So it is my great honor and privilege to have joined this university just in time to bask in the glow of this wonderful honor being bestowed on our colleague, Randy Scheckman, and to have the opportunity this morning to introduce Berkeley's 22nd Nobel Prize winner. And as you all know, and you're all here because of this, there's no prize, of course, that calls attention more globally and indeed more spectacularly to the importance of pathbreaking research than the Nobel. And this is the first Nobel, even though it's the 22nd for UC Berkeley, but it's the first in the category of physiology or medicine which makes this moment even more exciting for us here. Berkeley, of course, is known for its excellence in many, many areas. We call it comprehensive excellence and we actually mean that. And today's Nobel Prize is another illustration of the importance of that and indeed of this institution, all research universities, but also as my two distinguished colleagues before me just said, in particular it calls attention to the importance of public research universities that do so much to support cutting-edge research for the public good. And it's absolutely critical to acknowledge that while people have recently been talking about the decline of public universities and the decline of public research universities, first of all, it ain't so. And secondly, it's absolutely critical that it never be so. Our biological sciences department in the College of Letters and Science along with all of our science departments and programs and areas are working on a wide range of challenging problems that will ultimately help do very concrete things for the public good, including, as in this case, find new kinds of cures for diseases and change lives for the better. And as you've just heard in the case of our Nobel Laureate this morning, for at least a dozen years, Randy Schekman's been working on a cure for neurodegenerative diseases about which all of us know for most of us have been directly touched by these diseases in one way or another. But Randy is a trailblazer in the field of biochemistry. He's best known for identifying genes that control different facets of the cell's transport system. And the Nobel assembly has recognized him, and I quote, for his exquisitely precise control system for the transport and delivery of cellular cargo. Now, I thought you were in the Department of Biology, but that's, Randy will explain to me exactly what all that means when I have a moment to get him after all the laurels. But he's an investigator, as was mentioned, not only here, but he's been supported by the Howard Hughes Medical Institute. And it's very important for us to recognize the importance of HHMI in the critical funding they made possible for the work of Professor Schekman over the last years to enable him to do the kind of basic research that makes these kinds of prizes, of course, possible. Now, Randy is no stranger to achievement. Just over 10 years ago in 2002, he shared the Lasker Award for Basic and Clinical Research. The Lasker is among the most respected prizes for science in the world, and is considered the American equivalent in some ways of the Nobel. 86 Lasker laureates have gone on to receive the Nobel Prize, including, I understand, 32 in the last two decades. That just went up from 31 to 32 this morning, of course. Now, Randy was born in St. Paul, Minnesota. His family moved to Southern California. Some of you heard this before we began, that he went to high school in Whittier. And even during junior high, he was hooked on science fairs, and according to my notes, received not just medals, but cash prizes at regional and state competitions. So he decided to go for the cash prize that beat all cash prizes in the field of science fairs. He went on, of course, to study at UCLA, as you heard, where he worked on DNA replication, and then did his graduate work in molecular biology at Stanford under renowned biochemist Arthur Kornberg, and earned his PhD there in 1974. But it was during his postdoc at UC San Diego, the second of three UC campuses that have been blessed by his presence, where he began to focus on this easy to grow microbe that I even know about since its baker's yeast. In 1976, he was offered a post in biochemistry here at UC Berkeley, where he began to focus primarily at that point on yeast genetics, and he's never looked back. I recently had the opportunity, in fact, to have breakfast with you, and it was a grand breakfast. We talked a little bit about his own research about the tradition of excellence in the biological sciences at Berkeley, and he also told me about his real and huge commitment to public higher education, to the University of California, and told me about how important it was that he got his start at UCLA and has had his full career here at UC Berkeley. And this is not for once of offers from all sorts of institutions. This is both because we support great science and great research here, and because our scientists are deeply committed to the public mission. So we are indeed hugely honored to have Randy as part of UC Berkeley's esteemed faculty. And as you heard, there's something else that goes along with this prize. Some of us sometimes think that the Nobel is so important precisely because of this award I can now give. It's a very important award. I got a parking ticket over the weekend myself that I have to, I did, that I have to settle after this press conference. But on behalf, on behalf, no, no, out of the pride. I need a cash prize. So on behalf of the University of California, Berkeley, I not only recognize Professor Randy Scheckman for his grand accomplishment as a Nobel Laureate, but conferring you a lifetime parking permit. The greatest honor we can bestow, Randy Scheckman. Thank you, Chancellor Dirks, Steve and Richard. Well, I never imagined being here to deliver these remarks, but let me start by crediting the people who made this day possible. My wife, Nancy, is here. My kids, Joel and Lauren are not here. They're often living their own lives in Michigan and Oregon. But let me look back and credit the people who really made my career possible, starting with my high school biology teacher, Jack Hoskins, who wrote me this morning to say that I had now replaced Tiger Woods as the most eminent graduate of Western High School. To my undergraduate research advisor, Dan Ray at UCLA, my graduate mentor, Arthur Kornberg at Stanford, John Singer, my post-doctoral mentor at UC San Diego, and then my wonderful colleagues here at Cal, starting with the most revered of them all, Dan Koshland, who was chair of the biochemistry department when I was hired as an assistant professor in 1976. When I started here as an assistant professor, I had the idea of studying how protein molecules are shipped out of a cell by a process called secretion. I had experienced in Arthur Kornberg's lab at Stanford the beauty of a dissection of enzymes involved in complex cellular processes. Kornberg was perhaps the greatest biochemist of the second half of the 20th century, and he taught me how to take a complex process, in that case DNA replication, and tease it apart molecule by molecule using the tools of the enzymologist in protein dissection. I took that message to heart, though not quite in the way that he had anticipated. And when I started at Berkeley, I wanted to set the stage for such a dissection of another cellular process, the process of protein secretion, but instead of relying entirely on Kornberg's advice, I relied on the example of a pioneering yeast geneticist by the name of Lee Hartwell, who used genetics to take apart the cell division cycle control pathway. I learned from Hartwell that genetics was a powerful tool to understand at, I would say, a descriptive level how a pathway operates, and so I embarked in 1976 together with a spectacular first year graduate student, Peter Novick, in the isolation of mutations that block secretion in yeast. We started with the idea that the genes that are required for the movement of the proteins within a cell would be essential for the viability of the cell, and we used genetic techniques that match that goal. Now, I have to emphasize that we started with no practical application in mind. We were interested in basic cellular mechanisms, and though the work has evolved considerably since then, that remains the fundamental core of my interest and that of my colleagues, that is how cells work. Knowing from many other examples that through basic science, through the application of fundamental principles, that practical applications would ensue, and so it was gratifying, though not of my own, my own direct goal, that the biotech company Chiron and Ed Penhode, our local colleague, developed an interest in using yeast and using the information that we had gained to try to engineer the expression and production of biologically and medically useful proteins. They showed very quickly that one could take a yeast cell and introduce a gene from the hepatitis B virus, and the cell would produce virus-like particles employing the pathway of protein secretion that we had charted by genetics. That development, really dramatic development, led to the production of a vaccine that now represents the entire world's source of hepatitis B vaccine, expressed in baker's yeast. They then, with some advice from me, were able to harness the yeast system to express and secrete very large, commercially viable quantities of human insulin and now one third of the world's supply of human insulin is produced by secretion in yeast. These were anticipated, but nonetheless, inevitably, the direct product of the investment, not only of this institution, but of the federal government in basic science. When I started, though I had no experience in this, I was full of confidence, perhaps too much confidence. I wrote my first federal grant to the NIH and was rebuffed with a, what basically was a triage, telling me that I didn't know what I was talking about and I may know how to pipette E. Coli, but that I certainly didn't know anything about yeast. Fortunately, again, with a little bit of money that came from the department and a generous, though small grant to begin with from the National Science Foundation, Novik and I were able to embark on a several year project to isolate mutations that block secretion culminating in 1979 with a publication in a journal called The Proceedings of the National Academy of Sciences in a paper that was communicated by my then chair, Dan Koshland. Now, when I started at Berkeley in 1976, my first faculty meeting was one that Koshland led and it was on the occasion of the recent election of our colleague Clint Ballew to the National Academy of Sciences. Many of you know Dan Koshland will not be surprised by the remarks that he made on the occasion. First, there was a round of champagne to toast Ballew's achievement. And next, as Koshland raised his glass, he said, well, congratulations, Clint.  Many years later, I followed in Dan's footsteps to become the editor-in-chief of the PNAS. And we had a celebration in honor of my colleague, Michael Botchan, who had just recently been elected to the National Academy. And I offered a toast to Michael and I said, well, congratulations, Mike.  So I have had the enormous benefit of the investment by people in the state of California and the federal government in my science. I'm grateful particularly to California for what it did starting with Pat Brown Sr. with the tremendous growth in this system, the University of California. I came from a middle-class family. There was no prospect of my going to a private institution. It never even occurred to me. My parents, in fact, wanted me to go to Long Beach State because they didn't see how they could possibly afford to send me to the University of California. But at the time in 1966 when I started my freshman year, the fees amounted to $40 a term. Room and board was $400 a term and I could work a summer job and pay for the entire school year. My father was able to send five children to public universities and never had to spend any money. Unfortunately, as you know, this is no longer true. The tuition fees for even for in-state residents has escalated dramatically. My daughter went to Cal, studied economics, graduated seven years ago and the fees then were only $2,000 to $3,000. They have dramatically increased since then. It really is a shame that kids who come from a middle-class family now have the additional burden of having to worry about these funds. Nonetheless, many of us are here, will stay, will continue to invest in public education and I intend to use whatever glory comes to me to the benefit of this institution to spread the word about how important public higher education is in this country. Thank you.


Hi everybody, I'm Anthony. I go by coin and I'm one of the developers of Starkiller and Empire. I'm also here with Jake and Vince Hey, I'm Jake. I go by Hubble. I'm also one of the developers for Starkiller and Empire And I'm Vince. I created Starkiller and I'm the lead developer So we're gonna be talking about Starkiller today, which is our threat emulation platform that we use for red teaming What this allows us to do is to have an intuitive interface that multiple users can log in from and interact with the team server As well as it has some hooks built into it to the mitre attack framework that gives links to techniques within side of all our modules And what this setup allows us to do is to have our teams most accurately emulate the threats for assessments Since we're trying to emulate that threat what we're really focusing on is trying to make sure that we're replicating their TTPs Those tactics techniques and procedures Since it's what we're this is what the threat is going to use to obtain their objectives We're gonna make sure that everything we do and our tests focus around what the threats going to be and be representative That includes our infrastructure. We want to make sure that our infrastructure mirrors exactly what an APT Setup is going to look like for example our stagers pay and payloads as well as our implants will mirror the threats Our setup will typically include multiple operators across different locations all connected to the team server They may be spread out as well to make sure that everything is segregated So that way if one server goes down, we're not going to lose our entire operation and burn it We want to make sure that our our infrastructure mirrors what the threats going to do and are going to be able to emulate What they're going to be running for their attacks So what you kind of saw in the diagram before is is that Starkiller is the UI that connects to our team server so Starkiller provides a UI on top of the the C2 server in this case Empire and it allows us to Interact as a team. So we have multi-user support. We have a live reporting interface So anytime a team member runs a modular command We're able to instantly see those those commands through the interface and it simplifies a lot of the workflows that are a little bit More tedious through the CLI So as we mentioned and Starkiller is a GUI interface that interacts with the Empire C2 server Empire is built on PowerShell and Python for those of you that aren't aware With the addition of Starkiller can now be ran as either a team server and all in one C2 Which means just a person's running the C2 on the command line directly like there's no other infrastructure required for to run that C2 Has a bunch of adaptive modules are up to about 300 now and then the original project ended support Back in August of 2019 But we forked it and have been Maintaining and updating it ever since which is why we built Starkiller on top of it and we really built Starkiller to address some of the shortfalls that Vincent meant Mentioned to allow for threat emulation and just like a modern red team engagement when using Empire as your primary C2 So ever since we forked Empire when it was originally when support was originally ended We asked a lot why we still think PowerShell is important Because there's a whole bunch of mitigations in place, you know extra block logging and AMZ and All those kinds of things that do make PowerShell much more difficult when it is implemented properly But even though red teams have started moving on to C sharp and other dotnet tradecraft and Microsoft to start kind of focusing protections elsewhere PowerShell is still a huge attack vector. It's wise like every day by APT's Crouch right came out with a report in 2019 that said as many as 90% of breaches Use PowerShell in some way now that doesn't mean that PowerShell is their primary means of operations or Even this the majority of what's being done But it's still used in 90% of breaches according to crouch right so we still think it's really worthwhile for red teams To emulate threats using PowerShell because even though all those mitigations do exist for it We still see many many organizations that are vulnerable to PowerShell because they don't have those mitigations properly implemented So what we have here is our team server setup running Empire. We also have multiple star killer instances all connected to that team server That team server is then sitting in a secure location That could be either in the cloud or that like one of our offices There is then a secure line directly into our server or cloud server. In this case, it's AWS That cloud server is then going to reach out to all of our redirectors We had these multiple redirectors up in case one of them gets burned and that way if it does happen We don't lose our entire infrastructure Why we do this is this setup allows us to rebuild certain parts of our infrastructure very easily So we don't lose critical pieces Yeah, and then just another advantage of setting up our infrastructure this way Is it allows us to really lock down our Empire server on top of Using like reverse port forwarding to connect to the AWS server so that the Empire server can't be accessed directly from from external our Network we can also lock down it it down internally because we can basically lock everything down except for the Starkiller ports and That way if our network is compromised it limits the ability for an attacker to Access the Empire server and more importantly access the customer data that we're going to be handling since many times that data is extremely sensitive so really the the main two goals for Starkiller for us is one we want to make our Our workflows for red teams to be more efficient and we do that by Eliminating some of the menu options that were in Empire and making them more simplified Previously in Empire what you had to do is you had to memorize or go through multiple menus to be able to set up your listeners your Stagers and your modules Through Starkiller what you have now is you have these menus that are pre-populated Sometimes they have drop-down menus and this makes workflows much much easier for teams The second thing is the team-oriented engagements With Empire previously you can only have one person logged in at a time They're using that command line interface and if somebody else wanted to do engagement get to stand up a completely separate server Now with Starkiller you can have multiple users all using the same team server They can share credentials They can share their results from their modules and they can generate a single report for their entire engagement Yeah, and then just to add a little more to that We're good. We plan on future growth for this capability as well But it also provides more oversight for the team lead by giving them a centralized location to see what their operators are doing What things have been done as well as like when things are ran on individual boxes and that kind of thing isn't a centralized location to See all that data and keep an eye on the operation as it's progressing So setting up Starkiller is fairly simple when you run Empire you're going to pass the rest parameter Which tells it to run the rest API? There's a default login and password which you can change and then to actually run Starkiller You can either download the installer for Windows Mac OS or Linux off of the releases page on github or There's instructions in the read me to build it from this horse All right. Thanks guys. We're going to demo the features of Starkiller now So Vince has a instance set up already back into our personal range Where Empire is already running on a team server and then we have Starkiller connecting into that Okay, so this is the Starkiller login page. I'm going to log in using the default username and password And we're connecting to an Empire instance that we have that we already have running When I go to the settings page We can change our password. We can Turn dark mode on and off and we have access to our API token for For connecting to the Empire API This is useful if you want to Interact with the Empire API outside of Starkiller or if you wanted to use some other tool like that star to interact with with Empire API The next piece is the user management page So on this page we get a list of of all the users that have an account for Starkiller We can see when they when they last logged in and we're able to Enable and disable those users I'm going to go ahead and create a user account for myself With the password of password and We can see that I now have an account So the next thing is the modules list page So this page gives you a list of all of the modules that we have access to in our instance of Empire and Using the search box. We can search down by the name of the module. We can search down by the miter attack techniques and also The descriptions of the modules. So here I'm going to filter down by a miter attack technique And I get the two modules that that are in this in this technique and if I click into it, it'll bring us to the To the webpage for that miter attack technique so that we can get more information about it And then here if we expand an individual module We can get the author information We can get the description about that module and then often the the comments will have a link back to the source Material for that module Okay, so this is the listeners list page and here we can see all the listeners that have already been created in Empire So let's go ahead and create another one We're going to choose a type and then once we choose that type we get the form prefilled out with with all the defaults and we're going to go ahead and just update this so it doesn't overlap with the previously created and Any optional fields are just in this expandable context here I'm going to submit and that listener has been created The next page is the Stagers page Stagers are the initial payload that we send to the agent to initiate the connection back to our C2 server So you can see that we already have a couple stages created here But I'm going to go ahead and generate a couple more So the first one that I'm going to create is a multi launcher and We're going to have it connect to the listener that I just created and we're going to keep the rest of the settings the same Up here. I can expand the information box and that'll give us some more info about the Stager Okay, so that one's been created now. I'm going to create one more This one is going to be a downloadable DLL And again, I'm going to choose the listener that we just created I'm going to hit submit Okay, so now that we've created those two Stagers we can see Some information about it which listener it connects back to the language and When it was created and then over here we have the ability to copy or download So this first one that we generated multi launcher Has a little paperclip icon and when you click that it copies it to the clipboard Because this is like a one-liner that you can then paste into a command prompt or your your PowerShell window and The second one here has a download icon Because it's a file and you can download this file and then get that to your target. However, you need to get get it to them Yeah, and something that's really nice about this over Empire is that our Stagers remain persistent Not only for when we change between menus But also like if you log out of Starkiller and then log back in like your agents will still be there Because in Empire as soon as especially when we create like one-liners as soon as we move to another menu It's gone and we have to regenerate it and then cut and paste it and save it and all those things Whereas Starkiller just keeps it all in one place for us and saves it between You know sessions and all that kind of stuff Which is just significantly more convenient than operating directly in Empire Okay, so now that we've Sent those Stagers out. We've gotten some some callbacks into our Empire server And so that brings us to the agents list and here we can see all of the agents that have called back to us We can see the last time they checked in we can see the username of the account that we're connected to and if we click into it that brings us to Probably the screen that you'll spend the most time in when you're using Starkiller, which is the agent interaction screen And this is where I'm going to hand it off to Quinn to talk about interacting with agents So we have here is our agent screen as Vince talked about before this allows us to do our shell commands As well as execute modules of the couple nice features here All we can see at the bottom is Hubble actually just ran something this interface allows multiple users interact the same agent And every command that you run is going to be tagged with the username that you have associated with yourself So for example, I ran earlier I set my beacon to be delay zero and I ran that command under my Empire admin account Well, Hubble ran who am I and then he got his results back I can also go in here and I can go to shell commands I could type in ps just like they would in Empire to get my process list It's now going to run that it puts it in a queue all commands are set into a queue Regardless of who sends it and I'll execute that queue throughout and then drop all the results in this screen Your results aren't just going to be in this screen. It's also saved in a database that then gets populated on a reports page So everything everybody does will be aggregated together into one master log You can see here the process list just came back so you can come in take a look I can scroll through and see all the different processes that are running As well as I can also adjust the size of this screen if I wanted to expand it a little bit as well Next is the modules. So you have access to all the modules that are inside of Empire It's nice because you don't have to navigate all the menus. You can actually come in here and just type in exactly what you want to run I can type in mini cats in this case. We're actually going to run Sherlock I come in select Sherlock just a nice little tool that'll allow me to look at some privilege escalation opportunities We still have access to those Miter attack techniques from before so I can click on those As well as a description and an information about the module. I want to run So once I hit submit It's going to run that module It's going to queue it up and then we'll get the results and we can see that later in the reporting function Next we're going to go over into a elevated process agents that way we can show off another feature So now I can come in here now that I'm in an elevated process I can go in and run Some techniques that maybe I don't have access to under a normal user such as mini cats So I'm going to go in I'll pull up mini cats. I have all the same interface stuff as well I'm going to hit submit there as well. So now both of those are queued up and I can see those results later Inside of my reporting function So now we're going to look at the credentials page and you can see here We already have a couple entries from running mini cats And so the nice thing about this credentials page is it's central to everybody all of the team members engaging On this empire server. So whether I run mini cats or Hubble is is getting credentials They're all going to be dumped to this page and we can we can all see all of the credentials and These password hashes are going to be useful to us when we want to try to do lateral movement Now the the last piece that we want to show you a star killer is this reporting interface it's going to Show you in order of when it ran when a command was run on an agent who ran it and What the response was so for example? This is the last command that was run We can see that it was run by empire admin, which is me And we can see The agent that it was run on and we can see the full output of of that command And now just a side note here You'll notice this function name is just a random five character string That's one of the the features that are built into empire For keyword randomization. So this function name is just a random five character string That string is typically known as Mimi cats. And so that randomization just allows us to Prevent strings that are known flags from showing up in memory when empire is being ran Okay, so now if we expand another one We can see the output of the ps command in in its entirety And this page is really useful to the The operator of the the engagement so that they can get a holistic view of all of the different things that are going on during the engagement So at the at the bottom of star killer, we have links to the empire and star killer repos We'd love to get feature requests and bug tickets that we can fix And we look forward to your feedback


Hello and you're very welcome along to the first-ever episode of Highland Radio Carpool Karaoke with me David James and some very special guests over the next coming months. We want to say a big thank you to our friends at DMG Motors because they have very kindly sponsored us. This brand new beautiful Skoda Kodiak. We are just on the way to pick up our first-ever Highland Radio Carpool Karaoke guest. So stay tuned to find out who could be. Just you yourself, comfortable. The man, the myth, the legend, Connell Gallin is here to be saved. Connell, what's the crack? I haven't seen you since Spain. It's what do you call it? Calpe in Spain. Calpe? In Spain. I was there for a while. You were there for a while, right? You were there for about what? You must have only been there for 12 hours. Yeah, something like that, yeah. So Connell, do you know what I was wondering? And you know, like whenever you ask different country singers how they get into music, it's similar for me like because music was say always in our house. But how does a man get into comedy? In my case, by pure accident. Is that so? Well, sort of by accident. It started off an amateur drama. And I didn't even want to be an amateur drama. I called for a friend of mine. He was in amateur drama. We were going out to see two women. You were what? We were going to see two girls. And we were both young. And like a curtain, sort of? A curtain job. A curtain job, yes. Well, hopefully. When I went in, the director of the production, the drama circle, and somebody hadn't turned up so they were running slow. And he says, would you mind reading this? So, you know, this part and we'll get through it quicker. So I read it and I enjoyed it. And then he said to me afterwards, I think they didn't have anybody for the part anyway. But he said to me afterwards, do you fancy doing this? And I said, yeah. And I got into it and I loved it. I still loved it. Wait all the tapes and horse it into your synth there. That was number one for me in our house. How did that song come about? I was down doing a show in the Royal Theatre in Castle Bar. And I have a lot of friends down there over the years that I met through tours and stuff. And I was up in the bar talking to a whole load of them before the show. And I looked at the watch and I said, look, I've got to go to the dressing room and get ready. And two of the ladies were there with friends of mine. And one of them said to the other, she said, horse it into your synth there. Which it really means, drink up. We're going, you know? And I said, well, what did she say? I said, horse it into your synth there. Did you never hear that? I said, I haven't heard horse it into you. But I never heard synth there. So that stuck in my mind. And on the way home that night, I had the song sort of written. Horse it into your synth there for you, the girl for me. You're the finest looking filly that I'd ever seen. You're the onions in the burger, you're the sugar in the tea. So horse it into your synth there for you, the girl for me. Take it away now, Colo. Well, I met her in the bar room in the town of Kilchimock. She was sitting at the counter, knocking double, running back. She wore a low-cut candy and a skirt of her name. So I horse it into your synth there for you, the girl for me. All together. So horse it into your synth there for you, the girl for me. You're the finest looking filly that I'd ever seen. You're the onions in the burger, you're the sugar in the tea. So horse it into your synth there for you, the girl for me. Cynthia, if you're watching, I would love to meet you. I wasn't prepared for all this danger and excitement. You're never done because you're writing new plays and you're out on the road with new plays. You did? Yeah, we were lovely. It's called The Morphys, banged up abroad. Very good. Sounds like some sort of TV show. Title of that there. We could have another book of that next year. The next time we go back to Spain, David James and Connell Gallan banged up abroad. We'll do a carpool karaoke. Connell, I think we should finish our carpool karaoke with another song. I think it has to be the in-the-show and favourite, Anna from Bunker Anna. Listen, she's been very good to me. Any guards listening, it was totally fiction. I know where she is. One, two, three. Her name is Anna. Where's she from? She's from Bunker Anna. Oh, yes, she is. She's a member of the guard of Siacana. She's the pride of Templemore. Now she's up and doubling four. And God help you if you're spoken. Let's hear the trombone there, Connell. Take her away. Everybody thinks the country's gone ballistic. You just need to look at recent crime statistics. Right now, Connell. Give her the full welly. The semi, you ready? We're ready. Are you ready? Her name is Anna. She's from Bunker Anna. She's a member of the guard of Siacana. Oh, yes. She's the pride of Templemore. Now she's up and doubling four. And God help you if you're spoken. Let's hear the trombone there, Connell. I'm Anna from Bunker Anna, and you're under arrest. Oh, my God. Hopefully it's not me. This is all your fault. Dammit. If you hadn't a song. Her name is Anna. Where's she from? She's from Bunker Anna. Oh, yes, she is. She's a member of the guard of Siacana. She's the pride of Templemore. Now she's up and doubling four. And God help you if you're spoken.


The Co-Evil AMR project has developed a comprehensive guide to help decision makers select the most appropriate surveillance tools for their specific needs. The guide provides an overview of existing tools, as well as advice on how to select the right tool for the job. It also includes case studies to illustrate how various tools can be used to evaluate surveillance systems. This article was authored by Simon Aruge, Nicholas Antoine Moussio, Ceciline Chainslin, and others.


Welcome to theCUBE's presentation of the AWS Startup Showcase, the next big thing in AI, security and life sciences. We're here in the security track and in this segment we feature sequence security. I'm your host, Dave Vellante and today we're joined by Subu Ayer who is the Vice President of Products at Sequence Security. And we're going to discuss the importance of rapidly discovering and addressing common API security gaps. We live in this API economy and there's dangers out there. Welcome Subu, great to have you in theCUBE. Thanks Dave, I'm happy to be here. Look, every week there's some other report and the paper and the news, high profile security breaches. I'll know about the Experian breach, the clubhouse is a pretty popular app and many, many others. But you know what's perhaps more scary is the ones we don't hear about and there are a lot of those.  So Subu, in thinking about your customers and how they're using your solution, what are some of the patterns that you're discerning and how are you addressing this problem within your community? Yeah, APIs are a very common avenue for exploiting vulnerabilities in applications and what we are discovering amongst our customers is that there are elementary gaps that are being left behind in APIs. For instance, APIs that are completely unauthenticated practically like leaving your front door open and allowing anybody to walk in. I mean, there are APIs that are unauthenticated, APIs that are exposing sensitive information like credit card numbers, or social security numbers completely out in the clear, or APIs that are using weak forms of authentication that are very easily bypassed. The OASP API top 10 is actually a pretty good handy list for people to look up and we see many of those as being very commonly seen on vulnerabilities in APIs. Yeah, I mean, the adversaries, they're experts at automation. They knock on that door. If it's open, they come right in. And they don't even have to manually do it. They're just automatic. But so talk a little bit more about that problem of poor API visibility in this world in which we now live. Yeah, you nailed it. I mean, visibility is the number one thing that everybody should be thinking about. In an age where APIs are ubiquitous, like everything talks to everything else via APIs, lack of knowledge of how many APIs there are out there that a customer has exposed is the number one challenge that anybody should start with. Getting your arms around the problem statement of how many APIs do I have that are publicly exposed or privately exposed to other organizations is really where it all starts. And once you have discovered all those APIs, then you basically look at what risk those APIs pose to you. Like how many of those APIs are unauthenticated? How many of those APIs are using very weak forms of authentication or are exposing sensitive information or subject to some of the other commonly seen risks? You know, authentication is the other area. Not just humans, about machines as well. So this is a critical weak link. And it's fraught with complexity. You got multiple devices, you got service connections and it's very error prone. How much of a problem is this and what can we do about it? Authentication is actually the most basic and the most commonly seen vulnerability or flaw in APIs. The most common flaw that we see in APIs is the problem of APIs not having any authentication at all or having very weak forms of authentication to kind of go back to our front door analogy. That's like either leaving your front door completely unlocked or leaving your front door locked and leaving the key under the door mat hoping that nobody is gonna pull up the door mat and find the key in there. It's pretty much the equivalent of that for APIs that we see. That's really the gamut of like authentication related issues that we see. Like in that ballpark of either weak forms of authentication that attackers really don't have to even break a sweat to kind of find their way around and walk in. You know, I recently wrote about this and I wanted to ask you about another disturbing trend that we see and that's, you know, adversaries they're looking in our environments and they're stealth. You know, they're living off the land and using your tools against you so you don't even see them a lot of times. And while they're there, they're exfiltrating troves of very valuable information. In one study I read they were committing fraud and identity theft, but they were also stealing sensitive data so they could act on it like front running a trade. And so, and then they would hold that data, that sensitive data and other example it was a healthcare data, private information. They'd hold it on reserve, so to speak so they can extort victims once they're discovered and there's an incident response. So this exposure to sensitive data, it's an enormous problem. And I wonder if you could share your thoughts on this topic and how to help remediate it. Yep, sensitive data exposure is another one of the OS API top 10 it's something that we see pretty often with APIs. And you're right, adversaries basically look for avenues where they can exploit the sensitive data flaws that an API may have. And common ways of doing that are maybe the attacker discovers the or finds the mobile application for that particular application. It may be a retail app, a finance app and the user may create a valid account in there. So get in there as a valid account and see the APIs that are being communicated by the mobile app with the API backend. And then see if they can retrieve other people's information or that same API by changing the user ID or other tokens that they are sending back. And if they are able to break in and they are actually able to get other users information that's basically data exfiltration. And they just run that in a script and are able to exfiltrate lots of data from the API backend. If the access control on the backend is weak and this API is really not protected very long. So one of the key things that we do in sequence is provide visibility to our customers about which APIs are exposing sensitive data information what sensitive information are they? So are they credit card numbers, social security numbers some other proprietary identifiers that the customer may have and really how are they leaking this information? Is it in the response body? Is it in the response header and so on? So we really give them the ability to hone in on where the leakage is happening. Okay, so full visibility, talk a little bit more about that. I mean, can you share a little bit about your secret sauce, if you will your kind of unique approach to solving this problem? Yeah, that's a good question. So sequence is in the business of providing continuous visibility and monitoring and protection to customers for their public facing web applications and APIs. And we do this by essentially providing the ability to start with two customers to discover all of their public facing APIs. And we do that by essentially tapping into their network at various points. We can tap into an API gateway, a load balancer or really deep into their microservices applications to tap into their modern API based applications as well. And by tapping into multiple sources within their environment, we are essentially gleaning a complete picture of what their application attack surface looks like. So all of these become what we call sensors that essentially communicate information back to a central repository and aggregate all that information together and then produce this visibility of saying you have however many APIs. And then that's where a lot of analysis happens to see who is communicating over these APIs. Are we getting traffic from external sources, internal sources? How are the API communications happening? Is it in clear text and so on? And that's where the visibility really happens. And these so-called sensors, they're sort of embedded as part of your service. So I'm acquiring a service from you, correct? Maybe you could describe a little bit more about how I interact with your product portfolio. Yeah, yeah. So our technology is flexible enough that it can be completely deployed as a software as a service. So needing nothing to be deployed on a customer's premises at all. Or it can, or we are flexible enough to actually support on-premises deployments for some of our larger customers like financial app customers or other data privacy related customers who would rather have this infrastructure on their premises. And these sensors are really these little modules that go in their network environment. So they are easy to deploy, easy to integrate with any network-based options like load balancers or firewalls or API gateways. And really the backend can be consumed either as a software-based application like a Docker or Kubernetes application on the customer's premises or consumed within the sequence cloud. So needing absolutely nothing to be managed or maintained by the customer at all. So really the customer to start with essentially comes to sequence and says, hey, how do I get an environment up and running where I can play with my, where I can discover my APIs? And we can spin up an environment in our cloud in a matter of minutes or hours. And before you know it, we can drop a couple of sensors in their environment and we are discovering their APIs. And then what? So if you discover some APIs and the key under the doormat, so to speak, what do I then do as a customer? And how do you help me accelerate that remediation? Excellent. And that's where one of the important aspects of our product called mitigation comes in the picture. Mitigation is a remediation action where a customer can actually take action in the runtime to actually stop some of this bad traffic from happening. For instance, if you see an API that one of the common things that we discover in APIs are what we call shadow APIs. So when we talked about API visibility, what a customer discovers is all of their known APIs and unknown APIs. So known APIs are the APIs that they know about. Oh, that's my payment API. This is my billing API and so on. And they also discover APIs that they did not know exist like a newer version of an API that the development team has exposed. And they go, wait a minute, when did, how did that get exposed to the public? We haven't even done a security audit of this thing. So if they see APIs like this that should not have been made public but are public and are being used, they can use sequence to essentially block traffic to those APIs, these unreleased APIs or these hidden APIs that should never have gone public but are public either because of unintentional mistakes on somebody's part or because of certain compliance loopholes or something that these were made public. So we can take action and take and prevent a traffic from hitting these APIs. And I would imagine, Subu, that, I mean, every environment's different. I mean, I would imagine people make the same mistakes across different environments, but every environment is really a snowflake. I mean, it's an individual configuration. And so, but I wonder, are you seeing, we have sort of was my first question, what kind of patterns are you seeing? But are you seeing customers exposed in sort of the same areas? Or are you seeing like I'm describing, every situation is different? We do see situations being different. I have seen environments where the production environment was actually had a weaker security posture than a development environment. That was presumably because the development environment was running a newer version of their application. So it had plugged some of these API gaps, was not leaking sensitive information, but the production environment is running an older version. So it had flaws that the development environment did not. And I've seen vice versa as well. So really it depends upon like how their CICD processes, how soon are they able to get these applications into production and so on. And accordingly, they put in actions in that, let's say in the appropriate environment, the dev environment or the product environment to stop these attacks from hitting that environment.  Are they then, you know, it's kind of a cliche, but shifting left, you know, where they're building this in to their development process, as opposed to saying, okay, we've just deployed, now let's call sequence in, right? Are you able to align with the development lifecycle more closely? Yeah, yeah, that's an ideology that we do here at sequence. What we say is shift left while shielding right. What that means is, yes, shifting left is an important strategy for you to essentially take these actions earlier on in the development process before these APIs become public. But one of the key tenets of application security is to shield your applications from bad traffic. Shield your applications from these attackers who are trying to enumerate these IDs and trying to expel great information. So you need to protect your applications from bad traffic. So while shielding right, we allow customers to start shielding left so that they can start testing some of these APIs before they go into production. So before these APIs even become, see the light of day, let's say a newer version of an API, we are working with customers in that journey so that they can find this sooner and sooner in the development lifecycle. So yep, we absolutely see that as an evolution for customers. Thank you for that. So I got two more questions for you. And the first one is kind of a fun question that the CUBE team wanted to ask. We're asking all the startups, remember the event, it's all about cloud scale. And so of course, when you launch a company, a startup, it's exciting time, you're innovating, developing new products, moving fast, breaking things, helping customers out, disrupting all those cool things, growing the company, increasing revenue, great. But there's more even. And so what we're asking folks like yourself, Subu, is what is your defining contribution to the future of cloud scale? Yeah, so cloud scale is not possible without a digital transformation of applications. So and applications have to be digitally transformed so that they are ready for the modern cloud age. And in order to do that, applications have to become API first. They have to understand APIs, they have to communicate to other applications via APIs and allow other applications to communicate via APIs. So to truly achieve cloud scale, digital transformation is an absolute must. And we are playing our part in that journey for customers in digital transformation by allowing them to go onto their digital transformation journeys and allowing cloud scale by protecting their APIs, allowing them to discover their APIs and protecting their APIs, allowing them to reach cloud scale. Great, thank you for that. Now, let's summarize. And I wonder if you could sort of bring us home and give us your thoughts. I mean, there's a balancing act that we have to do between you want to tap into the API trend and the value that it brings, but at the same time, you got to mitigate the risks associated with that. And just give us a summary on the right prescription. Yeah, so to kind of bring it all together, right? API security is top of mind for many CISOs across the board. And it all starts with API visibility. You cannot protect what you cannot see. So you have to be able to discover your entire API attack surface. So you know what's going on with your APIs. And then you put in shield write strategies where you essentially are blocking the back traffic from hitting your applications. That's basically the logical evolution from discovering the bad traffic in your environment. First visibility and then protect what is going on. And then start shifting left by essentially being able to take these actions sooner in your development life cycle. So that some of these bad traffic can never possibly hit your applications because you have shifted left. Excellent. Well, Subit, thanks so much for coming on theCUBE today. It was great to have you. Great stuff. Thank you, Dave, for having me. This was great. Thank you so much. Our pleasure. And thank you for watching theCUBE's presentation of the AWS startup showcase. The next big thing in AI, security and life sciences. Keep it right there for more great content.


Good morning. My name is Nancy Lindborg. I'm the president of the United States Institute of Peace and I am Delighted to welcome everybody here for a very important conversation And a very timely discussion on Iraq If you are joining online, thank you very much for tuning in If you are here and using a headset for interpretation Channel one for English channel six for Arabic We will be passing around questions or cards for you to write your questions on we will collect those for the discussion And if you are tweeting about the conversation today, please use hashtag Halbussi usip Which is up here as well hashtag Halbussi usip so I want to extend a very warm welcome to his Excellency the speaker of the Iraq Council of Representatives, Mr. Muhammad al-Habussi who is visiting usip today for the first time Welcome also to the very distinguished members of the Iraqi Council of Representatives Who are traveling with mr. Speaker here to Washington welcome to all of you a Special welcome also to ambassador Farid Yassin. Thank you as always And to KRG representative by Ansami Abdul Rahman I'm especially pleased that we're able to host this discussion today because Iraq is at yet another very pivotal moment as it Finds its way towards peace and stability 35 years ago as an independent non-partisan National Insta Institute Dedicated to the premise that peace is in fact very possible and it's very practical and so We work with partners around the world on how to prevent to mitigate mitigate and resolve violent conflict And we do this by linking policy and analysis with research training and work on the ground Iraq is one of our largest programs with the excellent leadership of Mike Yaffe and Sarhan Hamasahid and a terrific team both here and in Iraq and based on our experience and our research we know that peace requires a Sustained peace requires working both from the top down and is importantly from the bottom up So we work with our Iraqi partners to forge agreements between local communities To reduce communal tensions to prevent violence and to support the safe and voluntary return For displace Iraqis in places like Tikrit after the spiker massacre Hawija, Tala Farr We support religious minority communities as they recover from the devastation Left after ISIS particularly in the Nineveh province and we're conducting communal dialogues and analytic work in Anbar and other parts of the country And finally we work with Iraqi leaders around the country And from the diverse community as they seek a more lasting peace It has now been a year since Iraq declared the military defeat of ISIS and since then the Iraqi government has continued its progress By protecting the Iraqi people from ISIS and they've enabled the return of more than 4.2 million Internally displaced people to return home in Iraq Speaker al-habousi's presence here in Washington comes as Iraq has also Taken the very important step of holding national elections, which it did in May of last year and Subsequently electing a new or electing a new parliament and forming a new government Mr.. Speaker and members of the delegation Congratulations on these very important milestones I met speaker al-habousi a little more than a year ago in Iraq When he was still the governor of Anbar province a position he held from 2017 to 2018 and as a native of Anbar province He has been on the front lines of dealing with the devastations of ISIS and its aftermath and when we met a year ago. I came away very impressed With how pragmatic how energetic how engaged he was With the complex challenges that his communities faced As well as elsewhere in Iraq including how to balance security and social cohesion as the government Removed rubbery barriers of return to displaced Iraqis. This is the balance that is so vital as Iraqi moves forward Before serving as government governor. He served as a member of the Iraqi council of representatives from 2014 to 2017 So I'm particularly pleased to host speaker al-habousi here at USIP today The speaker will make remarks and then I'll join him on stage for a conversation on the challenges That Iraq faces and we'll take your questions written on the cards So, please remember to write them down and we'll collect them And with that, please join me in welcoming speaker Muhammad al-habousi to the stage Ladies and gentlemen Decision makers and dear experts. Good morning to you all. I would like to thank you To our friends at the Institute of Peace For their kind invitation and hope to come out from this meeting with specific results that help to create a clear and joint vision Serving the goal of straining the relations between Baghdad and Washington and promoting world peace I am more than pleased to listen to you the opinion of the elite About the new challenges and I will try to prevent a number of ideas In a general framework and then I will be happy to listen to your ideas your questions and interactions as we speak The dust of the battlefield against ISIS is being cleared in last moment in Iraq and Syria where the territorial control of this organization has ended and those militants are now returned To operate as gangs who are unable to control a specific land The current situation requires a set of strategies to adopt in the face of the new threat Whereas the elimination of ISIS geographical areas opens a new window a new challenge from the terrorist organization in which this Terrorist could start targeting on an individual basis ladies and gentlemen One of the most serious challenges facing the world during this period this terrorist Organization Iraq has fought this organization on behalf of the world of the entire world And we did this with the help and the partnership With the world Led by the United States international coalition One of the most serious challenges facing the world during this period is the phenomenon of Islam phobia It is an attempt to provoke and dismantle societies and Create terror of the new kind no less dangerous than the terror of ISIS If it is not complimentary to it as far as vision and implementation However, we are confident in the wisdom of the civilized world in dealing with it and One of the best example is the New Zealand government set as an honorable example of how to deal with such a crisis of the past weeks The project of the reconstruction of the liberated areas does not only mean the rebuilding of urban areas It is equally very important to work of the local piece building and protection of diversity in these areas and work for a safe return of ITPs particularly minorities who are trying to obtain asylum in some Western countries from here Returnening of stability of this consists of the diversity and a piece of community and Security and safety we cannot do it alone We need the support of The international community and its cooperation to enhance the abilities in these areas Iraq has been working hard recently to control proliferation of the weapons and restore normalcy to citizens and cities By demilitarization of these areas and provide a legal and formal framework To those who fought alongside the army and the security forces. We are now Currently working in cooperation with the executive branch in order to narrow the illegal carrying of weapons and those who illegally use military titles of the fighters Against ISIS By closing the security or the economic officers of these groups whether in Baghdad or other provinces No one denies that they are still problems between Baghdad and Iraqi Kurdistan region, but Believe these problems today They are at the minimal level and the relationship between the IQR and Baghdad is witnessing a remarkable development through communication Between the IQR and leadership and the Iraqi government There has been an agreement on the side of solution related to some issues that were disputed before Like the budget and the administration of the disputed areas I believe that the presence of his Excellency President Barham Saleh in Baghdad and the great communication He has with the leaders of the IQR will provide an appropriate and important opportunity to resolve these problems There will be an opportunity to resolve these outstanding problems also the problems in the Middle East are getting increasingly More complicated and complex during this period. It is undeniable That the echoes of these problems will affect all the countries in the region Iraq now is in the eye of the storm and we are working inside Iraq to formulate and try to formulate in Iraqi vision On how to deal with the regional crisis based on the Iraq first strategy and keep Iraq away from these problems However, the regional conflict will increase day by day and it is very important that the wise people in the region and the world To act in order to create an opportunity for dialogue between all the conflicting parties One of the first problems that will play a critical role in the next stage is the Palestinian cause and the increasing tensions following the United States sign Announcement to recognize the sovereignty of the Israeli entity over the Golan Heights Here I say that Iraq adheres to all the United Nations resolutions that the Golan Heights and We sure we ensure that this should be resolved in a reasonable and practical way There is a difference between intervention and Rational overlap We reject guardianship hegemony and external intervention in all forms But we are dealing with the overlap in the conflict of the region in a rational way Our international alliance will be more economic than political due to our urgent need Ladies and gentlemen the sectarian issue is no longer a threat in Iraq at all There's a social fabric between all components We have left behind us sectarian problems for good But some political parties and individual political components from time to time the sectarian issue To use it and abuse it in an attempt to gain an electoral basis This will not give any of these parties or trend opportunity to return to political life again The Iraqi people does not trust these parties anymore delays in the completion of the formation of the Iraqi government are Not about conflicting interests. There's a personal stubbornness and It will a fight between the blocks I am working with my brother as the prime minister and the president of the Republic as Well as leaders of the block and when I return to like that We will definitely finish The appointment and assignment of the two most important ministries the defense and interior There is No hindering and no delay in these portfolio But this is one of the priorities of the government of Iraq and the Parliament of Iraq as well Ladies and gentlemen, we are still waiting for the countries that pledge the donor countries that pledge Support to us and the reconstruction conference in Kuwait and I cannot hide my disappointment my disappointment because of the reluctance of some To fulfill promises made during the conferences and if Iraq is not supported by these promises Investments in grants and funds Iraq will not be able to achieve the reconstruction project Iraq has fought on behalf of the world in of the entire world. We lost a lot of the infrastructure Due to this war and we look forward That all our friends in the world to adhere to their promises to Reconstruct and help in the reconstruction effort in Iraq to bring it back to stability and normal normalcy We are trying to attract international companies particularly The strong and the huge companies in the United States and we welcome them At the political or the social level to bring them to the investment sector some would Wonder like the bureaucracy in the state institution or the corruption that has resurfaced recently as a phenomenon But I tell you and I assure you that the three presidents is in Iraq. We have a clear vision to fight corruption We will somehow have a package a strict carriage and the executive branch will Absolutely work in fighting this corruption away from the partisan quota and The Iraqi citizen will definitely help in facing For combating this corruption all the files since 2003 Until now will be Dealt and reopened with the corruption files all findings will be revealed to the Iraqi public clearly and I believe that the justice System in Iraq I Commend them and praise them for what they did and complimenting the three presidencies in Iraq To hit on the bureaucracy. Thank you very much For your listening and I'm ready to listen to your questions Mr.. Speaker, thank you very much. Thank you again for joining us and for those comments You have had a very busy visit here in Washington DC So far, I understand you've had meetings with Speaker Pelosi with Secretary Pompeo Vice President Pence members of Congress other members of Congress Acting Defense Secretary Shanahan, can you give us a flavor of how those conversations have gone and how you see this visit Setting the stage for the future relationship between the United States and Iraq Thank you Nancy we found a very much welcoming Here in the United States they welcomed us greatly and I ensure that these conversations will contribute to help both peoples the Americans and the Iraqis and the joint efforts that Have been in the past and still going on between the United States and Iraq and in general with the international community We were partners in the fight against ISIS Just like I said, we defeated it. We defeated this extremist organization With the help of everybody of the international coalition led by the United States and we appreciate that very much I Not right here that the Liberated areas Does not mean that We eliminated terrorism in general. There must be a continuous support from the United States and the international community to finish not only This terrorist organization as we did militarily, but the extremist ideology which will lead us to somehow support for the logistic training and This is very very important For the armed forces the Iraqi armed forces. There's a big understanding in Iraq That all the three presidencies in Iraq the executive branch the legislative branch Led by Prime Minister Abdul-Mahdi and his Excellency the president of the Republic Barham Salih. We all are United in our effort to work with the international partners and the international coalition to defeat this extremist organization once in for all So in the next phase It's more like it's not militarily more of an intelligence-based effort The forces in Iraq and to somehow attack their funding and financing The extremist ideology the human and and and the financial from all these aspects There are so many parties That hurt Iraq because they gave them the incubator for they gave ISIS the incubator to flourish in the past Of course following and tracking down these Organizations and sometimes Countries could be behind them. We need to Follow up and attack them somehow indeed from these aspects The United States is welcoming of course and and I ensure all the people that you mentioned miss Nancy like the conversation with speaker Pelosi and vice president and Acting Defense Secretary All of them they are so much on the same page to Help Iraq and work hand-in-hand To work in all aspects economy investment security and militarily efforts and partnership to finish off the extremist ideology or organizations and and Reconstruction of the liberated area and and create a work opportunity. This is exactly what I my our conversations Contained and and I found that a very great positive vibe from the United States as Many people I think are looking With some concern at how to make sure that ISIS doesn't come back and you mentioned several ways That you're Approaching it. What what about the role of reconciliation of ensuring that there is a sense of inclusion? You talk about the three presidencies and the commitments Do you what do you view as the status of national reconciliation? As a means of ensuring that ISIS Ideology doesn't come back and and what what do you think should be done about that? When are you? Ma bad there are too many elements To stop the return of ISIS or We have to deal with the causes that brought this organization and this ideology extremist ideology Social and humanitarian issues we need to deal with that starting with the Social equality for all components in Iraq and providing services to Iraqi citizens in general and then also The IDP camps Clearly They could be somehow affected they could be somehow a Way a window for organizations for the terrorist organization to come back and see a Fertile ground For example like the Yazidis and the minority Christians. There are so many of them IDPs Living in those camps. It's it's difficult very difficult. They live in a very difficult situation and they could be very Fragile in terms of Being Tempted or somehow targeted For the return of the extremist ideology. We are willing and and hopefully waiting for the partnership and the effort Support from the United States and the international Community the Iraqi alone cannot take it on its shoulder alone But we are waiting for a lot of help and support from services and otherwise clearly. I see that There are Differences within the international community Before the elections We we have to say like I point out that this delay from the international community before early in 2018 until now Some of the parties or some of the donor countries They We want actually we are In race with time to bring back these donors Don't countries to somehow to get involved and indulge in our support But to keep it open-ended and without implementing and and Doing The walk as they did the talk. It's gonna be a little tough But if you say the reconciliation The it has to come in two parts One from the bottom up and one from the political parties on the top the first It starts from the areas that were subject to the occupation of Isis This has to be dealt with and I think we with the people we we made sure that we brought back I'll give you an example A family of six or seven a family of seven people one of them Forcefully he was He dragged out with those organization But these organizations they don't care about the family or the fabric of the family They have a very strange Ideology we had to bring back these families back to their Home lands with their promise that they would never return back and get Reaffiliated with one of those terrorist organizations. We We taught them how to Re-educate them awareness campaigns to know how They rebuilt their areas and to reconcile with the people who never been subjected to Affiliation with the with with the organization with the terrorist organization, whether they were militant or whether they were Civilians that's a part of the reconciliation. We bring them to gather and another reconciliation We need support of the international community in I would say like in in in a component like like the Nino Nino a plane and These areas They are so much Interacted with each other these components. We have to start at the political level Of course from the top down We will work with the legislative and and the government and the international community to split the Humanity aspect from the Elector aspect Any pragmatic Election issue they have all the right to Elect anyone that they feel that would represent them whether it's It could affect negatively, but we have to respect that whatever They want to elect or the humanitarian and election aspects are to separate things Pick a couple of strands forward The first the first follow-up is you refer you mentioned the religious minorities or components as you say in Iraq Who are truly facing existential concerns? You mentioned you mentioned the religious minorities or components as they're called in Iraq Who are facing what many consider to be existential challenges? And this is clearly a Topic of some focus within Iraq here within the United States as well How do you? How do you how are US Speaker and other political leaders approaching the concerns of these? religious communities about Their ability to exist in Iraq their security concerns their inclusion in decision-making As soon as I assume As a speaker of the coor Yes, I Do not I am from one component, but I am surely not working for only one component I work for all components in Iraq one of my priorities and and in at the parliament I Reconnected with the Azidi components and the other minority the Christian minorities Whether with their religious leaders or their political leaders. I continuously work with them is that to let them know that all their presentation is Completely for Iraq is not only their own components one of Iraq's characteristics is that all Iraq has multiple components Arabs Turks Everybody Cyber Yazidis What we find is that Iraq's distinguished from others is that it contains all these components We are working to bring them back to their own areas apart from the political differences whether it's in Ninoa Plains or To have exactly a real representation in the state institutions Just like the other MPs that I mentioned that they have a real representation There's one of the Christian ministers we are trying to Open up to other Woman aspect as well. We are working to appoint a lady a woman ministers apart from State institutions including security institutions We want them to enter the state institutions this way they would protect their own areas so they can be in their own residential areas and and contributors to To do the security portfolio in these areas in their own areas we I'm gonna Interspersed questions from the audience with mine. We have quite a few here, but so On this topic we have a question asking could you comment on the challenge of? Non-local security forces in Christian areas in the Ninoa Plains Yes, yes, I quickly Pointed out to Let to talk about these people the residential of those areas to be contributor in the in the army in the security the national security and the intelligence in all these Services we want them to Protect their own areas. We have an action from the prime minister to To have a representation from these components inside their own For example in Sinjar and and Ninoa Plain as I said before it's a political problem Not a security in the beginning. Everybody wants to control this area Electoral I don't deny that there also is an external Somehow intervention and to affect these areas, but what we are doing is Working in these areas to have their own people Get involved and indulge in all these institution services Because Iraq's popular mobilization forces played a very large role in in the fight against ISIS And there are many who view their role with much appreciation There are others who have concerns that these groups may have links to Iran They could undermine the Iraqi state longer term. What what do you see as the future of the popular? militias the PMF Yeah, PMF is a group or volunteers who Answered the fatwa the highest supreme religious fatwa in Iraq. They Offered a lot of sacrifices in this area. Yes, there are some of them that are linked to the PMF and There is a direction from the Iraqi Security armed forces to deal with this to have only one unified Commandership some of the PMF groups are in some areas, but not only PMF in these areas I repeat again and reiterate reiterate its a political problem not security. There are so many parties Some international terrorist organizations that They enter in these areas and we hope that We will solve this problem locally and internationally or externally international Intervention Somehow hit an imbalance in this area Some of them are I tell you like either Christians or Yazidis are Part members of the PMF use it to attack their Opponents or their foes, but what we want is like the police That they are only Loyal to the country to the state institution and not to one component or the other It's not welcomed from the people of the area for example like in Sinjar or Nino a plane But Iraq alone cannot face this challenge The ISIS when it occupied part of Iraq. They did a lot of mess and then they pressured Iraq and and then some other countries are using this aspect It's just to follow up on the PMF Point there's the armed forces the commandership of the armed forces are trying to rearrange the PMF organization of the structures to have in in every Provincial area Supported if they are there the PMF would be supported by either the federal armed forces or other Forces from Iraq to be supported with them in those areas Well a bit of a follow-up question comes from our audience which is What does what impact does Iran have on Iraq's politics, but either Positive or negative How do you see the impact of Iran and I would add you know you have a lot of regional neighbors Active in Iraq. How do you balance all those influences? External actors I'm sorry. I'm sorry. Okay, can I see can I see who posed this question? Please and stand up? Oh My oh my gosh These these countries including Iran they always always Interfer for their own interest and you know Iraq is always having problems whether it's local or International problems or most of the regional countries interfere Negatively not positively and wouldn't hinder Iraq. Well, I mean would hinder Iraq from going forward in progress in its own way as As I said earlier in my speech Iraq first strategy. That's what we want to adhere and be careful that our common interests and Respect each other. This is a fixture and it's not only a slogan It's not a political slogan. We want this to be Implemented in effect to have a full sovereignty No Intervention whatsoever from regional or elsewhere in the past we used to Take this direction is like what they want from Iraq whether the Gulf or the US or Turkey or anybody what exactly their interest in Iraq, but now what we want Iraq what Iraq wants from Jordan or from the Gulf countries or from Turkey or from the international communities Based on the common interest and a mutual interest We are working to have all these political Relationship for example our relationship with the United States does not Get affected with the people or the country that is neighboring Iraq That's what we try to do It's not it's not to put them in conflict with each other our strength and our force in Iraq will contribute to the stability of the region Including Iran the strong this The powerful Iraq we will contribute to the regional stability of these neighboring countries any negative impact on Iraq or negative intervention in Iraq. I'll tell you honestly some were probably sectarian intervention Some of them ethical now we all come as one Iraq. There's no way out of Iraq For all Iraqis from all components of Iraq Other than one Iraq everyone wants a special Interest of these countries we welcome all components in Iraq to have Iraq first Neighborhood for a moment on your other border. You have a very long border with Syria. There have been recent exchanges between civilian and military leaders Baghdad's Damascus and we have a number of questions from the audience on Syria so the question is what what's your assessment of the direction of events in Syria and What's your position towards the reintegration of Syria in the Arab League? And what is the impact of of this on Iraq? Syria, but I'll be sure Syria is a Brother in Arab country what Syria Been subjected to as a tax is not very different from what Iraq but Iraq is much longer term It's very important that Syria be back to the Arab League then to go somewhere else Syria is part of the Arab world and For the Syrians they have a good positions with Iraq before 2003 and after 2003 before 2003 they Adopted me personally they adopted the resistance before 2000 me personally when I When I was subject to terrorist attacks and targeting in Umbar I Took a refuge in Syria and I found that the Syrians welcomed the Iraqis and welcomed me and and we have to return back that favor and We have to work to strengthen their unification to have the people of Syria to support for them to decide Their own political future and who is going to be their leader. That's their own decision and it's For our benefit as in Iraq and Syria to clear Syria from all terrorism and extremism organizations We have to have them back as a participant with the international community. I myself Invited the speaker in Syria To come to Iraq and visit Iraq in April to have a joint conversation with him at the parliament level and I extended an invitation to other Speakers of the neighboring countries to bring them all This way Syria will come back to the Arab League to the Arab world to the international be a Participant and effective participant in the international community So one more question about Iran is this is about Iran waivers and it's given the importance of Electricity to Iraq and to Baghdad in particular But also very important for business development in Iraq. Do you expect future waivers? from the United States on Iran sanctions to allow electricity development the situation in Iraq is Distinguished and different How to deal with Iran than any other countries dealing with Iran? 1,400 kilometers, that's our borderline with Iran We do not want any problems Between Iraq and Iran just like we don't want any problems between Iraq and Turkey or Iraq and Jordan or anybody else, but Unfortunately until now we Have not come up and stood up Economically in Iraq we are still importing power and electricity from Iran I Think 30% of what we use in Iraq is imported from the neighboring countries We even though we are an oil Producer, but we're still using how to burn gas associated with We still what is the alternative? We're still at a primitive use of that. What is the alternative if If we don't have Any sanctions associated with Iran on us we have a breather somehow we can use and The resources of Iraq We we are against all the sanctions by the way, but we are trying to have our own decision purely economic and and Sovereign economic From on from our own decision-makers Hopefully I think this waiver will be extended In order to allow Iraq to stand up on its feet economically until Until because the associated gas and oil it takes probably up to three years With this three years after this three years, maybe if we see and look at Iraq as economically independent And we don't need to import power or electricity from the neighboring country Maybe we can address this issue after three years But as of now we are working to have Iraq independently in economic aspect have a number of questions going back to the question of ISIS and One questioner says that some experts believe that Iraq is back to a pre-ISIS situation in terms of the resurgence of ISIS ideology and the question is Is what are the practical steps that are being taken to ensure that the concerns of the Sunnis are Taken into account that there is more inclusion Another related question is What would Iraq like other countries both Western and Middle Eastern countries to do in terms of taking back their citizens? Who were involved with ISIS and I would I would ask for your Assessment of what what is the magnitude of the problem of the ISIS fighters and their families who are detained in Iraq Iran in my electoral campaign in one of the largest provinces in Iraq in Ambar the people back then yes everybody had civic duties and responsibilities but We believe that all People have to contribute To build this Iraq and then the Iraqi Institutions would give everybody an equal right This has been somehow found in an ear To have everybody every component to have Participants in all the state institutions administrative security without being concerned or having disappointed as second-class Citizens there has been in the past or there had been somehow a partisan. It wasn't a sectarian Differences or discrimination, but rather partisan discrimination And some would have more influential in one party than others The shia were not somehow beneficiaries of that area in the past But purely and in fact they only worked from a partisan vision These conflicts the inac inac inequality Implementation of law on some and not others Services in support that go to one province and not the others and As well as international intervention Supporting one province not the others these problems created problems between the provincial administrations and The government the federal the federal government, but we are working on on that They They did not have a real representation For those components in those provinces or to Have a real partnership with their brethren provinces or at the external or international level Now currently we have to have a quality in this society To have a fair share for everyone so the components Should not feel that they are a second-class citizens none of them no component What differentiate One citizen from the other is his performance or her performance, but not the idea of that person Just like I mentioned before to stop somehow provoking and inciting The people who were oppressed someone who took advantage in abused the oppressors and This is what we want to stop because this is an incubator to destabilization of security in Iraq and in these provinces and regions whether it's a human or ideology or Finance or military I Don't expect anybody everybody even the countries around us now. It is our opportunity. I take responsibility as a speaker The MPs they all takes Responsibilities the prime minister the president of the Republic everyone has to take responsibility to establish a Civic Equality this phase is different than every phase before it's unprecedented The only thing that when Isis came in This came out positive out of the defeat of Isis because all Iraqis came as united They are united at One at one group. We don't have to go back to square zero We have to support the provinces equally and to stop funding the External ideology in all of Iraq like you said miss Nancy the foreign fighters anyone Militant militant that contributed or or Hurt Iraq is directly or indirectly Will face justice in Iraq and the Iraq key justice is Basically straight to the terrorism act some probably where Isis members outside of Iraq if they had impact or Directly were involved inside the Iraqi territory Will face justice in Iraq and I think the punishment is really really harsh Different than someone who is not in Iraqi citizens others Western Western Nationals they will be taken care by their own countries. I think What every everybody knows how to bring back their nationals and Iraq will be so careful in Taking to justice all these militants, but also their countries know exactly how to Apply their own laws and their own justice on on their own nationals who Who were members of this extremist organization that hurt Iraq we We will ask for compensation from foreign nationals who did hurt Iraq directly or indirectly this is a right for Iraqis to compensate Families who lost their properties who lost their Family members all because of this Isis Low on time and I want to squeeze in two more questions We have a number of questions related to the relationship between Baghdad and Erbil and And maybe you could comment on whether you think the new parliament will bring any Developments on the issue of article 140 and maybe you could just briefly say If you think it will and what 140 is and how that's important And then the second question and then the second question miss Nancy It's a question to the second question is a good question to end with okay. I will answer about okay The relationship between Baghdad and Erbil or Kurdistan it was somehow Now I think It's much much better than How it was before there is an intention in Baghdad to have an understanding With the IQR the Iraqi Kurdistan region and vice versa the same thing with relationship to all the everything since 2014 Every year we had problems with the budget with the federal budget because it's it was not clear Every year it comes back and revisit the same thing How can we have this? Positively impact either in Baghdad or the IQR Every now and there every year it will come back this but this year is much much better than everybody before We have somehow compromised From Baghdad to Erbil and Erbil gave some compromizations to Baghdad to agree as 2019 to have resolved all the outstanding problems between the two the biggest one is the oil Problem there's clear differences on the contracts in IQR for example the contracts are Our Partnership contracts in In Baghdad is like More than the partnership from Baghdad's point of view is the service how to Service these contracts. This is how we're gonna negotiate in the next phase as a political party or as a political Entity we have to work on that it will be always a problem But both sides they have to compromise in order to service the Iraqi people the Kurdistan people The intentions always there the intentions are always there to resolve these outstanding problems but I Think because the IQR now is busy of In their formation of their KRG the Kurdistan regional government After this hopefully before 2020 According to our schedule from Baghdad schedule and the IQR schedule point of view. We have to deal with this the 140 article by the Constitution with the CRR the Parliament has to create a committee to address these clearly there are still problems in these areas Service problems some of these areas Started to have problems after the liberation battle so how is it going to be approached addressed is the IQR will Contribute to the reference structure of these areas or the federal government. This is the Problem between this or that and these people are suffering because they have not received anything No infrastructure efforts from either one To provide these services for IDPs and bring the IDPs so the decision maker of Those 140 article or the people of these people how to implement This 140 article is this is how we are to address it in the next phase So I'm here mom.  They have a clear and a good picture of Iraq Iraq. The sectarian aspect is much, much less outside Iraq. Even in Iraq in the past, as soon as they leave the Iraqi borders, even if they are in conflict between each other, as soon as they leave outside, in generally speaking, the environment is much, much, better. We just, we just live, there are so many tribes in Iraq, for example. They have, they are extended everywhere in Sunni areas and in Shia areas. The Iraqi community outside Iraq, they have somehow to reflect that image. They will contribute positively in the civil reconciliation in Iraq. Some of them are dignitaries, some of them are artists, some of them are singers, some of them, and in Iraq always remembers them and sees them as such to bring people who are influential, academic, academics or artists, always by, by media, people inside, they receive always a comforting message that we are with you from the Iraqi diasporas. They receive always messages that we are with you and in a positive way we are contributing. Tomorrow or the day after tomorrow, we have a conversation and a meeting with the Iraqi communities. Probably, we will have to address exactly the same thing. And we, this will contribute much, much faster than the media or than other channels to have it inside Iraq.