Even before the Congress I did not know what the Vasanar arrangements are and I learned now it's an international treaty that has some security implications for us and all about that will now tell you Walter, Nate Cardoso, Meredith Patterson and Richard Tynan. Have a warm welcome. Thank you. Just to introduce us briefly, Nate, who's on my far right, is with the Electronic Frontier Foundation, that probably doesn't need any further introduction. Meredith is mostly responsible for the language security, well I call it a cult, but that's apparently not nice to call it. Richard is the chief technologist with Privacy International, this probably does not need much further introduction as well. I'm just a loudmouth who submitted a panel and have been helping out a bit with Fukumi in Brussels. Fukumi is on behalf of CCC involved in this policy area trying to make things less wrong on this topic and basically what we will briefly do is discuss well what the hell is Vasanar to begin with, how much of a problem is it for the IT security community and how we came here and go through this. Basically we were actually not supposed to have a panel to begin with on the program and for that reason we will open up the floor to questions from the audience in about 10 minutes or so. So start thinking about questions to the panelists because it will be kind of a partially a conversation on the stage but also a conversation with this well not necessarily intimate room but hopefully it will be a good conversation. Anyways, Vasanar, what is it? It's a very poor suburb of the Hague, the Netherlands, King of the Netherlands lived there with ghettoish places like you see on screen. It's also a framework between most of the industrialized nations on export controls and weapons technology, mostly conventional weapons and signatories range from basically all the NATO members plus Russia. Most of the former Warsaw Pact countries are also signatories to Vasanar and it is actually technically not a treaty but has a lower status in international law and what it more or less does it sets policies on conventional weapons as well as dual use goods. Until December 2013 that didn't touch much upon IT security issues apart from cryptography, remnant of the past crypto wars which are reheating again but in December 2013 two new elements were introduced as dual use technologies and the first one is surveillance technology and the second one is called intrusion software and to give you an idea of the definitions of these two this is what the definition of surveillance systems is basically anything that can intercept at the at the carry grade IP networks and can target specific selectors and I'm bringing up this definition not because it's such an enjoyable definition to read but from my perspective as someone was interested in the intersection of policy law and technology is it's very fascinating that this this idea of having surveillance technology considered a weapons like technology that is worthy of regulation that we because you don't want to have it fall in the wrong hands like extreme regime etc that in that process there were very funny exceptions made in surveillance technology because if it's for a marketing purpose or for quality of service or quality of experience whatever that may be then all of a sudden it's not deemed to fall in these export regulations and conversely there's the definition of intrusion software any of the following extraction of data or information from a computer or network capable device or the modification of system or user data or the modification of the standard execution path of a program or process in order to allow the execution of externally provided instructions I'm not a techie but having javascript sent from an htp server to a browser does that alter the execution path of the browser I think it does and this may be a bit of a broad definition and to give you an idea why we brought this up now is and is that this arrangement will be translated into legislation on in the signatory countries and I cannot really speak for the US side that will briefly be done by Nate when I'm finished talking about the European side in the European Union you have a regulation that basically copies the list of cover technologies by the wasana arrangement and says if you want to export any of this stuff you must apply to for export permit in your member state and the member states have done some additional rules on that the country where I'm from the Netherlands happens to have a royal decree saying thou shalt not export any of the stuff on the list in the regulation basically meaning what's on the wasana arrangement and otherwise you will be punishable by law that particular European regulation is up to review and that review will also include the updates that have been in the meantime to the wasana arrangement the current EU regulation on this topic is from 2009 and there have been about yearly annual updates of the wasana arrangement so in the upcoming two years there will be a new European regulation that may or may not affect your ability as an IT security expert from Europe to let's say travel to China that we don't even know what the commission actually will be doing on this on this topic but we do know what on the US side of things is happening and for that I refer to night thanks walter so on the US side the bureau of industry and security which is a division of the department of commerce is in charge of implementation of the wasana arrangement in may of this year the department of commerce released its proposed rule its proposed implementation and it was atrocious it was it was a shock to pretty much everyone involved and it caused an enormous amount of fear and uncertainty in the infosite community both in the united states and abroad intrusion software is not actually controlled under the bis implementation only technology and knowledge implementing intrusion software is controlled as well as command and control systems for intrusion software the problem is under the united states definitions of deemed exports in the uk there's a similar concept of intangible knowledge transfer simply talking about something like an exploit could be considered a deemed export and therefore controlled so this is really really really bad so as part of another part of the US implementation is if any of this software contains cryptographic or crypt analytic capability the the person applying for the export license must on demand turn over source code to the national security agency and you can tell who put that little nugget into the US implementation so essentially what it means is that if you're a US researcher it well okay so these rules haven't gone into the effect into effect in the united states but if they do what it will mean is if you're a researcher in the united states or a united states person so someone with citizenship or a green card you have to dump all your odays to the NSA before you can talk about them to anyone else even in private that's problematic to say the least also what the regulations don't do they don't actually stand in the way of someone like hacking team or fin fisher selling their stuff to Ethiopia Bahrain or the Saudis all you need to do is get a license and as we could tell from the hacking team dump getting a global export license under Vasanar is relatively easy so what what do the regulations do they make bug bounties conferences and small teams working on defensive or offensive research next to impossible they make distributing things like metasploit or pen testing tools nearly impossible and they create legal uncertainty for folks doing research on essentially anything interesting if you could get a security paper accepted here at ccc it would not be exportable under Vasanar that's of course a gross oversimplification i began my journey into vasanar when the bis released its proposed rule eff was not closely following vasanar in 2013 when the intrusion software and network surveillance definitions were entered i can speak only for myself but i i regret that fact okay i'm i'm going to have meredith explain a little bit from her perspective as an american living in europe how this makes affect her life but i also will announce that from now on people will want to ask questions to these panelists just just walk through a microphone and and we'll uh from now on the floor is open basically but meredith yeah so i'm originally from texas but i've been living in belgium since 2009 so this actually makes me subject to both the us and e you implementations of uh uh of the vasanar arrangement um the ones that and like uh nat was just saying the ones that are most relevant to me are the deemed export and intangible transfer um regulations which i have to point out i mean those are those are things that like the us and the uk came up with and i guess it was the uk that presented it to the e you because intangible transfer was totally you know the topic of the day um at one of the uh the meetings in brussels on uh on the vasanar implementation that i went to what does intangible transfer mean in practical terms well i mean in practical terms it means that if you have an idea in your head that qualifies as an export you can't cross a border and i don't know how they plan to enforce that oh it's way worse than that uh what it means so i'll i'll give a a discussion i'll you know i'll talk about it in in practical terms open whisper systems is based in san francisco uh it produces signal tech secure uh all those lovely uh things that i have on my device so that i can talk to people here um and if there are people with multiple citizenships even sitting around a conference table in san francisco speaking about it to someone without a us citizenship is a deemed export so you don't even have to cross a border all you have to do is open your mouth to get into trouble with vasanar yeah and so i'm in the situation where you know because of the citizenship i have and the place i live there are two different sets of regulations that can basically constrain me from traveling or from even talking to anybody because i understand the general principle of how to construct exploits from differences in how input handlers parse things that's obviously not the intended result of this but you know it's only one of a lot of side effects that the the the people who wrote this language were clearly not thinking of when they wrote it and that brings us we have now invented a new class of thought crime uh and uh on that happy note i would like to ask richards how we got here um and i'll just follow on with the press your button press your button process uh the um intangible technology transfer um giving lectures and and various things like that are are problematic even if you don't necessarily know who's in the room if they are a foreign citizen they can take it elsewhere and there's also another problem that if you were to go to a company and potentially disclose some of this information in your own jurisdiction but that company had many offices around the world which most companies that that we use products in our everyday lives are based around the world they may actually send on that information internally which may also include crossing a border to various other different teams so that the other the other teams could potentially fix uh the problem in terms of uh the starting point for this uh i i guess it probably started back in 2010 2011 where the goal was to uh limit the spread of uh tools like finfisher or tools with the capabilities of finfisher um to regimes like ethiopia and marocco and various other different places where we see that technology been used um very very uh in a very very nasty manner for journalists and human rights defenders and very often these countries what we've seen is they wouldn't even have the technical capabilities to develop this stuff by themselves and ironically in one of the hacking team dumps the the guys were very very concerned at a particular country's technical skills and their ability to use their tools not that they wouldn't get what they wanted but simply that just by screwing up the use of these tools would actually reveal their use and potentially provide a sample or some material that techies could then use to to counteract them so that was the i guess the starting point and as i understand it uh back at that time vasinar was considered a very uh attractive target you essentially lobby one uh organization who can pitch uh text into the agreement and if it's all agreed by default you get up to 41 different states who who would uh who would follow suit but of course as we've seen the implementation the text the various things like that have not been ideal in fact far from ideal and many of the the not only the technical definitions are not necessarily correct but the the lack of inclusion of factors such as the intention of the individuals when they're exporting this stuff there's no distinction between an export for for example generating new snort rules to detect malware that's uh on people's machines or antivirus signatures or potentially um the disclosure of malware that represents an entire class of new type of attack which would allow much more general safeguards to be put in place like DEP ASL or those kind of things so the the starting point i think was was uh well intentioned and the implementation as we saw has left a lot to be desired and i think it's the question now is whether vasanar itself can capture the nuances of the problem uh to achieve the goal but also to not screw things up royally for the entire internet security and the very infrastructure that we rely on on a daily basis but i do think we also have to look beyond the text of vasanar itself because deemed export and intangible transfer were bolt-ons from you know you know from from the us in the uk so we have to look at the implementation and shepherd that through as well as the text so i would say that the i i totally agree with richie uh in in that the intention was good uh but in in my mind at least the trying trying to make a legalistic definition to separate good software defensive stuff to bad software offensive stuff is a fool's errant the definitional problems overwhelm any possible benefit here uh the chilling effect of a bad definition which is exactly what we have is worse than any of the possible benefits especially because you know as the one of the founders of eff said in 1995 or 1996 uh the net interpret censorship as damage and routes around it right this software isn't magic finfisher and hacking team are barely more functional than vnc i'm exaggerating but you get the point um it's the service and support that actually matter right you can it you can give ethiopia finfisher and the it folk there won't know what to do with it um without the service and support and it's the service and support contracts that actually matter um so take that for what software isn't weaponry right software isn't guns you can't control it in the same way that you can control the export of physical devices so um my in in in my opinion trying to fix the definitions in vasanar um is uh you know i admire people who think they can do it but i don't delude myself to think that i can do it so i think we need to ditch intrusion software from vasanar all together okay we have a first question from the room so uh one important note for the vasanar is um and you haven't mentioned it yet uh open source is is exempt from vasanar well so open source is sometimes kind of exempt uh if you're for the purpose of this discussion it's exempt there really is not a bright line i tried very hard to get um public domain okay public domain is exempt that ain't the same as open source yeah well there's this slight problem to interject here right um when you interpret interpret international treaties per the treaty of yana you're supposed to use the common interpretation of words unlike other legal documents which have created our reality so public domain is no longer necessarily a copyright like like thing there's two problems the vasanar arrangement is not a formal treatment so i don't actually know how to interpret it the second problem is i've been looking for exemptions like that as well i'm nowhere near as much an expert as the other people at this table there are much clearer exemptions for let's say open source or source code availability for the crypto bits but less so for this and i would i would just add to that that while yes in the in the text on on open software the general technology notes and general software notes um open source software as i understand it doesn't isn't always open source at least in the initial embryonic stages and while yes it may become open source later on and we may become in the public domain later on while it's sitting on a laptop of a developer who's yet to commit their their changes into a repository that is open source to the best of my understanding that is still not public domain information that that is still information that resides on the laptop of the individual or individuals who are creating the next version of the particular open source software and this this regime may limit the ability of those individuals to communicate in the formation of the next the better improvements to the open source software and so even things like we've had very conflicting statements from government saying things along the lines of well if you if you're working on something and you intend to present it at a conference at some time in the future well then maybe it's open source but how are we supposed to prove that how are we supposed to demonstrate that when we're working on bits of code and bits of technology not all of them are going to work some of them aren't ever going to see the light of day and it's at that process before things become open source or before things become in the public domain that can actually limit the the ability for people to to conduct their work and and to make matters worse the general software note which is what Richie was discussing is not included in all of the national implementations including the BIS implementation the BIS implementation specifically exempts the general software note exemption. There's another question on the left. So I wanted to share an experience I had in dealing with Vassinar for voice encryption and how it may be related with that. For export of a strong encryption product there are a precise specification whether it fit in the category of a mass encryption tools or whether it's subject to export control and it dictates a very precise rule like if the end user is able to change the encryption algorithm if the end user can acquire directly without and can install without any substantial support from the manufacturer and those are specific kind of details related to the way of deploying and the purpose of the technology for voice encryption the for strong encryption subject to export. So I'm wondering if it will not be useful to think and propose from a policy standpoint of view a set of rules that create the boundaries of what should be subject to export regulation and what should not be subject exactly like strong encryption is already in the provision of Vassinar arrangement. But I would say that it's very very difficult to look at a specific piece of software just the ones and zeros and make a determination on that basis and so without the ability for an agreement such as this or a regime to achieve the stated objective that I said at the start it can't capture things like what you just said about what the the intent of the individual who's going to receive it or what they could do with it and that was expressly or it wasn't included in the intrusion software definition or any of the exemptions in in Vassinar as it was and the transposing legislation into the EU. I mean it's also not always obvious on its face what a piece of software actually does. If you've ever looked at the underhanded C contest there are a lot of examples of software that appears to do one thing but actually does something else. I mean I have I don't think we've seen this as an export controls dodge yet but it's certainly possible. And just to pile on on the crypto front you know it has long been EFF's position that crypto should not be export regulated at all. In the United States we have there's very little regulation on publicly available crypto so open source crypto all you have to do is notify the NSA that you're putting it online you don't actually have to ask for permission. Most people don't even do that and it's not really enforced as far as I understand. And following on from Meredith's point there's a there's a very interesting competition that's held every year and I think based on a Linux vulnerability that was that was found a few years ago where where semicolon was inserted that to any cursory reading of the of the code might indicate that things were hunky-dory but in reality what it allowed was basically anybody to gain root on on the box and it was all in there in in in the open source and there's a competition each year to find new and innovative ways to hide in plain sight essentially issues with software that just a cursory analysis might not actually reveal. We have several people wanting to ask questions over there. Okay so first off thank you so much for this panel it's been very informative. I have two questions that are really tightly related. The first one is coming from a basic knowledge of policy standpoint it seems that if you have an agreement that was presented then there was probably a chain of events like meetings and so on that led to the formation of that agreement and I'm curious is it possible to go through the meeting notes and for who introduced these terms and what the context of the discussions were. The second question that I have how have these kinds of agreements actually been enforced in the past because if this was introduced in 2009 I assume that there were things before them because cryptography is not a new thing. I think the first question is best to be asked to Richie in the second one I'd like to refer to Nate. I also want to note that when asking questions we are very thankful for your gratitude but let's stick to the questions. So I guess the first time and look obviously I may not be aware of the entire picture but the first time Privacy International became aware of the text was almost before days before it was actually completed so to the best of our knowledge there wasn't a consultation process and it's almost a problem with the actual I guess the drafting process that people were involved not only too late but that the potential consequences were huge and they should have been involved at a very very early stage so we didn't have to get to this point that we're in now where the implications are very real I think mostly be aware of HP pulling out of a of a bug bounty contest during the year simply because of the under maybe it was Microsoft account member which company was because there was question marks over whether they could actually have people showing up and presenting bugs and zero days and things like that and what legal regime had did they need to get a an export control license for every country and things like that so there is tangible evidence that this stuff is is stopping things but as far as I'm aware there was no consultation outside of governments who are drafting this and so as that is your second question how are these sorts of agreements enforced the answer on I can only answer I'm a U.S. lawyer I can only answer in United States terms they're enforced by the Department of Commerce and they're enforced sort of very rarely and very selectively so that would be a big problem in the EU because selective enforcement is like you're not allowed to do that in Belgium yeah Belgium being Belgium but that that selective enforcement gives rise to a chilling effect the mere possibility that it could be enforced is often sufficient to trigger the negative consequences that everybody I think here in the audience have which is that you want people to engage actively in in improving things and improving the software that we use and that necessitates in the modern age the ability for people to collaborate across borders and so I'm not necessarily sure whether the fact that it could be enforced people could go to jail which obviously is is a disgrace but the the the chilling effect of people actually engaging in this research in the first place you don't want to be in the receiving and enforcement I've been specifically told the questions from the internet yes thank you I have a bunch of questions regarding open source again in detail what is the expected impact on projects like meta-sploit that's partly open source you know and Kali Linux so meta-sploit the the lawyers over at hacker one not at hacker one at rapid seven have determined that the open source meta-sploit projects and modules there will be no impact on them the meta-sploit pro however is subject to the license so meta-sploit open source just fine keep exporting keep using keep posting meta-sploit pro is going to become a lot more expensive I'm just another question from your backlog of internet questions yes there's one question what is the the detail problem is it that exploits would be more open or is there also a financial aspect in this individuals would be criminally liable for for having exploits basically oh having exploits and crossing the borders or talking about exploits to foreign nationals so hi I'm an academic from the United Kingdom and I was wondering if you could comment on the possibilities of this affecting research particularly and thinking of my own research would be classified under the the very broad definition of surveillance and the follow-up question is what about teaching how am I expected to teach an international group of students in my university without an export license I'm afraid you need an export license if you've got international students in there because when you impart it would be deemed an intangible technology transfer in the sense that the transfer actually occurs in the heads of your students when you've delivered that lecture and they go on to their their countries that would be an intangible technology transfer it's really not clear like they're they're they're not drawing clear lines about what kind of research I mean because because politicians have been have been telling us to our faces oh researchers don't have anything to worry about but they don't tell us why and so when I said and so when I ask okay well why for what reason do I not need to worry about about intangible knowledge transfer you know I just sort of get padded on the head and and they move on to the next question nobody really seems willing to clarify how this is going to how this is actually going to be brought down on research with the exception of Australia Australia apparently seems perfectly happy to just like shut off all crypto teaching in the entire country but you know that's Australia and we've already seen and I'm now forgetting the gentleman's name but we've already seen one doctoral dissertation heavily redacted by the by his committee in the UK because of Vasanar and that's fucked up and the and incidents like that are going to produce continued chilling effects fewer people will get into research because who wants to end up in the situation like that poor guy in the US who who did a geography PhD on maps of critical infrastructure department of homeland security suppressed his thesis if you don't get to graduate that kind of wastes the all that time you spent on a PhD and so like that's fewer people will be coming into the field and people who are already in the field are going to you know are going to have a lot of fear and worry about you know am I about to get busted for trying to publish a paper and I'm also not sure what security research actually is and when security research stops and ends our pen testers security researchers are people who go out and just tinker with software and say reverse engineer bits of bits of code simply because that's what they like doing where they're not affiliated to say an official university are they covered and so many of the many of this opposed protections or exemptions for things like academic material I just it just doesn't make any sense to me about what indeed what what the definition of a security researcher is and whether it includes pen testers and their collaboration cross borders to to to ensure that all their tools are as up to date as possible and I'm in exactly that boat I'm not affiliated with the university and I do not do security for my day job I'm a bog standard programmer at nuance um all of the security stuff I do I do in my copious free time so I wouldn't even be protected by uh protections that only apply to academics well luckily in the u.s. you don't have to worry about that because there is no security but maybe a very short follow-up question here is there any chance to get out of here um claiming that it's freedom of speech so this kind for the academic area so I can give you an answer from the european perspective yeah and they may probably respond from the u.s. perspective um as a kind of groundwork for those poor european countries which don't even have a constitution like the united kingdom um and other kind of backwards monarch monarchy is like the Netherlands and all that the the european convention for human rights is kind of actually the real constitution and the article 10 says that freedom of expression shouldn't shall not be well I'm paraphrasing I'm not crossing with you but it shall not be this shall not be prior restraint unless by law and proportionate to the public interest for which that law is brought into being so there's no evident cut off there why you could or could not have that we already do have the cybercrime convention which has equally chilling well not equally but also chilling effects and security issues it has never been challenged in that court as far as I'm aware so uh but it's a very good question basically can we fix this and after nate covers the the first amendment issues I'd like to move on to that bit thank you I'll just follow on with what was that there freedom of expression at least as you said in the UK in the EU is what's called a qualified right like privacy is and the qualification is based on law but many times freedom of expression uh can or can be compelled to yield to privacy rights of individuals so for example would my doctor be able to engage their freedom of expression rights to breach confidentiality and publish information and should I be able to prevent that from happening so not only is there a balancing act between freedom of expression and the general legal regime in a country freedom of expression and privacy very often can collide in in in the real world from a US legal perspective if these if the proposed implementation went into effect I would love to take the case that would bring it down um one of EFF's first major cases was Bernstein which you probably know better as djb versus United States Department of Justice and we got uh code declared as speech which was good and we got uh cryptography pulled out of the United States munitions list and into a much lower level of export control um so I I think that in at least under US law at least for open source software um even if it wasn't publicly available even if it wasn't public domain I think you would have a very very good argument uh that the regulations would fail under the First Amendment and then there's another thing under the under the United States Constitution which is if a criminal law and all of these export controls are criminal is not readily understandable by a person of average education and intelligence then it fails it's the doctrine is called void for vagueness um so I would say that this would fail as void I'm not sure about this far from registering the church of the weird machines is an actual church in the United States and then we get freedom of religion into the mix amen brother oh please do so I must emphasize that I'm not aware of any European jurisdiction that has such a lovely concept as void for vagueness yes definitely no I don't think any of European countries have such an exception basically if you don't understand the law it's still your problem I blame France um well yeah that's not blame the French for everything I think there's some there's some jurisdictions which have the phrase that ignorance of the law is no excuse yeah and I think that unfortunately might be operative in in many of those situations but since you're speaking how fixable is this um well so if we look at some of the the objectives that were were set out uh at the start in terms of the the very well intentioned very well um kind of you know there was a there was a very bad problem there to be fixed there are a number of of potential shortcomings in Vasanar itself which I think we need to look at addressing and potentially saying well if a tool or if a if a mechanism that that we're looking at isn't able to capture the kind of nuances of this problem that you know we may need to look at at a different mechanism so some of the ones that are our kind of open questions is that that Vasanar obviously looks at everything in the basis of the ones and zeros and not on the intention as we said before um in court on DJB's behalf and uh it was it was such a catch 22 for the department of commerce that they that they eventually backed down completely and after that going to court sorry going to court is something you do after legislation is passed that is clearly unconstitutional or otherwise contributing to fundamental rights we're both in the US and New Europe in the position that the pretty vague criteria of Vasanar have to be transposed in more concrete legislation and that process is still not finished and especially on the European side um the only contangable thing we have is a non-legislative report by Marieke Schaake and MEP and while that non-legislative report is has not been ideal um as we managed to get in amendments that specifically acknowledge that this has potential for chilling effects on research although we inserted the word bona fide research which I regret in hindsight because it's probably not helpful either um but at least um there is potential to have a European implementation of this bit in Vasanar which may be revised within Vasanar in the near future but also in the in the in the European implementation to make this less bad but I'm not sure whether it's um how that will survive that process um on that I mean the most frustrating thing about all of this to me is that we keep finding ourselves at daggers with people who are supposed to be our allies like we're supposed to be on the same side uh as the anti-surveillance people but what's happened is well meaning anti-surveillance people who don't understand the technical landscape propose what sounds like a good idea to them without ever without ever actually asking technical people then the NSA and GCHQ get involved and they push their agenda and the technical language ends up constraining the people who the surveillance the anti-surveillance people are supposed to be allies with I mean and then we have to you know then it ends up being our problem to massage people's egos and get them to you know and find them a way to save face when they're backing down and I'm sorry I'm not very good at that personally Katie Masuris did a fantastic job of it um a couple of months ago but you know we're kind of an abrasive tribe like you know being nice to people is not really our job well maybe it is but still I mean it's extremely frustrating to be put into this situation that we didn't ask to be put into in the first place and so I'd also like to you know if we can get into like how can we avoid this happening next time that would be real nice too but we also didn't learn the mistakes from the crypto wars so it's almost like this is the problems with that happened back in the 90s seem to be repeating themselves and the lessons that were learned then seem to cyclically go out the window and unfortunately I just wonder what in 10 years time they'll do next oh sorry to interrupt at that point please first the question from the internet thank you harold um the the internet wants to know our defensive technologies potentially going to be restricted by this arrangement yeah one defensive technology that is not simultaneously in attack technology or in other words and this is a quote will we end up with city everyday security because yes things are not exported yes yes that will happen if this gets implemented the way it's been written so part of the problem is that the boss in our arrangement definitions risk throwing away the solution that it's trying to solve um you know harden the endpoint harden the server harden the pipes the tools to do all those things potentially get screwed by vasanar right we want to get secure devices and services into the hands of the folks who need them um and banning pen testing tools is not the way to do that number one please so one one the insidious things about um ita regulations with the arms trafficking regulations in the us is that you are also liable for whatever end users of whatever you export is like um use it for is there similar things in like the implementation of the like vasanar argument is it just on the us munitions list or is it some different it is not it's not on the us munitions list it's on the er rather than itar which is the export administration regulation list um so you're not liable for end use end user you're only liable for the export at least in the us i think one of the problems that we're seeing is that traditionally uh the kind of technologies that that the regulators have been used to dealing with uh have been either solely military goods or so-called dual use goods and i think one of the things that potentially this falls into is that there's actually another use which is highly beneficial to the overall security of our systems as the the question from the internet pointed out that that is one of the consequences and so it's not necessarily clear that these things should be on something like a dual use list but maybe we need a recognition that the the positives of these things uh drastically outweigh the negatives and that by not having secure or not having the offensive tools to create the the defensive protective measures that we potentially leave ourselves open to much cheaper much uh uh ghost rat whatever whatever rat you want to buy on uh on uh alpha bay or whatever the new uh the marketplaces another question from the internet please thank you is this uh wasana arrangement draft openly available yeah where to get it it's it's not a draught wasana arrangement just wasana.org yeah and it's not a draft it's just a published document on that side yeah it's it's final it's not a draft number four please so i think the high level point i'm hearing here is that we have learned in the 1990s the wasana arrangement with its weird reserved word definition of public domain um it's in scare quotes and its weird framework has been an awful fit for crypto back then we sort of got ourselves out of it that's great it's coming back it's an awful fit for the sort of possibly intrusive software we're talking about here but actually it's possibly a little bit closer in its original intent to this software than it was to crypto after all its original intent is to keep that heavy truck out of its use as a troop transport it is to keep this um dual use tool out of another army's hand and what we're talking about here is keeping this overtly dual use attack technology out of the hands of an oppressive government that wishes to use it against its citizens while maybe keeping it in the hands of researchers so that framework sounds attractive we're learning in this conversation it probably has a lot of secondary effects that are unpleasant i would like to hear from the panelists what your view is as to what a reasonable regulatory environment around these offensive technologies looks like i heard nate say for crypto it is just take it out of export control make it freely available it is so beneficial are we saying the same thing about offensive technologies i won't i won't like give the mic to mary there from that because he has published a paper on that together with surga bratus well i mean i mean honestly my my perspective has changed over the course of this conversation um you know because what surga and i have have been writing about um is how to change the language to something saner um you know one thing that's come up over and over again in discussions on the the current language is that the um the language about execution paths is essentially meaningless um nobody really agrees on what it means um and even if they did agree on what it meant it wouldn't actually help um there's a wonderful paper from usenic security earlier this year um called control flow bending um and they they take a look at uh control flow integrity systems um this is these are basically like systems that try to whitelist um what paths through the control flow graph of a program uh are considered legitimate um and then you only whitelist those and anything else is considered an exploit um turns out um you can actually uh have all kinds of memory corruption fun and get arbitrary computation with printf you don't actually have to uh you can you you can violate even theoretically you you can get an exploit on even theoretically perfect control flow integrity so like what they've described doesn't even make sense and doesn't help but i mean i think what i i i think what what you said earlier about the provision of services is the far more important point like the you know government of random third world nation is not gonna get a lot of use out of you know here's finn fisher have fun they need that support contract regulate that or you know impose a strong liability regime i'm i'm lead counsel at EFF in our case where we're suing the government of Ethiopia for using finn fisher on a democracy activist in the united states we were lucky enough to get a client who we were able to catch Ethiopia using finn fisher red handed within the united states which gives us jurisdiction to sue them um but PI is uh is pursuing a case against uh gamma in the UK for the same thing um you know EFF was involved in cases against Cisco for helping build the great firewall and against IBM for building South Africa's apartheid identification card system uh that kind of liability on the on the back end for doing this the stuff that we care about that were that we that we don't want companies doing um i think would be possibly much more successful um and would have chilling effects on the on the bad stuff without touching the security research and i think that's the really big ask because good luck getting any government to you know be willing to be sued for anything but well i think that the one of the point in relation to the question is that um you know to someone with a hammer everything is a nail and Vassanar is is the tool that was there but as has been highlighted just there there are potentially other alternatives uh that may or may not be be be better and maybe the exploring whether the the language can be fixed within Vassanar to take account of the various different uh situations or whether there's other mechanisms in place i think needs to be explored yeah and as a lawyer as someone with a law degree everything looks like a lawsuit so i'm like sue them um question number four i i just um have noticed something in a new South African cyber security cyber crime legislation i'm not sure if it's influenced by Vassanar or if it's just the current environment um and uh yeah basically in South African now according to the cyber crime bill um malware would include any electronic mechanical instrument or device that could create a vulnerability modify or impair or interfere with the ordinary functioning of a device computer or network uh so that occurred to me that you know if i modded my phone for example there would be malware on my phone um a whole lot of things yeah and the second be i'd also got me thinking um how does one actually distinguish between possessing malware and then on the other side the people who are owned have been infected um could that not be a catch 22 that might be useful in certain judicial context i mean um an exploit is still an exploit that's still taken across the border if it's in the hands of a researcher attacker or possibly even an infected computer we do have the problem already with the cyber crime convention in practice it's basically not really happened so we have no idea because yeah there's the cyber crime convention with an entirely different framework on Vassanar uh which again most industrialized nations have signed um it has become in most implementations a crime to possess a piece of malware even if you're just a victim you're technically a criminal i'm not aware of any public prosecutors stupid enough to pursue such a case i would love to hear that right away south africa is a signatory to wasanar though i just looked it up um and i think under us law in there there's always an intent requirement for virtually every crime except possession of child porn um so if you're a victim of malware and you happen to cross a border you don't have the intent to export so no crime and i think the some of the other tools that might fall into that would be things like fuzzer's idea pro that would you be able to manipulate various different bits and bobs through the true decompile piece of software but um night at the start i think mentioned that the uh the actual piece of malware itself um strictly speaking or at least that's probably not fair uh the intent of vassanar was not to control anything which could go on the individual's device precisely for that reason that an innocent victim crossing the border and be found now as as as experts have analyzed the um the actual text and found various different ways in which potentially uh um code or or um executables on a victim's device could potentially be considered uh uh caught under vassanar yeah thank you oh so here's a wacky thing under the us implementation uh the code is arguably not subject to control but the comments to the code are definitely subject to control yeah um i think we're kind of running out of questions from the room and number five oh sorry one six um you mentioned that hacking team very easily got a license so why why would it be very hard for all of us to get a license well i think hacking team had a special relationship with the italian regulator that allowed them to get that license and i don't think people who want to play with software and figure out the problems with it should have to register with their government uh in order to get a license they they probably should be able to conduct the the research themselves because then you're running into the problem of well supposing somebody in in canada gets their hands on finfisher or hacking team and then they have to go and register for a license with canada who are potentially customers of finfisher and hacking team to say hey i'm doing reverse engineering or malware analysis on the very tools that they have bought um i wonder if that information stays within the the authorization department or whether that may potentially get passed to the companies who are involved in the uh in the sale of the the material so that they get tipped off that hey somebody's got a sample of your latest malware version and uh you might want to think of changing it i mean one thing that could you know one one thing that could be done to sort of point out the absurdity of uh of particularly restrictive uh licensing requirements you know could be the equivalent of a work to rule strike um DDoS the uh the the licensing agency with requests for every single time you install open SSL um so that's one possibility and on that note uh thank you all for your attention and enjoy


Hey stampers! Welcome to another week of Watch It Weekly Wednesday. I'm Beth, part of the Stamping Jail creative team, and I want to share with you a really, really cute idea that was shared with me this weekend at a stamping retreat. We met together with a group of demonstrators to do On Stage, which is Stampin' Ups convention, where they inspire us and show us new things that are coming. It was so fun. And we got together with some demonstrators in our area and did some swaps. We did some shoebox swaps. And one of these little projects that someone shared just inspired me to create something I thought was so fun. So let me show you what I created. I'm calling it like a photo card. I think that's the best description of what it is. My family just recently had family pictures done, and I was thinking of how I could put them up on my husband's desk at work. And so when I saw this project, I thought, that's exactly what I need to do. So I took her idea and I made it into a little photo card. So it's flat enough that you could mail it if you wanted to. This would fit in one of our regular medium-sized envelopes. But it will also stand up. It will stand up on your desk just like that. And it will show kind of your cute family. Or for whatever occasion you want to do, I want to show you a couple of ideas I came up with. But this card base, our card stock, is really what makes it stand up because it's just such nice thick card stock. So I want to show you the measurements of what I did for the base. And then I'll show you some other ideas I've come up with. I'm going to bring in my stamp and trimmer and just one piece of soft suede card stock. And I'm going to first start by cutting this in half at five and a half inches. And then I'm going to have two pieces that I'm going to work with.  That's going to be my first piece. I'm going to score this piece twice. Score it at a half inch.  And I'm going to score it there. So I'm going to have a four and a quarter side that this is going to fold over the top. And this is going to be my flap, where I'm going to adhere my second piece.    And that's going to be my top piece. Okay, it's going to start to build on itself. I'm going to bring in my second piece. This is still marked at eight and a half by five and a half. And I'm going to cut this down to four and seven eighths by six and a quarter. Okay. And I'm going to score this piece at two and three quarters. Okay, just like that.  So I'm going to go ahead and do that here. I'm only going to cut down to that score line.  And I'm going to have the base for my photo card. So this is going to adhere here and this will fold over. And that will be like the base. I like to use tear and tape. So I just take a little bit and put on the flap. That's why I left the flap just a little bit larger at half an inch so that I could add the tear and tape easily. So you just lay it on there, peel off the wax paper side. And I like to lay it flat out like this and then bring my piece over top of it so that I can get it just as close in there as I can. Just like that. And then it's going to fold like that on top of itself. So that's the basics of how to make the base of the photo card. Okay, so let me bring back in my card that I had made. I just decorated this one using a lot of the product from the Nature's Harvest Suite. I thought that was so cute. And it kind of worked with my family's colors. But I thought for Thanksgiving, this might be a fun project to make for a grandparent or for somebody, a family member that maybe you're not able to get together with. And you can send it just right through the mail to them.  Another idea I had was to make something for Christmas. This could be your Christmas card. I've used the Candy Cane background stamp here and just said have a Holly Jolly Christmas. And then included photos of my family, had my kids sign it. And we wrote our little note there. Just really simple, but someone could prop that up on their mantle and have it up as their Christmas card. Fun. And finally I made one for my niece Emily. She is my youngest niece currently.  And it was such a tender time for our family that I wanted to document it for. So I thought I would use some of our hand pens sweet to do this. I use some of the memories and more stickers and card pack. And I made this one for Emily. This is Emmy when she was just in the NICU and now she is just a rip-roaring little five-year-old and she is so full of spirit. We just love her. It's Aubrey's daughter. So here's a photo of Aubrey with Emily. Such a fun time. So I thought I would make this and give it to her as a Christmas gift because I know she's going to love to put this up in her room. So I challenge you to think of what you could do with this project. Make a fun photo book for somebody that you care about or use it as your Christmas card this year to be able to share multiple photos and your message all in one little thing that you can mail. If you like this idea and you have a friend that you think would want to make it please share this video with them so that they can have the tips and tricks. You can also check out our blog at StampingGill.com to see the measurements for this card idea so that you can recreate it yourself. Thank you so much for watching. We'll see you next week for another Watch weekly Wednesday.


You wouldn't ask for a doggie bag, would you, from a restaurant where you know the food made you ill. And yet I think we do that metaphorically when we keep reliving our negative past and maintain an attachment to fragments of it. And every day we continue as it were to eat from a doggie bag of the things that hurt us. And the negative experiences we went through and we keep continually making ourselves sick. So I wonder if today you could stop eating from that doggie bag of what made you sick. Get rid of the doggie bag, make a note of the place that made you sick. Don't go back there again, learn, move on and live better because of what it taught you.


Awesome. Welcome. What would be great is to just take a couple of minutes and go around and tell us a little bit about your journey here and some of the ways that you've been involved in the education space and what excites you about the future of education. Okay. Well, in terms of my journey here today to here, Kiwi Connect, my partner works at Kiwi Connect, so that was sort of the beginning of the introductions. I've spent the week here really listening in to what's different in each group each day. There seems to be a slightly different crowd. So my journey here to Education Day today at Kiwi Connect has kind of been like a buildup of sort of checking out each day and seeing how they vary in the crowds as much as anything has been interesting. In terms of my journey with education and my passion, I've come from having second chance learning and community empowerment and education as things that are intertwined. I come from a family of ex-high school teachers who really got frustrated with seeing systematic failure happening in low socioeconomic communities, especially with Pacific communities. And so I was born into a family that had a very strong social justice bent and on the role of education to create change and equality of opportunities. So my education background is very much in working with at risk and low literacy learners, adults and youth. Maori and Pacific communities. And being very employment and employability focused, there are many other reasons to talk about education, but the employment and employability economic empowerment opportunities is where my passion really lies with education. Thank you. Kia ora, my name's Sylvia. And I was thinking, I guess it's always in these introducing ways, there's so many different hats and lenses that you can bring to a conversation. So I thought I'd just touch on a couple ones. The very first one is I'm a Wellingtonian, and so I thought I'd just sort of touch to Wellington and welcome all of you who have come from overseas and from outside of Wellington. I grew up in Wellington. And I guess though then the other one that I want to introduce myself as on the stage is as a daughter. And it's really nice to be on the stage with my mother. And it's also really nice to be sitting next to Brian and Matthew's mum. So it's really nice to think of family as an introduction here as well because I think when we're talking about education, I think you get your first education from your family. I think the next lens that I want to bring is I'm very actively engaged with the Inspiral Network. And I think that's a core lens that I currently bring to a lot of my work. I think one of the questions we're asking at Inspiral is how does Inspiral do education? What are the core principles that we hold to that? And what is the core sort of impulse behind the education system that we're trying to create through the Inspiral lens? And I guess the fourth sort of primary one that I would bring is through the lens of Chalkal. Chalkal is the startup that I'm working with with the crew out of Inspiral. And Chalkal on a very base level is really looking at the foundational infrastructure on how we can rewire the adult education system. So what we're looking at there is going let's move the education system from an industrialised, batched, productised system into a human-centric and powered system. And I can talk further on what that actually means on a real practical level with Chalkal, but that's my core work at the moment. But I guess fundamentally what I really want to introduce myself as is someone who sees education as the acupuncture point that I can use to make real systemic social change. If there's so many problems out there and I'm drawn to so many of them, food, tech, you know, politics, there's so many things I want to do but there's a limited number of hours I have. And I kind of made the assessment that actually if I'm going to focus all of my energy, where do I want it to focus and I've decided on the education system because it's empowering human beings and enabling them to realise that the discovery of finding their own real potential is actually going to then mean that people can go out and change those systems themselves. So that's where I focus my work at the moment. Hi everybody, I'm Denise and as she mentioned I'm mother of Matthew and Brian. So that's where my journey began. I think that's why I got a spot up here too. I'm coming more from a background as just your traditional public school teacher. I taught for a long time in Illinois. I taught middle school, language arts and history. I grew up in Chicago and everyone in my family, my mother, grandmother, all her brothers and sisters were all Chicago public school teachers. So they were on strike. This was the days of allowing people who had individuals with disability acts, all those fundamental changes that happened to the 60s around public education. So that's the perspective I come from and now that I've moved from Illinois to California I'm seeing a totally different side of public education and all the cool innovative projects that are happening in places like California and it's exciting and inspiring although I still kind of look at issues of inequity and neighbourhood, the way that we fund public education and things like that who really is getting access to some of the really good stuff with the high tuition costs. But there is room for me to be excited even in the public schools. I've been working the last year in a school that's located in Silicon Valley but it's a lower SES school. So they do get the benefits of lots of resources, grants from Facebook, things like that. So it's not resources. It's what are we going to do with the resources in the most effective way. So, thank you. Thank you. My name is Doris and I've landed on this spot through my connection with Sylvia. She gets me into all these exciting spaces. Thank you for inviting me, Josef. I've grown up in Switzerland and had my formal education there until I was 22, coming to New Zealand. My qualification is science but my profession has been in education. I've been involved with Waldorf Education, having founded a school 25 years ago and watched its development. Focused on young children from kindergarten to 13. Focusing on the actual unfolding of the child in a balanced way, in an unhurried balanced way, drawing out not so much popping in and watching for the balance of academic, artistic and practical. Truly experiential learning. I'm now witnessing all our pioneer children in their 20s and I've witnessed my three daughters going through their schooling in their 20s. My key interest and passion now is watching the questions of young people leaving school. I hear questions, what do I need to learn to get prepared for this fast changing world? I watch and observe them with a sense of receiving a sense of pressure. Young people are asked who you want to be, what are you going to do, what are you going to study? They're experiencing this pressure while they're feeling a sense of disconnect and actually are dealing with the question, who am I? Where do I belong to? How can I serve in this world? What is my contribution? The core human question. I'm interested of how do we deal with these softer values of education? The hard, the technical knowledge aspect of information is so well taken care of. Technology made it accessible online, it's marvellous. We can now focus on the complementary aspect of education. Responding to those key questions. And I'm excited with my involvement, with Orientation Aotearoa which I feel responds to those questions. Providing a space for young people, with eventually one year to explore that very core human question. Who am I and what do I need to learn to contribute meaningfully? My first question to all of you is, we brought up human centric learning. And this is constantly playing around with community oriented learning and education. I'm curious to hear, what does that really mean? How should we start to understand such a way of approaching education? I guess the way that I understand it is going, every single individual is unique. We say that right. But what I'm interested in then, why do we then create infrastructure, educational infrastructure that doesn't allow people to actually uniquely find the path that they want to follow? So on a real practical level you can think about this in primary school and you group kids by their age and if you're nine, you're nine and you go there. But where are all the different talents and unique elements of a child? I think though, what might be really important as a frame setting for this panel is to recognise that primary education and adult education are quite different. So creating a primary education that's human centric will be looking at who is this individuality in front of me as a growing child that's finding their own personality. Whereas in an adult you're actually perhaps more trying to empower them and figure out how they want to find their task in the world. So I guess then for my personal lens, where I'm looking at it with chalk or what we're asking the question is going, okay, yes there's all of this information out there. Yes there's all these people but how actually do you discover and learn the real practical skills that I need right now? And why is it that so often the educational institutions are batch teaching, media marketing managing something which is really important but at the same time when things are changing so fast what you learn at the beginning of your degree may no longer be relevant when you come out after three years. So what we're trying to do with Chalkal is find the people in your community that actually have the skills that you need right now and how do we connect them on a human to human level. Part of the difficulty I think is Katelyn brought up, it would be nice if somebody had a product at the end of the year. I do see a lot of classrooms moving to a portfolio type basis for grading or assessing but it's really hard to measure a large number of students and their soft skills so we just do testing and more testing. We're greatly challenged at the moment with our initiative. Every funding application asks you for outcomes and we feel we're creating a platform that's beyond measurable outcomes and to me it's like I love what you said the difference of the child and the adult. In the adult you really want to go... you want to nurture the curiosity for learning just like the child but you actually want to instill the capacities. It's no longer just knowledge, it's the capacities of problem solving and creativity that makes you able to respond to this incredible fast changing world. The knowledge is yes, the skill that you will need then but the resilience, the creativity and the imagination do forever imagine something new because the present is not necessarily at times working. This doesn't answer your question so much as where it has gone to. So I'm doing another hat. I'm doing a PhD right now and looking at evaluating what different programmes work to support youth transitions from education to employment and how to develop employability and soft skills has been coming up every single day this week and I was just talking at Morning Tea about soft skills and that word, that term triggers so many different interpretations. I think one thing that we really need to do in education and not just in education, in our society is get a clearer set of terms so that we're not talking past each other about what it is that we're trying to achieve for outcomes because on the day focused on entrepreneurs there was lots of demand for soft skills and how important it is to have soft skills and in employer circles you talk about soft skills and employer surveys say that's one of the top things they value above qualifications a lot of the time. Then you go into the education sector and people have again multiple different definitions of what that does and doesn't mean and whether it's a cabbage subject and it's only for people who aren't academics. So we need a clearer definition so that we can all agree what it is that we want to achieve is outcomes from education and especially around that area of soft skills. Personally, and it's something I'm arguing in my thesis soft skills are very hard to measure, not impossible. Our formal education systems are focused on standardised ways of measuring things. They need to standardise things because it's public money and the expectation is that you can say you produced it, you know, that can do this, X, Y and Z in a standardised assessment way. But if you think about a CV as representing the different things that are not just employer's value but other people in the community like a CV for a volunteer role. Qualifications is one section on the CV and qualifications is a standardised way of signalling to employers and different people because they've got often technical or hard skills. And it might imply some other things too. But soft skills, if you think about referees and how much weight people place on referees or seeing what else you've done where you might have demonstrated your soft skills, I think it is possible for us to talk about ways that we can develop validation signalling so that we're actually creating validation systems as you kind of do on something like LinkedIn when you endorse people. Maybe we could talk more about that between both education groups and employer groups as well. Sorry, that's not your question, it's where they were going. It's actually this very relevant and when we think about many of the soft skills like about last year there was a research that was done across technology employers around New Zealand and what are some of the most important things that they're all looking for? And they say this is soft skills, leadership, communication, ability to work with one another as the most important even beyond academic qualifications. So I'm actually curious to hear if anyone in this group has had any experience with ways of measuring and tracking the development and work of soft skills rather than just transfer of information through classroom activities. There is an intersection I saw recently called the classroom dojo and it's this online platform where teachers have like everyone in the classes names listed and it's sort of a behavioral response sheet so people can be sort of given feedback and easily a teacher can go in and in 15 minutes give some feedback to everyone's behavior from throughout the day or I saw you being very helpful with this or I saw this and sort of just this reinforcement so that the parents can know what was going on behaviorally throughout the day and also reward that or provide feedback. So this is very easy way that tech is kind of trying to bring some more attention to that area so I thought that was relevant to share. So at Dev Academy we focus a lot on soft skills and training it and so there's lots of curriculum and things you can do but the question about how to measure it and how to track it the only solution we've got so far is really high touch and sort of teacher time so that we sort of have like a 1 to 5 teacher ratio so that when people progress through there isn't a formal test or anything but there is a big amount of the teacher's judgment and a recommendation about what do you need to work on where do you need to go so that's based off spending lots of time with the students and having a very non-standardized recommendation or assessment at the end of it would be how we're doing it. Can I jump straight to that because I think that links to a really interesting question about the online offline education and you know with all the different online education things at the moment like Coursera and Udacity and all of these different ones what they're making education more accessible, granted but if you look at the drop off rates it's incredible, you know you start with 20,000 people and the people that actually finish it you might end up with 500 so I think that's an interesting stat but I guess I would ask this just as an open question if soft skills are so important can you measure soft skills online and I really like what Josh is saying because I would perhaps use that as an argument to say no you can't and therefore is that the value of face-to-face education and perhaps to then ask the next you know provocative question of do we need face-to-face education you know why should we all be in a room together what is the actual value when actually you can you know teach 5,000 people online and I definitely think you have to be face-to-face but I can see that's what you all say things I think face-to-face responds to core human character we have, we are social beings we're not just curious, we are social and so it's not just who am I it's a curiosity who are you and there's a limit of how I can figure that one out online but I'd love to ask another question around the soft skill before we get into measuring them can we explore a little bit more you know how do we develop soft skills and maybe we're not quite answer that question may I ask that question may I answer it in our fast world my belief is that some of the key soft skills you can't just pop in overnight they take space and time and experience and and to counter with each other and my actions and the response from the world my action but that poor spot, that poor button of reflection sometimes slow can really create the soft skill and I just want to challenge our fast world we are fighting for this a year of space giving young people space take the pressure off and give time to truly explore and I believe that is what develops the soft skill such as compassion a sense of morality and all the other skills that we are after as employers and we have to remember that the majority of that does not come during the school day I remember in a teacher education program class it said you can get the kid and I'm mostly in you know 32 to 1 ratios you can get the kid if you have at least 3 to 5 minutes of eye contact throughout the day with that individual so trying to keep track of like did I look at Johnny yet you know or recognize him for his inherent worth in the room so it does not we can't rely only on the schools to do that the soft skills have to be developed in the home the community and the extracurricular programs I just want to point that out and that's my next question is when we talk about a holistic model of education what is the role of formal education what is the role that parents play and what is the role that communities around us play and providing a more holistic educational experience for our children perhaps I'll just jump in there on a real personal note is it's been really interesting with an inspiring how many people say they're still recovering from their primary school and you know I know and I think Rich will let me share that but Rich from Lumio described how he's he went through you know 15 years of primary and high school education and it's taken him 15 years to recover from that you know in terms of the bullying in terms of the you know the structure and me personally I never had that experience I loved my education and I thrived in it and I think that was part of that feeling of actually what's going on in there why are these people not not yeah thriving in their education system and how can I try and help people have more of the experiences that I had but I guess that's just from a personal response I guess in terms of holistic education or and that sort of overlaps with the student centered learning discussion I find that often you've got community groups who naturally do learn holistically and as communities together and maybe we could tap into that a bit more because especially with this advantage communities in the New Zealand context so we ran some really awesome community learning hubs in Samoan churches around the Hutt Valley and they came in and they talked about themselves being a learning village and they were just natural at holistic learning we didn't have to you know introduce them to this new thing called holistic learning it was just they just it was holistic in what they thought was worth learning so we did some digital literacy introduction to the computer and then we did some cooking together and we integrated numeracy and literacy into that we talked about goal setting and life goals and how to be able to plan goals that are baby steps into plan and review your progress and actively learn how to do that in a holistic way not just get my qualification but also I want to get my driver's license or I want to learn to cook three new recipes through these community group learning sessions but anyway I think holistic learning and community learning often go together very naturally as a combination and maybe we could actually look at some of those informal learning setups that happen naturally in tight-knit communities often it is around a church group or something like that observe what is working and why that way and then see if we can somehow replicate that in our more formal systems rather than go the other way because actually they've got a lot of answers there already I wonder I'm just going to I'm in the middle so I'm going to grab the mic I just want to ask the quick question of I heard both of you say families school structures and communities I'm really interested in what's the role of business and how do we get if we're talking about real-world education why is it that you spend 20 years not interacting with business and then suddenly the next 20 years whether starting a business or working in a business and why isn't there that connection and what are the different with Chalkal right now we're trying to see if we can partner with one of the biggest tech companies in Wellington to create alternative forms of professional development where we connect their staff with young people and their impulses around youth employment and they're saying we're a tech company and there's no young people to be able to hire and they're not seeing tech as an alternative career option so what we're saying is Chalkal is saying well actually you have all the skills you have some of the best IT professionals in your company how do we help you connect them to the young people so that then it becomes you're starting to reduce the barriers that way so when I would be talking about holistic societal education I'd be interested in the role of family community institutions and businesses one other point I want to make about community schools is also the need to be careful not to have the schools segregated then because community in a big city usually the way they're arranged is ethnically so like for example in a Hispanic neighborhood you come out and all the smells all the food carts and colorful murals and they walk to school and it's beautiful expression of community so but we also have to make sure that they also get included in the global connection my view in holistic education is it's all of the above all what you've listed and you've forever looked for the balance so when we say you've got a prodigy child in front of you that's a genius in math you celebrate that but a holistic approach should be to also look oh what else is missing you know you don't want an hyperactive or an antisocial math genius you want an all rounded math genius that's also good at growing your own potatoes you just forever look for the balance and for me that's holistic education it's really balancing all aspect online, formal, experiential hands-on education all have got its place and I guess just sometimes where we feel we've gone out of balance that it's formal online and the face-to-face experiential is a little bit at risk we touched upon this in the conversation so far the topic of inequality how do we overcome inequality in education what are some thoughts that you have around that and also any models that you've seen that we can learn from just real briefly one of the main ways we could reduce inequality is to help minority groups become teachers you walk into schools and it's still all white females you know other than like the secretaries and stuff so if children see more role models of their own kind and also a total restructure of the whole way we finance public education so could you take care of that Joseph any time I spent some time in Benin, West Africa teaching in a small school there and it was interesting because I came in having gone through a Steiner Waldorf school and going I'm going to bring you know holistic education to these children and I'm going to teach them how to knit and I realised within the first two days that actually it was the foundational structure that we needed to try and support the teachers with these were classrooms with 50 kids they had a whip on the table so any time I went near the whip all of the kids cowered and that was when I realised that actually no not knitting but actually how do you empower the teachers that were standing at the front they needed a whip because they had 50 unruly kids because the parents sent them there and they'd never had really proper any interaction in the past so I guess I bring that as a story of going there's so many different layers to education but in inequality I can go in as a white well-educated woman into West Africa and try and teach kids to knit but actually when I leave they don't have knitting needles and wool so it's useless but therefore I can go in and I can have conversations with the teachers and go actually how can I help you as an individual and start with the individual teachers and through that way then be able to create this systemic change and I guess that was just my illustration at the inequality that I was experiencing there I actually have and I'm saying this as currently an academic you know focused on qualifications in the formal systems I have in some ways more confidence and hope in the private sector and in groups like those gathering together at Kiwi Connect to entrepreneurs I have more confidence that there will be groundbreaking relationships that can happen between entrepreneur communities and the business community to do more things like supporting Michelle's OMG type setups to really tap into disadvantaged communities and give them access to education that is holistic focused but I've got my employability hat on is also employment focused and self employment focused is part of it right I have more confidence that that can happen faster with greater impact than relying on the public sector and public education systems to be able to do the same thing as fast because there's more restrictions on the public sector than there is on these communities that have been gathering here to directly go in and have partnerships with schools and communities it's a much faster and more likely thing to happen so as a member of that community yo where you go I love to open it up to questions from the audience or any reflections that you might have thank you all for being here look at all the women on the stage um so one thing I just wanted to add into the space as a reflection in addition to the it ties into the soft skills it ties into the community driven approach is one way to kind of break down a format of experiential education is by things that students care about so the work that I've done is a lot around I call it like a social change boot camp for teens but you take issues that affect them and you let them throw that out there on the board of like so it could be environmental issues it could be sexual abuse sexual assault can be bullying all these things that have affected them since they were young and then you can do this in a whole school you can do this in a community group you can do this really anywhere with young people um and then what it does is it inherently creates a safe space for students to be vulnerable because they're aligned based on certain things that they care about that have affected them so it has them be more engaged and then from that space you have their attention their attention span grows so much more and then there's so much of you can use a multidisciplinary or multiple intelligences approach to be able to teach them multiple different things because you have them aligned in a group in a community of people that care about addressing the same things and you also start teaching them problem solving and help shift them from a place of feeling powerless which may not be so applicable when they're in elementary school but as they get older they start to feel like who am I in the world what do I have to offer and you start to help them shift into a place of feeling powerful like I don't have to be 18 to vote to be more compassionate and kind to the kids in my class so it's just kind of an interesting way to section out learning in an experiential way that helps them be rallying because a certain thing is something that is something that's affected them deeply in their heart so it's very like behavioral heart to heart human to human which gives them more space to receive other types of skills. I just had a quick thought about something here as a question earlier about how to recognize soft skills and that's something that I tried to figure out for myself and for a long time I was listening to what other people were telling me I was getting at but I wasn't thinking about what am I really spending my time on and what are my skills deeply and so I eventually started to think about what do I always do when I don't have to do anything else like when I'm bored and I started to list those things out and there were patterns to that and I found out that actually the things that I really enjoy doing deeply and I'm actually better at are the things that I do when I'm bored and it's important for kids to be bored at certain times and I think for their learning it should be structured but also unstructured. They need unstructured time and that's something that a lot of kids don't get these days so I just wanted to add that I'd like to really just support Doris's insights which to me are absolutely crucial I've been involved for quite some time now with US based tertiary students doing experiential education in parts of the planet and some pretty wild places up in the Himalayas and Native American communities and Dappatistic communities and the focus of that particular program apart from an underlying theme of how do we shift perception shift awareness is to follow curiosity and establish learning communities look at all these gifts and how they can be challenged and more and more we have to grade to a certain extent to satisfy host communities back in the States but outcomes I think are totally overstressed grading is totally overstressed how do these kids ask better questions how do they see the connections what is their shift in awareness how do they cope with silence the power of ritual where you can actually open your heart to see and feel more clearly those can be expressed in all sorts of ways we get our kids to do some stunning academic work but we also get them to be incredibly creative and of course you can't grade creativity you've got to give them 10 out of 10 but the all roundedness I think is what really is the key element and I think our ultimate test would be that if they haven't shifted their perception and awareness and to see connections we've failed there's a wonderful phrase that says we grow in the direction of the questions we ask and I would put on top of that how do we create an education system as far as our young kids to ask non-googlable questions because so much is around I am just someone that I'm constantly asking questions and often I will ask a hypothetical question that I'm living into and the very first response is oh hang on I'll just go check that let's just explore it and live into it and through that see if we can collectively discover it so those are just two two directions that I really hear what you're saying I really like that hook sorry to just jump in there but you know throughout this discussion I've been thinking you know around what Doris was saying around if we are going to have holistic education we need the families the formal education the communities all surrounding this child and young person or adult in their journey and I'm thinking whose responsibility is it to look at all of these gaps and how are we going to ensure that that happens for every person that is part of the education system and maybe what you're saying Sylvie as far as encouraging people to ask the right questions might cover some of that I don't know what your thoughts are on that I so strongly echo with all these responses I got two reflections yes the curiosity that's one thing but I strongly echo was it Adam? yeah the boredom yes it's creating again that gap and it's the opposite of over filling if we feel the task of education is lighting the fire really finding your passion your interest it needs a moment for that to come out if you keep over filling if you keep the children forever you know one program after the next structured there is no space for something to grow that's truly your own unique passion and that needs to happen again as an adult you know find yourself give yourself the space of exploring what's next and that's what I feel a 21 year old needs but it's actually all of us deserve that at some stage in our lives I had the privilege of finishing my job two years ago everyone asked me what are you gonna do next I felt like a 21 year old and I took a year just to wonder the world my answer was just give me a moment and that moment I want to give to a 21 year old to that the true fire comes out and then that fire can get trained and formally educated and if you're on fire you are employable a quick comment to make on that when we talk about curiosity one of the best gifts that I've received was the way my parents taught me as I grew up is when I ask a question they respond back with a question and that really actually allowed me to ask and I wonder and explore and when we think about education often times we think about teachers being the sources of information and you're withdrawing information from them I don't know if you've heard of philosopher Paolo Ferre from Brazil he coined the term of a banking system of education which is throughout the year the teacher is the student is withdrawing information from the teacher you're basically depositing it and then the teacher then withdraws that during an exam so it's just transfer information and one of the things that has come up over the last few days is just the exponential rate of change in everything that we're doing we're creating so much information where everything is just becoming obsolete and evolving over time and so moving education from an information based economy to a knowledge based economy knowledge being something that's co-created and it's actively evolving and that's a very much a pedagogical approach to learning where we have discourse and discussions and conversations rather than working towards a very specific outcome we're in the space of creativity using all the resources that are available to us two quotes that I love and one is I can't remember who said it but Google it that we are now we're drowning in information and starving for knowledge and that's true and it ties into what Darius has been talking about and the other thing is that paralyzing question we keep asking school leavers and teenagers what do you want to be when you grow up it's paralyzing to realize I've got to make a decision and commit forever can we please at least change that to what do you want to be next because it will be many things you're even asking a soft scale question like what do you want to be like I just want to respond to the un-Google question does it take away the wonder and do we celebrate the sacred you know everything is Google and is it healthy to sometimes live and wonder and not being able to explain everything and be quite comfortable in that question and just follow the quest of questions and be comfortable in it because I think I want to jump off to that and bring it practical in terms of what for example some of us are trying to do with Inspiral you know if we're taking it and I think many of us are here right now because of the paradigm of society there's many things that we might all personally believe is wrong but how we're trying to shift that into the future none of us know and if we want to wonder about the future and recreate it in the imagination of what it could be we can't Google what the future is going to look like so if we're creating an education system and I guess this was always what frustrated me the most about of my university time was writing papers coming up with crazy ideas and I lecture is saying where's the reference and I tell I don't know because I made it up and I know you can't have that in your research paper because it needs to be a reference of the past but if you're trying to create a new future you know if with Chalkal we're trying to create a new education system with Inspiral we're trying to create new businesses there is no reference to the past of how you create a decentralized organization or whatever it is that you're trying to do so where do we create that wonder which then so tangibly comes out in my work and in many of our works is we're trying to create organizations and businesses that are trying to feed the future one last question yes I just wanted to kind of tie in a few things that we've kind of been discussing throughout our time here over the last five days and this idea of creating wonder is something that I've been thinking a lot about and research group out of Berkeley University is doing a study right now on awe and so I had an opportunity to hear them speak about this on Facebook's campus actually they pulled all these leaders together and this was for the Wisdom 2.0 event last year and they're talking about how awe the response of awe in the body actually decreases inflammation response so in that space where the body is not in an inflamed position you actually are able to learn you're actually able to take in information and so thinking about that in terms of how do we create awe with the natural world and allow people the space to explore and then this connection through food another member of our conversation said that the entry point into caring about the natural world is so often through food and so we have all of these conversations we've been talking about for the whole week and we bring this food and this awe and this wonder and this spaciousness and all of a sudden there's there's nutrients in the body the epigenetics are in alignment to actually taking the information so I think just pulling all of those together and just so happy that this conversation is here on a farm surrounded by food where we get to taste the food in a few minutes for lunch so we're just about to go we're a bit late for lunch but we'd love to thank you all for the time that you've made and really appreciate the conversations on holistic and community oriented education thank you very much


What's up everybody? Jason from Jasper's case breaks.com 2017 Panini contenders optic two box break random team number three just sold out And again 32 spots guys Everybody gets a random team the NFL chase patty my home's rookie on card autographs and again guys two boxes here Here's the dice. Well, there's a cousin ran so from Matthew s all the way down to David got those spots Straight up and then from Eric from optic mega eight. I'll lay down a Sean optic mega nine So here you go. Good luck everybody. Let's roll it. You got ourselves a full 12 12 times. Good luck one Come on round that oracle come on two three four five six seven eight nine ten 1112 12 times David down to Greg 12 times one two three four five six seven eight nine ten 11 12 Colts down to the Saints David you have the Colts Sean with the Lions as well as the Falcons Kobe with the Cowboys Greg with the Vikings Michael the Panthers David last spot module straight up with the Chiefs and you with the Jets David with the Bills Sean with the Bears Eric Give the Rams Kobe with the Patriots Cardinals Sean you have the Packers Adam with the Ravens Sean with the Dolphins Adam with the Bucks Kobe with the Jaguars Brandon Brandon, sorry, but my Eagles Sean with the Titans David with the 49ers Giants Kobe with the Chargers Josh with the Raiders Kobe with the Texans Gordon with the Bengals Matthew this 49 Washington football team Sorry Kevin F with the Steelers Matthew the Seahawks Sean with the Broncos Kobe with the Browns and Greg with the Saints So if anybody wants to trade, I'll give you guys a quick minute All right, I texted Nick to guys because I don't see any more of these boxes to use for fillers So I want to figure out what box I can use so I can repulse another one of these Give me a quick sec. I have a blue tape here. You can use it for now All right guys, I don't think we're gonna trade the Jets for the Chiefs, but nice trying though, Anthony. Good luck Guess nobody else wanted to try to trade Here we go guys two boxes. Good luck everybody. Remember 17 contenders optic We have room for at least two more breaks guys Marcus Mariota and rookie round numbers that is Solomon Thomas and Derek Derek Barnett And Mariota is number two ninety nine So this will probably be randomized here So 49ers would be David Eagles is Brandon. So we'll have to do that as a randomizer there And then we have Jehu Chisholm Chisholm sir And Jameson Crowder We got Cole Stacy the 75 that is a rookie ticket out of 75 Minnesota Vikings with that one that is Greg Oh, good lord. That was close Karim Hunt for the Chiefs David I forgot totally for how Karim was a rookie the same year Whoo, we are so close on that one On ticket on card rookie ticket and there you go first box Yeah, I mean he's kind of helped bring back his career a little bit being with Cleveland All right, we have Drew Brees and we got Super Bowl contenders that is Braden Cooks to 99 But um, you know, obviously With his pass a little bit kind of brought him down to 199 Drew Brees right there as well Trevor Simeon, Carson Wentz So we have a redemption right there And Kenny Gholiday for the Lions At least we got two pretty decent rookies That is Sean Maddock with the Lions now, of course, are the Giants, I believe The redemption shouldn't be a crazy player could it be rookie ticket autograph card number 149 Marshawn Latimore, which I believe should be Saints Yes, actually still with the Saints as well So New Orleans Saints that's going to Greg All right guys and there you go Karim Hunt Kenny Gholiday That was the break right there. We do have one round. We need to do really quickly That was for the 49ers and Eagles. So let's get that done guys Team at number one at the top gets that hit And I'll post up another two boxes We have at least four more boxes left two more breaks Could still be a patting my home's hiding one of those last four boxes guys Or still at least another big rookie quarterback 49ers and then we got Eagles There we go Roll the dice Five out of three eight times. Good luck one two three four five six seven eight eight times 49ers on top. So there you go 49ers are getting that one and that's David So I appreciate you guys again. I'll post up another one Jaspy's case breaks.com