have 10 minutes for questions or one minute? No, we do have around 10 minutes. Oh awesome. Okay. Okay, hopefully I've confused you all thoroughly and you have a million questions If not, I'm going to start picking people out of the audience to ask questions But I see Sean's up. So at least we get we've got a plant In the in the audience and this is actually payback because I was the first guy to ask questions for for his talk So indeed Sean hello So when you talked about Generating the the admin token data Do you have examples of doing that in practice so that we can go back and do that on our clouds? Um, well as I said you can run Keystone excuse me open stack token fetch From the command line dash dash debug And and you can you can so the example will be in there So you you can do from that. There's a handful of examples. I believe still in Think he's done he's done middleman. There are there are example of what old tokens look like including old v2 versions of those But I think I would just generate one from an actual server and cash that and then Edited you'll see where the roles lists are in there and should be able to add additional ones in and stuff that once you've seen the Initial one you can chop out the whole service catalog, which is about 90% of the bulk of that You don't need that because we don't actually check policy on any of the service catalog things But yeah, there's a cash version. I want to see it might be in Keystone middleware still or it might be in Keystone Look under okay, so it's some part of the JSON response contains that yeah, and in fact in the The the repo that we're building the one. I'm currently hosting a page or I actually have two or three examples on there And that's you're laughing because so I'm only half kidding when I said Shawn's a plant He's a contra a consultant that works with our customers and has actually had to go through this process and Build a read-only role for a customer. And so the What he did there again the the rules look a little familiar. Yeah, they should Based on that so so there's a couple examples in that repo That will and we'll be plusing those up exactly that to have different projects And we need to now that we have the target option to to be able to build a bunch of those for those Okay, all right awesome. Thank you talk Thank you Yeah, come on up question about the versions of OpenStack this basic stuff what version of OpenStack does it require to work generally and For the stuff that Neutron hadn't implemented. What is that missing? Right? What kind of we do with that right now? Okay, so There's a couple different answers depending on which part you focus on Let me start on the latest part first the dash dash target flag Um approved and merged prior to the summit So that's that you'll have to get tip of tree But that for your your own work you could do a pip install of that or whatever that should be fine for being able to do that That's the only thing that's changed on the policy side of the rest of the enforcement is the same You just have that additional flag in there moving Back through the presentation to some of the earlier stuff policy and code has been an ongoing Effort effort I remember we were talking about it at the first Vancouver summit. So you have to go back I think Liberty and stuff like that you'll start seeing it there Keystone only got it about three or four releases ago Glance doesn't have it yet So really that's on a project by project basis Oslo policy the rules that it enforces has not changed in forever Okay, does that answer your question? So basically you can use the Oslo policy to make a read-only role for like old Versions you could do it for cactus. Okay No, you couldn't do it for cats. They weren't doing policy back then In the back the room greetings Just a quick question. You showed earlier that under slash etc slash service something there is the policy Jason Since greens all this is containerized How do I get to the policy of? Containerized service don't want to break in the container It's a configuration file and wherever you would find your configuration files. You find it there now If you're talking triple low and how do you want to generate new ones there? I think you actually need to generate them in the triple low environment format And then they will be generated into that for you and we didn't cover to that here because that's kind of triple low specific But the the short answer is wherever you would find your keystone.com right next to that You'll find your policy that Jason assuming that you generate one you may not have one if it's using policy and code And it has made no changes. There may actually be no policy and that's why those last Those last two are so important because if you want to actually document this and Deploy in such a way that somebody could modify it, then you'll want to run this and stick those in there. I believe for for triple O at least the Config directories are are bind mounted from under var Did everybody catch that? There's gonna be a quiz It's under varlib and you know look at the triple o documentation It depends on your deployment mechanism where we're where it lives, but it's basically bind mounted into the container. Okay, but assuming your Deployment engine doesn't bind mountain then yes, you have to go inside the container and modify that file There is a documentation for this. I assume Something that I can read and understand I Know what is it? Okay? Documentation for what fear change he asked for documentation or something you can read and understand about where you would find those files Yeah, and how to get them into the containers What deployment engine are you asking about? So that's trip. I mean are you talking about specifically triple? I'm using OSP 13 triple o director. Oh Yes, there is there is no documentation about it, but there is a specific format to do it Dogs I could write them though. So Sorry about that. I I do know that in At least in the OSP version, I think this is taken straight from upstream To be able to customize policy you can pass it in as environment variables And in fact usually what you'll do is you'll generate a a policy dot yaml for your whole deployment and So do you do a redeploy of the overcloud with that in there and they end up in the right places if you're working with Puppet managed files and policy is often puppet managed And you make changes don't be surprised when puppet changes them back on you. That's there's nothing I can do about that as a policy guy That's just that's just the the painful world we live in but there is documentation about how to customize policy as part of triple o and as part of of OSP, okay, thanks sure You guys just want to hear me place that spoon in and right No, that'll clear the room All right, any more question we got a hand over there. Yes. No, we got two that one right there magic Yeah, it's a little bit complicated because the target as I mentioned The target format varies depending on the service. So Neutron has its own Barricade has its own so for instance right here versus tenant colon network ID Wow, I really butchered that didn't I network colon tenant ID That's what you would expect to see in the JSON in the target So it's really gonna be dependent on which API you're calling what that's gonna look like and this this is new This is like something that we built to support ourselves So we will better document this as we we come up with examples of it but the short of it is the The doc the the targets are usually pretty flat dictionary and so you would just expect to see JSON in there, which would be project ID colon and then whatever the actual ID is so it's usually a fairly flat dictionary The best way just to read the default policy files and see the references to targets and try to Try to get the target from there Right now Yeah Yes So you remember before the the question was how fragile are they? On the roll side You're probably fine. You're supposed to modify the roll check. That's supposed to be your Your organizational specific part of it. Don't change the scope check. Don't change parts that reference Like the target or stuff like that because chances are you're gonna get it wrong That's really an engineering decision. I would actually like it so that as we split the code that stuff is stuff You couldn't override. I'd really like it so that the policy check was just overriding the the roll part But we're not there yet so the the short of it is You might have something that looks like it runs fine And then you'll just find the workflows fail because you're not providing the right roles Years ago I had this dream of something that was kind of like se Linux in permissive mode to be able to run an open Stack workflow and see what would happen and then you just say everything passes, but this would have failed We don't have that. We might build that Sunday, but we don't have that yet Okay, but in general if you're not getting stack traces at least, you know, your policies valid Syntactically and stuff like that you should be okay and then test like everything, you know Not just the the checks that I had before you should always do this in a you know a scale up Cluster and have you know have workflows that check the policy you just changed before you deploy into production Something like tempest something like tempest. Yeah One other question. Yes, I'm is there a master list of what variables are defined per service So you have the tenant ID checking network colon tenant ID. Is that is that documented anywhere? Where the which ones are defined up? It is not documented, but It is people are trying to standardize it so on some services it started to varize. So now we try to pass the Context so at some point if we manage to pull it off, it'll be the same for all services I don't really want you touching that Seriously, I mean Yeah, you you you can go in there and do unspeakable things if you want and there's there might be some good reasons for that in General if you look at the API documentation for the API that you're doing and that's one of the reasons why I showed This because you need to figure out. Hey, what is the API for the policy? I'm modifying so say you want to modify The OS attach interfaces you need to know that hey I can go to the documentation for know over here if you expand that out It will show you the the response objects and typically those targets are those response objects There are the objects coming out of the database in a format. They might be nested one level deeper in the In the in the Oslo, I mean in the documentation might have a compute at the front of it That you don't need but it's going to be in that format Okay, awesome. Yeah, okay. We're at 1421. There's another question And there's one last question Yeah, that's why I pointed this out at the bottom. That's exactly what I was doing you run it first and Cash it right you run it before you make any changes And cash it and sort it before you cash it because you're gonna want to check it sorted and then make changes and then diff That's the workflow We don't have a cash version of what it would look like because to be honest with you if you start varying up the Roles that you have and the targets that you want to do this against you're gonna far exceed what what we could provide Okay, but that's that is that should be the answer to your question. This is how you generate those Okay Any other questions any other answers go away


The oil prices steadied on Wednesday after four days of declines. This comes as investors remain worried about the outlook for fuel demand as the use of rail, air and other forms of transport remained constrained amid surge in COVID-19 cases worldwide. Brent crude was up 70 cents or 1% at $69.73 a barrel. US oil gains 54 cents and financial markets overall are turning SAR in response to the Delta variant's progress, softer US economic data and a solemn reflection on the Afghanistan crisis.


Fy oeddaf yn gweithio i chi i'r tynnol yn gweithio i'r ydyn nhw'n trafodol mewn dynol, o'i'r gweithio i'r ddefnyddio yn gyflwyneb yn ymwyaf. Mae'r ffrindiau yma yn ystafell, a'u'r hunain i chi'n gwneud ymwysig yma, yng Nghymru i'r Prifysgyn ni, Ifmwyfwysig Ymwyfwysig Ymwyfwysig Ymwyfwysig, Julia Soufriad Denco. We have with us also Congresswoman from Missouri, Second District Anne Wagner. We also have with us today Eric Cantor, who will be familiar to many of you from his long and distinguished career in Congress. He's now the vice-chairman and managing director of Mullison company USA. Bringing up the far left-hand side, we have John Morrison, CEO of the Institute for Human Rights and Business, ar gyfer y Gweithreit yma, mae genny oedd y rhan sydd y ryddion hynny ar gyfer y panel a gwybolaeth i gweithio. Rwy'n urch yn gwirio ar ardi, buddial indicatedr a'u lliffer yng Nghaerdydd, ei wneud y pethau sydd eu gwirio ar yr ysgwrdd yn ben sy'n gweithio ar godisiwn ym 40-odd ym 45 munud. Felly, ddwych i ddwy i fod, fynd i yn ei gweithio y Prifeddeu Cymru sy'n lawer o mwyaf i fynd ymLews â'r rharnau y Llywodraeth ymlaen yn yr Unedol? Thank you, First I would like to start, my speech was a words of thankful and to express my gratitude to all those countries to all those people that support Ukraine during this dramatic times. For, we are really grateful for this one who supports and put Ukrainian lives, know about economic and political benefits from Russia sy'n gwneud i Gwydr Basicallyn i gyd yn fwy o'ch gilydd ym economiaeth i Rysod, ond dyma'n gwneud cyhoedd gyda'r mwrdd cyhoedd eich lle i Gwydr Ystafell ar gyflogon i ddweudio Ilywyr o'r Llywodraeth i Gwydr I mean food, energy, resources, now it's treat the world with a world hunger, so that's why I think the action are intentional and sanction against Russia, there should be reaction on its weaponizing of everything. In general economic sanction used in the modern world like tools of pressure and in 2014 our partners they applied sanction against Russia but now we understand that it was not successfully and fully enough, that's for sure.  So that's why there is definitely no time for cost and benefit analysis, so we just need to cut Russia from the civilized world entirely. This is our main message that I would like to speak about and we appreciate the sanction that was applied by our partners but let's look at the number, let's look at the situation in general. If you look at the forecast of Russian economy you will look at that according to consensus analysis that Russian economy is going to be I think shrink by 10% of GDP till the year. But if you compare it with situation in Ukraine because it's also you know we have military front and we have economic front right now. If you look at the hour forecast I think the economy of Ukraine will be shrink by at least 30% of GDP till the end of the year. So that's why it means that we need your support more and we need more full scale sanction against Russia because economic front is not least front and you know army wins battles but economy wins wars. That's why we need your fully economic support to win in this war. So I think that together we need more support for Ukraine and more sanction against Russia. So even right now in Davos we don't have Russian delegation and I think that they should not be the part of global conversation and they should not be the part of global economy. And I think that it's time to unite the world and I think I also would like to mention you know China and India as well. They also should also provide sanction against Russia. The economic front actually even more complicated than the military front. For example there are huge efforts is made by our partners to provide the 6th package of sanction against Russia on oil and gas but in parallel there are some European companies that are opening account for paying for Russian gas. So that's why Russia capitalized in this case. Russia capitalized right now even on food crisis. Our black sea ports are fully blocked and that's why it's also another message I would like to send to you. We need your help to unblock the sea ports. Yes because even on right now Russia capitalized on food and you know the price for wheat even higher than what was previous at the previous years. So it means that it's a paradox that should be fixed. It means that sanction is not good enough. It's a paradox but we can fix it together with you. Last and not the least you know many companies announced that they leave Russian markets. There was many press release for this company but the real situation is following. So they announced but they still operating on Russian market and they have time to adopt to this sanction. That's why it means that we should think about the secondary sanction. How we can block it to block any circumventions. So that's why I think the government should be more proactive in increasing in enlarging sanction against Russian secondary sanction and the ordinary sanction. And the final remarks I would like to speak about it of course frozen Russian assets. It's time for Ukraine right now to think about recovery plan. All the recovery and possible recovery we have this frozen assets all around the world and we need to find a clear procedure and clear solution. How to send this money for this frozen assets on the reconstruction of Ukraine. And that's why I think it's also another item I would like to rise during this discussion and listen to your ideas and think how we can together find against this invasion as we understand that it's real full scale war. It's not a conflict and it influence all countries. That's why I think that to solve this problem we can just all together buy support in Ukraine, economic fund of Ukraine and by increasing sanction against Russia. Thank you so much that phrase. It's not a conflict it's a real full scale war is going to resonate with me and it would be great to get your response. America has been leading on the sanctions charge and to get the view from Congress is invaluable at this stage. Thank you. I appreciate it very much. Wonderful to be with the Deputy Prime Minister and Minister of Economics in Ukraine with my distinguished colleagues. I had the pleasure of serving with Eric Cantor for a number of years. And most of all welcome and thanks to all of you who got up bright and early to be here. I serve on the House Foreign Affairs Committee, number two ranking Republican and on the House Financial Services Committee. So we've had a lot of integration, especially vis-a-vis OFAC and others in terms of imposing sanctions. It was one of the very first delegations five days into the war that went to Poland and to the border of Ukraine with colleagues on a bipartisan basis speaking as one America. And I'm part of a delegation now that just left Moldova, okay, and are here and then on to two other stops. And this is a very top issue here. And I can tell you sanctions I believe are a critical tool in restraining the ambitious and destructive impulses of adversary states. They are very difficult to craft and to implement, let me just say. And using our economic tools effectively require a very clear, I think, and oops, pardon me, consistent message. Ironclad commitment to long-term implementation and an exhaustive attention to detail. Oh, I'm going to lose all my pages here to detail. But that just because they're difficult does not mean that we should not try. For example, genocide, nuclear proliferation are invading a sovereign state or country without reason or provocation are egregious effrons to the international order. And it is appropriate and it is right that states should work together to impose costs on those who would commit such crimes. Our post-war international system, which is founded on the rule of law and respect for universal human rights, benefits all of us, I think. But it requires active defense. Economic sanctions are an essential part of our efforts to safeguard international security. I should say the sanctions must be used to bring about a positive change in behavior. I believe that they are a tactic, not a strategy. And I will say that sanctions against Russia on the part of the United States of America and others, I wish that our administration had worked sooner. We saw the buildup of 190,000 troops on the border. I believe they could have been used to perhaps stop the aggression, the invasion, the now full-on war that we are seeing in Ukraine now. So, find that they're in place now. We should unify together. But I believe they should have been started much, much earlier. And I'd like to focus a little bit on the oligarchs. And you talked a little bit about the assets. And not enough has been done to impose pain, I don't believe, on Russia's elite. They are fully complicit in Russia's regime. And Western countries should coordinate to maximize the economic pressure on oligarchs and their families. The United States House of Representatives in Congress has passed legislation that the U.S. for them to be able to seize, okay, seize, not just freeze, but to seize those assets and use a proceeds to support everything from humanitarian assistance for Ukraine to military support also. So, and it's in time we hope the rebuilding. The Russian elite must understand that continued support for Putin is no longer in their interest. Next, I think we have to work together to end Europe's reliance on Russia, to enable tougher sanctions. I called for a U.S. ban on Russian energy imports for months. And I believe this was extremely important move to demonstrate to our partners that we have the will to follow through on economic sanctions on Russia in the long term. And now we need to accelerate Europe's efforts to transition away from Russian energy. They still have massive dependence on Russian energy and we should be working overtime to help our partners open up new sources. And I would hope that the United States of America could be very much a part of that in terms of unleashing our American energy supply in independence. I believe we're the Saudi Arabia of LNG and we should be selling it to Europe. It's 41% cleaner and these are the kinds of sources that I think are very important and it would be a cut off of a very important revenue source for Putin. We've got to make the sanctions airtight and impose tough penalties. And secondary sanctions I do believe are now in order. So those that aid the Russian effort by circumventing these sanctions, we must work in close coordination with our partners to identify and punish the sanction evaders and that is what I'm talking about now. And they should also be fully, not partially, not partially cut off from SWIFT. Last I would say that we must set up the political pressure on Russia also and the US and our allies have let me punishing sanctions. And I would say there they are costing an immense cost to Moscow but they need to be diplomatic costs as well. And that means leaving Russian officials and government literally from the outside looking in. I just passed a piece of legislation through the US House of Representatives. I hope that it will be moving swiftly through the Senate which is called the Isolate Russian Government Officials Act that would bar their attendance from the G20, the Bank of International Settlements, the Basel Committee for Banking Standards, the Financial Stability Board, the International Association of Insurance Supervisors and the International Organization of Securities Commissions. I think that benefiting from these international and participating in these organizations including the ones in my bill calls for a basic level of commitment to our international order. And unleasing and launching is illegal and unilateral, unprovoked, unwarranted attack on Ukraine was Holy Putin's choice and his alone. So it's a choice now to bring Russia back into the fold, the International Committee community, by ending this war. That is the only way you should be allowed back in. And I look forward to working with you and our world partners to come together to make sure that these sanctions continue to be imposed. Go after the oligarchs, make sure that there's some energy independence, secondary sanctions I believe are in order and I want them isolated diplomatically and the world community must continue to pull together. So I thank you. Thank you so much for that overview of the view from the United States and for raising the issue of Europe to which I think we will have to return in the next round if you like. Eric, on this panel you are I think the eldest statesman in the room, spry as you are. And one of the sets of sanctions moves that America was involved in at your period in Congress was Iran. So what lessons do you see from that experience for our current situation? And we're saying that she wished that we'd moved sooner. Is that a lesson that you draw to? Well Adam, first of all thank you for having us and for everyone for being here. And I know you've written extensively on sanctions and have always said that we've got to bear in mind what the purpose of sanctions are. And I think it's relevant to the Iran discussion. But first I want to, as we used to say in the House, associate myself with the remarks of the general lady from Missouri that as usual I'm very much in sync with Anne Wagner and what she's saying as far as what the US position should be in support of Ukraine. But let me get to the question about Iran and then bring in what you have written I think a little bit from my take on what you've written about. And then number one the sanctions, the purpose of sanctions can be either deterrence, they can serve as punishment and they can also serve as rehabilitation which is like a change of behavior. In the case of Iran I think those would say that there may be a mixed bag on that. As you know we've been through successive rounds of sanctions first imposed by President Obama and his administration when he embarked upon the discussions with the regime in Tehran in search of this agreement, the JCPOA, the Joint Comprehensive Plan of Action. There was a lot of consternation especially on the Republicans part in the Congress at the time when I was serving as leader was very much in opposition to that because we felt at the time that sanctions were actually working vis-à-vis Iran. And I think there are three reasons why those sanctions were working. One, there was multilateral support and there was a lot of work that were being done to give the credit where it was doing, the administration at the time to bring along our allies in basically blacklisting Tehran, its oil and gas exports and really trying to focus on getting a change of behavior. And it was very clear, that's the second piece, is what is the off-ramp, what are the reasons for the sanctions and how does the country get out from under these sanctions. And I do think at the time we're very clear about that as well. We wanted them to stop their pursuit of a nuclear weapons program and there were other things that I felt some of us wanted to see as a part of those sanctions as well about its maligned behavior in the Middle East, in the region with its proxies. But yet I do think they were very clear and then thirdly there was a mindfulness if you will about the stacking or the repetitiveness of sanctions. And at this point, after the Trump administration came in as you know and withdrew the United States unilaterally from the JCPOA, we put on even more sanctions. And I think at this point there are over 1600 sanctions against individuals and entities in Iran. And now we're sort of back at a point where I'm not so sure there's going to be success. I doubt there will be success in arriving again at JCPOA. I was never in support of it before. I'm not in support of it now. I just think that the behavior by the regime in Iran will not change. And so the question now is are those sanctions working? Well you can certainly see they punished the economy. I mean their inflation is running at 42%. Their currency I think has been halved in value in the last several years. Certainly their oil production is severely down although just as with the case in Russia the increase in price of the commodity has allowed that regime in Iran to recover some of its revenues because of the increase in prices and frankly their ability to evade sanctions. So when we looked to and where the Deputy Prime Minister talked about the need for enhanced sanctions here in the case of Russia, I'm for whatever we can to just tighten the vice. However I do think we've got to go back to those cardinal rules. We've got to have multilateral support. We are accused in the United States of weaponizing the dollar through these sanctions. And I'm mindful of that and I think we need to have a lot of discretion when we are using the tools that come with the reserve currency of the world. Because every time we use it even our allies and our friends start to wonder why is it that you can do this and how are we going to make sure we don't become subject to those sanctions. So I do think multilateral support, I think clear definition as to what these sanctions are for and how you get an off ramp and we've got a problem with this, this off ramp. Because just recently our Secretary of Defense Austin, our Secretary of State Blinken in the region and they talked about now we're not just trying to save Ukraine, we're going to win this war now. That's the goal. Now what does that mean? And we've got to tie that back in with the sanctions. And then lastly on the Prime Minister's comments about secondary sanctions, those are in place in Iran and the holistic set of sanctions on Iran been pretty effective in trying to impose those and enforce those. The problem is as we know now US-China relationship is very tense right now. What is the situation with China and others in terms of supporting these kind of secondary sanctions? If you look at the votes in the UN that went from condemnation of Russia back to pulling Russia and ejecting them from the Commission on Human Rights, there were like 58 votes that pulled away from that vote, which seems to me we may not get that multilateral support of secondary sanctions. So I don't want to make sanctions something that don't work and are not an effective tool so we'll have to work on that piece too. Thank you Eric, that was extraordinarily illuminating. Both I think in focusing on this question of, let's not call it the off ramp, but the end goal and the conditionality and what in fact the aim is. I think Deputy Prime Minister, you were very clear. We want this war to end. We need the aggression to cease. We need Russia to roll back. But also frankly speaking about the degree of politicization of this issue in the United States and this is a very interesting contrast between the extreme polarization over Iran between the parties and the extraordinary degree of unanimity that we're now seeing in Congress on Ukraine so far. Although Anne will tell you there are 57 members of the House of Representatives in our party that voted against the latest package and 11 members of the Republicans out of 50 in the Senate that just voted against. So I'm not sure that unity will last. John, on that fascinating moment, come on in. I mean what's really interesting and we're great to get from you is the sense also of the role of the private sector here because that's really your Metier, the business human rights dimension. And self-sanctioning by firms has been a big element of the story. Big element, yes. Sanctions bleeding into boycotts I guess. I mean first of all to associate myself I think is the term we're using with the Deputy Prime Minister. I mean as a human rights organization we stand with Ukraine, we stand with civil society in Ukraine, with human rights defenders in Ukraine. And I just want to say that unambiguously that there's an act of a complete breakdown I would say in the norms of the society in the world in which we want to live. But we are talking about economic warfare. Let's be clear. The Deputy Prime Minister said Russia uses its leverage like a weapon. We're having a discussion about how the West should use its leverage like a weapon. And the difference between economic warfare and warfare on the ground where you have the Geneva Conventions developed in this country 150, 200 years ago is there are no rules when it comes to economic warfare as we're hearing.  And I remember Iran, I remember Sudan, I even remember the McBride principles for Northern Ireland, I'm that old. And there's an element of us trying to find those rules and those benchmarks each time something comes along. And it's very important we do learn from the past and I'm going to try and take the long view here. You asked me Adam to think about it from the perspective of business. Well I think for business, business should see this in three buckets perhaps and the buckets are not watertight but they're associated with each other. First is in Ukraine itself. It makes a big difference as to whether you're in free Ukraine, occupied Ukraine or in areas of conflict. You have the Geneva Conventions which I've mentioned, humanitarian law and other things to consider if you're in Ukraine itself. The second bucket is individual sanctions and acknowledging McNitsky and everything that's developed over the past few years. A lot of work has gone in to create a sanctions regime around individuals that is clearly stated in human rights terms. That's very, very important. So we should build on that even in the context of the urgency of the moment. And then the third bucket is this broad-based sanctions around particular business sectors. And what I'm seeing also on some boards and some companies is withdrawal even above the requirements of sanctions. Companies are moving before they're being asked to move. Now the third thing really then to say is we need to gather the evidence. And it's very important and I acknowledge the work around war crimes research that the government is doing at the moment. And the first trial that's already underway in Ukraine now. That we get the facts, we document the abuses, the genocide, the international criminal violations that have taken place in the country. We need to create an evidence base for what our economic measures. But we're having over recent weeks in the Congress and all around the world, particularly in the West. Big discussions now around what it means to target individuals versus whole populations. Who are the real violators? Who are the innocent? Are there any innocent in the context of Russia? Gross violations versus serious violations? And essential goods and services, medicines and food, should they be exempt from sanction regimes? Now the short term I think is a clearer, the long term consequences of where we're going are less clear. A lot of this is trade distorting. Are we actually talking if we think about all of these measures and everything that's happening about the end of global free trade in the way we've discussed over the past 30 years at Davos and elsewhere? These broad-based sanctions, when do they become boycotts? When do we elaborate these rules of the road that boards and companies can use to decide when there's a fact-based approach to withdrawing from the Russian market? So I'll just end by saying three things. And I think Eric, you've said some of these things already. Be precise, the first thing. Be really precise. State the objectives, whether you're a government or a business, as to why you're disengaging from the Russian market. Sight your rationale within international law. Human rights, corruption. Be very clear about why you're doing it. The second is to measure and evaluate. Beware of unattended consequences. And Eric, you've mentioned the diminishment of leverage over time in the context of Iran possibly. How do we know in the medium to long term that the path we're walking down is actually having the purpose we intended? Magnitsky, again, allows us to measure the consequences in the terms of specific individuals. Broad-based sanctions, you're measuring the impact on a whole population. Beware of unintended consequences. And third for boards, for corporate boards. And today we launched a report for boards in terms of their impacts on affected stakeholders. Whatever your decision, make sure that you put at the centre the impact on the human being. So if you're withdrawing from the Russian market, make sure you're doing so responsibly. Responsible exit and responsible entry are key factors here in the discussion. Cutting and running, leaving staff and others in harm's way is no way to behave. So responsibility comes, whatever your decision. Thank you. Thank you, John. I'm not so far getting much flow of questions on the, not the gadget, the Slido gadget. So if you do have questions, please start winding them up. I see a range here. I'm tempted to just put one to First Deputy Prime Minister. And it's, I think, the question that hangs in the room in a meeting that we are having in Europe. And it's uncomfortable perhaps to talk about because we don't have a representative of the EU or in fact of Europe up on the panel here, but it's impossible, I think, to avoid the question. If we go beyond the formalities of cutting Russia out of the international system, if we're talking about concretely depriving them of access to the bit of the world economy that matters most, it is the European energy market that's decisive. And I don't know whether you feel free at this point to say something on that score, but I think it would be very good to get the message from Keith this morning on that issue that is being debated all over the continent. So I think actually it's essential for us. And there is no other answer than that we are insisting on providing sanction. It's, I know that I think the most old countries in the EU are prepared this second package of sanction. And there are, you know, discussion, very, very discussion inside. But we insist that this package should be implemented otherwise there won't be, you know, we're discussing, we have, you know, very complicated discussion and there is going to be some complex question, I think, in this audience. But the question is we will understand that sanction works just in case if this invasion will stop. Otherwise there is no sense to discuss this partial sanction like swift or partial sanction on ban of oil and gas. If the war is continuous, it means that sanction does not work at all. That's why we insist on the decision from EU side. We understand that it, I know from their side, they try to estimate how costly it's going to be for their economy. But from other side there is Ukraine. We're sitting in a good audience with you in a good room and in parallel there is war landscape. It's a real war and Ukraine economy loses every day and we lose our people. That's why I think that there is no other answer than EU should launch the second package of sanction and to ban the possibility to purchase oil and gas from Russia. Thank you for that. If I could add on to that because it is important. In short, our adversaries and certainly in this case Putin and those that we're targeting must understand that we are not bluffing in this. And the multilateral concept of everyone pulling together in this is absolutely key. We must have a commitment to impose severe cost to those who threaten our international stability and security. So messaging is important. It is, but the coming together is important. And as I said, in terms of energy, I mean it's tough. We look at the swift sanctions that are out there, but you look at those that are not included in that. Schwer rank or Gazprom. This must be a very holistic thing and we must find other sources for Europe. I believe the U.S. would be a wonderful source for LNG and for energy to Europe. So I offer that once again. I've got a gentleman here with glasses. Ken Roth from Human Rights Watch. I wanted to pick up on John's comments because I think it's very important that we distinguish between the Russian government, the Kremlin, the military on the one hand, and the Russian people on the other. Because if you look at what's going to stop the atrocities, what's going to stop the invasion, arguably the Russian people are the most important. And despite the censorship, despite the disinformation, despite the 15-year prison terms threatened, there have been anti-war demonstrations in 150 cities across Russia. Putin is terrified of the possibility of a color revolution. And so it's important with the sanctions messaging and the reality to make clear that the Russian people are not the targets. Because we want them to see that they can join with this anti atrocity, anti-war message. Second quick point is that the most targeted sanction is prosecution. And the most effective institution here is the International Criminal Court. Now, the U.S. government traditionally has said the International Criminal Court cannot prosecute anybody even on the territory like Ukraine, which is accepted at the court, if the war crimes suspect, if his or her country has not joined the ICC. Now, Biden has changed that with respect to Ukraine, said it's okay to prosecute Russians even though Russia has not joined the ICC. But legislation in the U.S. is still precluding full U.S. cooperation with the International Criminal Court. And I hope, Representative Wagner, that you will join with current legislative efforts to allow full U.S. cooperation with the International Criminal Court even though theoretically the ICC at some point could prosecute an American or prosecute an Israeli. Those are not good enough reasons to block cooperation with the ICC today on Ukraine. Thank you very much, Ken, for that very pointed intervention. Could I ask whether or not, Deputy Prime Minister, you accept that distinction between the government and the people in Russia? Is that a logic that you follow in Kiev in your understanding of how these sanctions should work? Cos it's a classic, liberal version, it's an argument that goes all the way back to the sanctioning of Iraq, at least, and if not before. It relies on focusing on oligarchs as one of the main mechanisms or the political leadership. Is that, from your experience, as a country at war, a meaningful distinction at this point? We have in this room our deputies from Kiev and they write their hand and they would like to answer that question, Yulia Clyman, if you don't mind. No, I'm Yulia Clyman, co-member of parliament of Ukraine, and I would like to answer this question. When you're saying about the difference between Russian nation, which is destroyed by Putin, by himself, and Russian-Kremlin government, tell me the soldier that raped two years old kid. He is Russian or not? Yes, he is Russian, and he is a part of Russian nation. And the Russian nation should be responsible for the Kremlin that they actually elected and they are supporting. 75% of Russian supporting the murders of Ukraine. What we are talking about here. About what values economic development and growth in Europe we are talking about, if we allow 75%, it's an official post. It's not, I'm not taking it from my head, except and actually proof and they, how to say it, even agree with the killing of Ukrainians. This nation, unfortunately, will be destroyed by his own government and his own president by Putin. We are not destroying Russians, they are destroying themselves, and they will do it by the end, unfortunately. And we will fight by the end. Thank you very much for that powerful statement, which I think exposes a really quite fundamental conflict here. I would love to get your reaction and to the issue of the ISIS. I will say this, that the culpability, resqueryly unexclusively, especially in the case of Russian-Ukraine, and with other targets, with the regimes that would see their citizens suffer rather than risk the development of connections between the people in the outside world. We do these in a comprehensive plan to ensure humanitarian efforts are also out there, but they continue to be impeded. Putin is a man that is not only is bombing hospitals and schools and citizens, he has blocked the humanitarian corridors. It is unheard of in a war of this sort, to block those kinds of corridors. The war crimes are absolutely, I think, key, and I think it is often times, sadly, authoritarian regimes that will compound the pain of their people in denying them that kind of access. We look forward to seeing, I think, the first, we saw the first warm crime prosecution just maybe this past week, is that correct? Gentleman, yes. I'm going to take two questions bundled, so I'll come forward to the lady in Herigmong. Professor Tucson, resisting the temptation to ask you the question, because it's a question about the financial impact of the sanctions. Do we know how useful are the euros and the dollars the Russians are getting for European energy? Because as we know, the central bank cannot handle that money, so do we suspect, do we have reason to believe that Russia is creating slush funds, or is it useful to receive those euros and dollars just to stabilise the foreign exchange and avoid hyperinflation? I think this goes to the bottom line whether or not we should pass sanctions on the energy. Thank you. Thank you so much. I just want to talk about sanctions and take a step back and thank you for raising Iraq. I'm originally from Iraq. I wanted to ask about sanctions on Iraq. Iraq withdrew from Kuwait and the sanctions continued from 1991 to 2003, and the Saddam Hussein regime was removed by an American-led invasion. What lessons have we learned from how sanctions were used in Iraq and was that a strategy or a tactic? What benefit was it to the eventual end of changing character in how Iraq acted? And when we talk about, of course, the impact on international law and order and peace and security, what you think the impact of the 2003 decision in Iraq had on some of the dimensions we're seeing now with the Ukraine invasion? Thank you so much. I'm going to bring one more in Riccardo House by the front here, then we'll wrap and we've got an eye on the time here. Thank you for the fascinating panel. Thank you for your words and your courage. I have a question regarding energy sanctions. The world obviously is undergoing a period of high oil prices and people are concerned about energy security, energy affordability. On the other hand, Europe has been hesitant about being more aggressive and they've postponed, say, adjustment for some future, but the war is now, it's not in the future. You want to have an impact now, not later. So I have argued that the most effective way to sanction Russia is not to embargo its oil but to tax it. Russian oil needs to compete with oil from other parts that's not taxed, so they will have to eat the tax. And it shouldn't wait that it's just a matter of imposing a tax on Russian oil and to use that money for many good things, for the reconstruction of Ukraine, for helping the Ukrainian refugees, for many, for helping Ukraine defence. So just tax the oil and tax it now. I must say that I read recently in Reuters that Secretary Yellen was pushing for that idea in the G7, but I think that it should be put on the table. Tax, Russian oil now. Thank you. Can I ask, is that an option that would be attractive to Kyve as a solution? It has, on the one hand, a revenue-raising element. It has, on the other hand, a rather liberal feel in the sense that if you still wanted to buy Russian oil, you could. And it would be the Russians that paid the penalty. Does that do the work that you would like to see from sanctions at this point? Actually, I absolutely agree that for us, for sanctions, it's important to have impact right now. And we have our internal discussion, and we also consider this possibility to have double extra taxation on the Russian oil and gas. But from Kyve's point of view, from an official point of view, so I think that's number one, it's Ben, the expert of oil and gas. So it's our answer. We also have representatives of Nandegas, the CEO of Nandegas also, I think that he can comment, Yuri Vityanka, if you don't mind. Excellent, sorry. Just speak loud. Just speak and that's all. And a special duty, and again some kind of escrow count mechanism that can be implemented through financial sanctions, and I will explain what I mean. So there are countries that can afford the moment to implement a full embargo. For example, even like Germany, in terms of oil, they're saying, look, now we're ready for a full embargo on oil, but we're not ready for a full embargo of a Russian pipeline gas, for example. People will freeze. Hungary is saying, look, we're not ready for an embargo on Russian oil because, again, that's the only source of oil we can get because we don't have a seaport. So they can be a combination when, for example, some countries are saying, look, there is a full embargo, not some countries, we're saying as general rule is a full embargo. Then there are some exemptions as a transitional arrangement for those countries who cannot implement a full embargo right now. They have to use a special duty for, for example, pipeline oil, for pipeline gas, where it's really like the critical dependence. We will also test, by the way, if they are sincere about saying that they have a critical dependence, because maybe with a special duty we will all see that Russian oil is not just competitive, for example, in Hungary. So maybe some Hungarian firms, they just want a free ride, again, on this huge discount, for example, to Russian oil that we see at the moment. A similar situation, for example, with escrow count mechanism. We can say that even if you are buying Russian oil and gas, you cannot transfer all the money to Putin's regime. So at least some part of this money should be frozen, seized, again, it's a different story where there can be options, basically. But at least we should deprive Putin regime of these billions of dollars he is getting every day from Europe to finance this barbaric war. Thank you so much. Because when people are arguing about different options, it's an excuse for them to do nothing. That's exactly what is happening in the moment. We could spend all morning talking. We've had an incredibly rich and complex discussion this morning. We're out of time, but I feel it's entirely appropriate to leave the last word this morning to the Ukrainian voice. And so I'll ask you to thank all the contributors to this wonderful panel to join me in a round of applause. Thank you for being here. Thanks very much.


en it took over and I was elected our water department budget that year was $200,000. And the water department budget for 2022 was $1,307,990 that Bill had a million dollar capital outlay in there, which I'm not sure what that was meant to be. Well, that would have been $600,000 from the alpha funds that we've come to act in. We were able to build that. And then $400,000 for the other projects that we've got permits for and everything that we're waiting for funding from the state. Next. And the main street reconstruction that we waited so long for replaced the eight inch cast iron pipe that was very, that was installed in 1890 cent in the hand and trench. And it was in continuous use for 128 years. We replace it with a 12 inch pipe which is going to enhance fire flows and service. And the trustees back then and at the suggestion of Tom Nesbitt and things that the state couldn't prove they owned right away for what was the Lewinsky turn pipe, which is what route two is and the village couldn't prove it. So we click playing to any right away that the village property owners had that these utilities were in our right away so that then the state and the federal government paid to replace the utilities, the water, the sewer lines and the storm drains and things. Thus saving us the cost of replacing these bill and put in the refund report was over $5 million. Pretty close to $5 million in construction costs plus engineering that we say that that last improvement pretty much completes the upgrade of all the transmission and distribution system of the water system since 88. So it's in pretty good shape. Thanks, next. Some of the priorities EFUD is working on that we have a tenants line from Blush Hill Reservoir that we'd like to replace. We're working on restructuring the water rates so that everyone is built on the same basis, business and residential units and things. Some of the state rules have changed that got water consumption and things at different levels. We're hoping to change the ownership of the pipes and hybrids and the guts for a more sound system. We thought that was going to be more of a project before but it looks like it's pretty simple with them doing it. We need to work on multiple use regulations for the watershed, the hikers and the bikers and things up in the watershed to protect. And we're also looking at options to install a transmission line from Howard Avenue to the development in the area of Cabot, Annex, the East Wind, Mobile Home Park and a new Ivy computer building over on wood 100 to give them fire protection and then a water supply. The estimated cost keeps going up to things today I think where they thought it was around $2 million now. This is showing where that is that it's a potential leading to waterline from Howard Avenue that are going out to the area of East Wind Mobile Home Park where there's all the development of the stores. We've talked to people they're interested in kind of connecting up if we get the water out there but it is an extensive expansion and it's not something we would have the current users shouldn't pay to extend the waterline to these. So we were hoping they'd be through the grants and things with the uncle money and stuff that there could be helped. We've applied a couple of times potential grants. I think so we're hoping to come up with some money to do that. The Water Ready Village and E-Fund residents I think hold those 18 night officials and engineers for their good design and this system for the water system and the sources today. The manager Bill Shubluck and former public works for the Alex Dusty, Tom Nesbitt, Bill Woodruff and the other elected officials for their efforts and decisions and upgrading the current system. I think this water system is an unnoticed gem of the library that's so important to our future. I think it's one of the best water systems in the state due to its location and the protection of the sources and the generators and the ability to operate in emergencies. I think it's gonna serve many generations to follow us. And I'm pleased to have an opportunity to serve my community. Thank Bill, Woody for always helping collecting facts and pictures to put this together. I hope to use it in other times to share information about the Water Ready Water System. Next. And over the years, I've served a number of times with commissioners, Bob O'Brien, Chuck Badness, Bob Finucke, Ed Steele was a commissioner for short while, Mark Alvagany and Sydney Parks. But I'd like to dedicate this presentation to the memory of Bob O'Brien. I don't know how many of you knew him but he truly loved the Waterbury and was proud of serving his community. He died in his sleep in April, 1995. And Bill and I have talked a number of times about his, he told everything as it was and was a bashful. And people complained about our water range. He said, tell him to don't go away. We heard that many times. And Bob was the first recipient of the Wallace Award posthumously that he was, he sort of recruited me to be a Water Commissioner too. I think we, I owe him a gratitude for his work. I think, he was an 88, a Water Commissioner so it's about seven years or so. Thank you for listening and I appreciate when you turn on the faucet next time where it all comes from, the effort that's been put in to keep the system what it is today. I'll do the sewer system at another time but it's not anywhere near as exciting or as interesting as the water system. It's the other end of the pipe. It depends on where you're at. It depends on where you're at. It's on the tannin scale. You're right into the sewer system right now. You guys have to let us know what the running time and then we'll discuss a little bit more. He project would have been exciting about the sewer system as I am a Water Commissioner. One can't go without the other, right? They do though. They do. The sewer system is not connected to the water system. Simon. Oh, yeah. Oh, yeah. You're so funny. Great. I'm going to let it happen. You should decide that or just go. Yeah. On that note, there are no pressing questions about the water presentation. Take a motion to adjourn.


Preparing the unadjusted trial balance is the fourth step in the accounting cycle. A trial balance is a list of company accounts and their ending ledger balances. Its primary purpose at this step is to make sure that debits equal credits. The trial balance is prepared at the end of the accounting period, as are all of the subsequent steps in the accounting cycle. The trial balance lists accounts in the following order, assets, liabilities, equity, revenues, and expenses. Before we look at how to prepare the trial balance, let's revisit how we arrive at the ending balances in our ledger accounts. Account balances are either debit balances or credit balances. There are no negative balances in accounting. Balances are calculated by totaling the debit side of an account and totaling the credit side of an account. Then subtract the smaller side from the larger. This is the balance on the larger side. An account can have only one balance. In this example, debits are 20,000 and credits are 9,000. So the balance in this account is an $11,000 debit. In this example, debits are 15,000 and credits are 17,000. So the balance in this account is a $2,000 credit. Now here's an example of a trial balance. Notice the account order is assets, liabilities, equity, revenues, and finally expenses. Let's look at the details as to how we arrived at these balances. So in this example, all of the debits totaled $18,300 and all of the credits totaled $10,250. Therefore, the cash account has a debit balance of $8,050. So on the trial balance, we would enter cash as the first account and $8,050 in the debit column. Then we would repeat this process for all of the other accounts that have balances. Normally accounts that have no balances would not appear on the trial balance. Some additional terminology that you should be aware of is the chart of accounts. The chart of accounts are all of the accounts available for use in a company. It is likely that accounts on the chart of accounts may not be used all of the time. The chart of accounts is not the same thing as the trial balance, which are the accounts that are used and have balances. Here is a short example of a chart of accounts. In academia, we identify accounts by their names like cash or service revenue. But in real life and in accounting information systems, accounts are identified by an assigned account number like 100 or 400. So much of what we've covered in this video deals with the trial balance in general. I'd like to identify why this is an unadjusted trial balance. Specifically, other than telling us the balances of our ledger accounts at this time and whether or not our debits equal our credits, the adjusted trial balance doesn't tell us very much. For example, look at the supplies balance. That balance has likely come from the purchase of supplies during the month. However, it may not be the amount of supplies on hand at the end of the month if we've used some of them. So there are limitations to the adjusted trial balance including some transactions may not have been journalized. The correct journal entry might not have been posted. A journal entry may have been entered or posted twice. Incorrect accounts may have been used in the journalizing or posting of transactions. Or offsetting errors are made in the recording of the transactions. In fact, this is why we need to perform the next step in the accounting cycle, adjusting journal entries. So we can adjust the account balances to more accurately reflect the financial position of a company. And that concludes this short video on preparing the unadjusted trial balance.