Whatever you perceive is lacking in any situation is what you have failed to give. It's an amazing sentence because it gives us the key to the gateway to the King of Heaven for ourself to really take the key and then to use the key, to turn the key. Whatever you feel is lacking in any situation is what you have failed to give. So what does that mean? What does that say about us as human beings? It just means that we've emphasized the human part and we've de-emphasized the being part. You know, it's been such a focus on scarcity, on lack, on survival. And I'm just going to use a real short word so you'll be able to remember it. Getting. Get. Getting. We're human getters. We're trying to get attention. We're trying to get money. We're trying to get love. We're trying to get affection. We're trying to get notoriety. We're trying to get noticed. We're trying to carve out a niche for ourselves like we were taught. carve out a niche for yourself. Nobody's going to take care of you. You've got to take care of yourself. You're going to have to get. You're going to have to be a pretty good getter, a proficient getter in this world in order to survive. And, you know, I see the first thing that Jesus was talking about is what you fail to give is our only function on earth is to learn to give as God gives. Because God is not a reciprocal God. God doesn't give in order to get something back.  God is watching us. God is watching us. God is watching us from a distance. That's not it. This is how I'm good. I don't like being watched. Especially from a distance. I don't like it closed up, but even from a distance. To me, that sounds a little sneaky. God is watching us from a distance. No. A lurker, huh? That's a lurker. Always lurking, lurking, lurking. A lawyer, you observer, a lawyer. What I'm from in this is, no, God is a giver. God gives love. God extends love. God extends only love. And God doesn't even know what reciprocity is. So God is not saying, Listen, I'll give, give, give to you, my beloved child, and now, here's the conditions. This is what I want back in return. Even when Christians, really well-meaning Christians sometimes will say, God is a jealous God.  That's still a bit bizarre to say God is jealous. As if God is aware of all these distractions somehow. He's like, pay attention to me some, too.  At least come. Pray to me some. Praise me. Come on. Praise, praise. Praise, praise. You know, God does not have an ego, and God does not want anything, actually. But God doesn't even know what wanting is. God doesn't know what getting is. And the condition of human beings are, we're born with an ego, born of an ego, projected. People are peopled from the ego. The ego peopled the world. The ego put the people out there. These seven billion little bottom-fears wanting to get, get, get, get, get. Psychologically, physically, get, get, get. And the ones that are called the successful ones are the ones that are the better getters. That's a pretty sneaky trap. The ones that get more are admired. And yet they have nothing to do with God, because God is not a creator of getting. In fact, Jesus teaches us that, just like the Bible said, as you sow, sow, show, you reap, and we've heard what goes around comes around, what Jesus teaches us is giving and receiving are the same. So all that I give is given to myself. That's why I need to be a giver, because I won't know my true identity, because I won't receive the love that I'm giving, unless I learn to give the love.


Good evening and welcome to the March meeting of the Burlington Electric Commission. We meet here at five eight five pine street every second Wednesday of the month. And as always, members of the public and the ratepayers and they're welcome to come down, talk to us. That's your concerns, craze, whatever, but here we are. So we'll start the meeting up with the agenda. Are there any changes or additions to the agenda? So number two, minutes of the February 8th, 2023 meeting. Are there any changes or to that that are substantive? And if we have any just a grammar or any substance of change to the minutes of February 8th? Nope. Make the motion to move to February 2023 meeting. Meeting is adjourned. Second. Seconded discussion on the motion. How do you say that? All in favor. All in favor yet. All in favor of the minutes of the motion. By saying aye. Aye. All those. Let's have it. And it's passed. Number three, public forum. Again, this is a time when the public is invited to join us, make statements or say anything. Do we have anybody in the public? If you don't have me here, you're in the building. Do we have anyone online? Well, again, I'll reiterate, public ratepayers here in Burlington. Always welcome here. Second Wednesday of the month. Please come down and join the conversation. If you have any concerns or anything like that with your electricity or lights or wherever, come join us. All right, we'll move on to the commissioners' forum. If you have any things for the commissioners. Congratulations. Thank you. Very exciting result. He was pretty, or the, except, victory, victory, victory. The victory was substantial. 67 to 32, roughly. Yeah. So two to one. I talked to Jen Green. I just saw an email from her and I said this, because was somebody in my neighborhood just putting fires around? Yes. That was a little bit misleading, I think. Yes. Yeah, and I had an item on that in the report. And I'll touch on it more, but I know exactly what you're referencing. But thank you. It was a good result. I got a couple of things. One, I wanted to, just as I got this this afternoon, I was thinking, going down through the packet, that I'm not sure about the last time that we took a, just took a quick look at the dashboard and kind of look at where it's at relative to where we think we should be along that timeline. And I'm hoping, I'm not gonna try to put you on the spot, but I'm wondering if we could maybe touch on that a little bit tonight and then maybe make that something of a regular or a couple of times a year. Yeah. Take a look at that and see where we stand. Relative to the roadmap metrics, at least the major metrics. I had a small item on this, but we're expecting to have the updated Synapse Report on the 2022 emissions and fossil fuel use data, hopefully in April. So we'll at least be able to give kind of the high level, what we've done, comparison over the last, now it'll be 2019, 2021, 22. So four years of data relative to the 2018 baseline. So I'm hoping to have an item to discuss that in April. So we do that annually. And then relative to the other kind of dashboard metrics, we can certainly get more depth on any of those that are of interest too. Cool, fantastic. And then the other thing I want to bring up is we had a, the couple members of the commission had a meeting a couple of weeks ago with some engineers and designers here and an outside person for a long discussion. We've been having quite some time about lighting standards and IES here in Burlington. So I just wanted to tee that up and give the mic to Bob to give us a little more detail on that. First of all, I did not pick up my packet because I had a cold first time ever, but I looked at it electronically anyway. That's also partially my excuse for not being totally up to speed on what's going on since that meeting. Gabrielle, our previous board member and chairman, actually sent a note around, which I got today. I forgot to check the date, so I'm actually going to quote some of that. I'll also say personally that we don't have a lot of significant goals at this point about this, I think. I'll come back to that. Mr. Arnold did tell us something we had heard about, which is that the IES, the Illuminating Engineering Society, has reduced its recommendations for light levels in a couple of small cases for lightly traveled streets. That's encouraging, but not terrific. Also, the IES has become more emotional about dimming lights in off hours. That latter thing is what we mostly ended up looking to for further investigation because we seem to start, regardless of where we started the discussion, we come back to the IES recommendations which we follow. And the difficulties we would have legally, and you name it, if we deviate it. Even though there are lots of examples in other parts of the country and even in Vermont where they have done that. There are examples, but they're first not well documented. And second, we have legal advice that says if you've been doing it one way for a while, which means following those recommendations, if you change, watch out, legally speaking. What Gabriel has suggested and volunteered me to do and fair enough, and I'll argue that of course I would have done this myself and I know I'm sick, is to investigate Rhode Island, a state where there's a nonprofit which promotes lighting standards and quite a bit has been done. I do note when I look quickly at the material they have, they seem to stress the idea of saving money. Nothing wrong with that. But the dark sky question also speaks to aesthetics. And about that, dimming, typically after midnight, which is also done in Preparo, Massachusetts by the way that one example I've mentioned before, is done because it doesn't affect many people. But because it doesn't affect many people, it doesn't change their dark sky experience. Their dark sky experience is dominated by their 10 p.m. time. So we haven't really sorted that out. But if on the other hand we can save money, why not do it? So to sum up, there's gonna be some more work, but right now we don't have a strong advocate for pushing the IES recommendations. And we don't have a strong connection to places which have done it, many in the West Coast or in the West rather, which also have astronomy as a part of their consideration. So keep tuned. Oh, sorry, I'm just learning about these things. Clipboard, huh, cool. Just to elaborate on what Bob mentioned, regarding dimming the lights in the IES, while also it mentioned dimming it to a lower level in residential area doesn't provide lower level. So that's something if we decide to, somebody has to come up with that level. So there's no standard for the dimming? For the dimming, yes. Because it's at the Ulan level. No, because when there is natural areas, there is one light level in the new IES standards. And we design to that level. So if you decide to dim the lower level, what that lower level is. Right, right. So there's a consortium of towns, 26 towns to pan again. Burial. Burial. Whether it's this company that's working with it, they're doing these things. Yeah, they're a nonprofit. So we're trying to get information from them and those towns, because part of my question, especially with the towns, is if you are deviating from IES, what's the policy that you've somehow adopted that is justified value? Or would, you know, so trying to dig into what, you know, at our level, these towns are safe. It means a conflict in the environment. Because I'm still new, I only use that card a couple of times more, but can we, can someone just say the problem, the statement that we're trying to solve? That's a very fair question. I don't think we've really got it articulately. If you're a dark sky advocate, you say the sky is too bright. Aesthetically, and then there's a whole argument about what's really enough from safety standpoints and there are issues out there in the great literature about that. But that's it. I think there are only two reasons to think about coming down. Money and aesthetics. Well, I think the other thing is that BED changed some lights on Spotted Scarf Avenue. Yeah, that's right. It's South End Street and they think there was some pushback because it was too bright. Okay, I think- Several streets in the South End that are recently got some, yeah. Basically, our policy requires when we do work in an area that we update the lighting to the standard. And if the street hasn't been updated in a while, that can appear to be a really dramatic shift from having out-of-date light to more up-to-date light. And so that sparked a conversation. But the piece on our end that's been a challenge we've talked about a lot is we're kind of liable for the safety of the roads. And so if we have the standard, we have to meet it. We feel a little bit constrained on that end. And there's a lot of good discussion about other ways to go about it. But that's kind of been one of the sticking points for us. Thank you, I appreciate it. And I think Scarf Avenue went from seven lights to 28 or something like that. Yeah. You know that, yeah. Okay. But I didn't know. Yeah, thank you for that. I know it only because it's feet away from my house, but not because of the background and everything else. So I think it's come up a couple of times, but most dramatically. Yeah, I mean, the complete of the boats. Yeah. But even if you replace one light on the street, the light's been there for a couple of years, you know, the light decreases over time, right? The light output. So when you replace it with a new LED light, the light is so bright initially. And sometimes you get complained from people. And at the same time, we get compliments from the pencil. Somebody else. Somebody else. Yeah. And it all goes back to the way we back. Paul knows this story all well since that happened. I think the legal thing has a lot of inertia. So if you really wanted to change, abruptly would not work because expectations would be filing. I guess I would say, I suspect that means it couldn't be it couldn't be done, but we, it's got to be done very gradually. More to come as we explore. Any other items from commissioners? That will move on to item number five, the general manager update. Thanks. Before I get into the items in the report, I wanted to remember to mention the commission that we have, we had submitted, I think I mentioned this, five concept papers under the infrastructure bill, some of the federal funding that was available. We've been encouraged to submit a full application for two of those. And we would like to have the opportunity for the chair to sign on behalf of the commission, supporting those two grant proposals. If that's, if everyone's amenable to that, these would be one page fairly brief letters of support. The two, am I able to mention the proposals that were encouraged? Okay, just confirming. Yeah, I'm happy to mention. One of them is to support our ADMS system, which is really to help with greater visibility into the grid for our power system operators and enhanced reliability, our outage management system for our customer care team. So it's very much a reliability related proposal, although it could help as well with integrating more solar and distributed resources into the grid in Burlington. So that's one funding proposal. The second one is related to what we've done, essentially with the EVs already, where we have an EV end use rate, and we're doing pilots around things like a heat pump end use rate and opportunities in the commercial sector to shift usage off peak as we move towards electrification proposal that's really focused on that flexible load management and use rates and metering. And so those two were encouraged for a full proposal. So if commission's amenable, Lori and I would work with the chair to secure a signature on behalf of the commission. We're working as well with IBW to have a letter of support from them as well. And we'll be hoping for the best outcome for both those proposals. You said it's a one page item times two. Correct. Okay, in that case, I would at least like to see it. Sure. Our deadline, I think for one of them is this Friday. Is that right? Okay. Both next Friday. Both next Friday, okay. Perhaps what we can do is share, copy via email maybe as early as this evening or tomorrow. And then if there are any concerns, maybe either communicate to me or communicate to the chair. And then if everybody's good, we'll work to get your signature. If that's, do we have an electronic Scott Moody signature? No, we don't. Okay. So we may have to send it to you to be printed with signs. That sounds really cool. I can work on that. Maybe. So we'll follow up on that. So jumping into the update, good news relatively on the legislative front. There was a bill introduced H320, which encompasses renewable energy Vermont's proposal for changes to the renewable energy standard. We don't necessarily see eye to eye with them on the bill as a whole. There's still some major cost concerns. We had a commentary myself, Ken Nolan, Rebecca Town and Lewis Porter representing the public power utilities or many of the public power utilities in the state raising some serious cost concerns with changes to the renewable energy standard that ran in Vermont Digger last week. But at least on wood energy, the bill is much improved from the initial proposal. It makes sure that plants like McNeil can continue to count towards Vermont's renewable energy targets that if we're able to move forward with things like district energy, that won't negatively impact our ability to count towards Vermont's renewable targets. And if somebody was to build a new plant, then there are some language in there. If this was to become law, which obviously it's a bill, not a statute, but that would set some efficiency standards and emission standards for new plants, that would not be something we're subject to at McNeil if we were to move forward with district energy or repower the facility in any way. So at least on wood energy, it's helpful that renewable energy Vermont and the groups working on that bill have acknowledged the benefit of having wood energy count towards Vermont's targets. So appreciate that. There's more to come on wood energy, certainly. I know that the TUC, the Transportation Energy Utilities Committee of the City Council's planning to hold some sort of a forum, possibly in April related to wood energy. We'll certainly share with the commission to the extent that you're interested in being a part of that or calling in or anything. And then it did come up. I was on the morning drive radio show for about an hour earlier this month or maybe it was late last month. That was actually late last month. And we talked to some about McNeil and district energy and a variety of these subjects. So we know it'll continue to be a subject of discussion, but it's good progress there on the Renewable Energy Bill. On Act 151, which is the bill that lets us use a portion of our efficiency dollars towards innovative programs, a bill has been introduced in the Senate, a committee bill. They kind of paused their work on that in the Natural Resources and Energy Committee to take up a housing bill that had come through. But the bill that was introduced includes some concepts from BED, including that we could potentially use our thermal energy process fuel funds, TEPF funds, which we've been using to support district energy feasibility. But that'll conclude, the feasibility work will conclude hopefully over the next several months. We'd be able to use those funds to support the Act 151 program. So this would be revenue that comes to us from our participation in the Regional Greenhouse Gas Initiative and from bidding energy efficiency into the Ford capacity market. So this is revenue that's Burlington revenue from our customers that we might otherwise lose and that we're able to retain currently because we can use it for district energy. This would give us another avenue to use this on behalf of BED's customers for innovative programs. So that bill, which would include an extension of Act 151, we're hopeful we'll start to move after we get back from town meeting week. And we've testified in support of that in the Senate. We'll touch on financials obviously with Emily. I did have an item in here to flag that we had a probably a little bit better a month in February relative to January, but neither month was a good month in terms of energy markets in terms of power supply relative to our budget expectations. And so we are gonna see a significant impact in the FY23 budget because power prices were not anywhere near what they were projected to be when we developed the budget. We're doing everything we can to mitigate that in terms of positioning McNeil's operations. James and his team have done a great job working with the McNeil team on creating a bidding strategy that maximizes the benefit for McNeil when it does run relative to the economics on the New England grid. We've had a great run in terms of wood supply. We've run almost 24 seven really since December. And we still have enough wood I think to get through to the end of March, I think. We're hopeful. It's gonna be close, but we think. And then we have an outage scheduled for the beginning of April. So that would be a natural time to begin to restock the fuel supply. But all of that said, we are working on a number of strategies. Try to conserve cash. We wanna end the year with 90 days cash on hand. That's kind of a bedrock metric for us in terms of the A rating for Moody's. We know our adjusted debt ratio, which was improved last year was I think a 1.22 last year to end the year which had been up significantly from prior years is likely to be impacted by some of the dynamics that we've mentioned. So as we develop the FY24 budget, we're taking a more conservative approach, I think relative to the power markets and trying to build a budget that will also have, it will certainly have a rate increase. We're trying to keep that as moderate as possible given the dynamics. So April will be our draft budget and rate discussion that we have every year and may would be the time where we come to you for a final approval on the rate and budget pieces. So we'll obviously be digging into this quite a bit more over the next couple of months with the commission, but I just wanted to flag kind of where we are. With district energy, the update there, we did submit for a jurisdictional opinion to see if the project needs a full Act 250 permit. They came back and says that it does. So the council who's been working on this for the Burlington district energy nonprofit is preparing the full Act 250 permit for district energy. The nonprofit has received its 501C3 designation from the IRS and we're having relatively intensive conversations around some of the economics to try to firm up where those stand and hoping to kind of, be able to advance some agreements, potential agreements for the city and customers and VGS and BED to look at collectively over the next few months. So the Act 250 process continues and the financial piece, the work there continues and we can hopefully in the next couple of months come back to commission with a substantive update on where we stand relative to all of those pieces for district energy. The last couple items, so we touched on both of these a little bit during the commissioners' check-in. I don't know if it's the check-in or the corner. This comes first, one comes first, one comes second. So there was an effort relative to the ballot item two to oppose it in a way kind of, you know, at least in my view, conflating the issue of whether somebody supports McNeil or supports district energy with whether they support having the carbon impact fee as part of the new construction development process and application for the existing buildings that would be subject to it. Obviously the ballot item passed, we're grateful to Burlington voters for that. We'll look forward to working with the mayor and the city council and the department of permitting to try to advance policy that would help to implement that well ahead of the 2024 timeframe where hopefully it would take effect. I do expect that there's gonna be discussion because of this and because of the form I mentioned at the TOOC about what counts as renewable for our purposes here in Burlington. And what we've advocated for and what's included currently in Burlington ordinance is a fairly broad definition and inclusive definition of renewable. As the municipal electric company, we're always happy when people electrify. That's one of our key strategies. That's something that we support strongly but we don't support it as an exclusive strategy. We believe there are building applications where electrification may not make the most sense from a technical or economic perspective. So we see district energy as a viable solution for some customers. And obviously that's why we're working so hard to advance it, it's part of the roadmap. One of the four key pillars of the roadmap. So having renewable district energy be an option under Burlington's policy is very important in that context. It's also currently included in the state clean heat bill that's advancing. Similarly, the current policy in Burlington allows for renewable fuels that have a contract for renewable fuel like renewable gas or biodiesel to count and also allows wood heat, modern wood heat to count. And again, that's the same in the clean heat bill that's advancing in the legislature. In some applications, we may have a situation where there is some residual fuel use and having that be renewable as opposed to fossil fuel makes sense from our perspective. And in addition, there may be some buildings, particularly existing buildings where the distribution infrastructure is such that converting away from a conventional fuel system may be prohibitively or technically impractical or impossible and having the option for those buildings to use renewable fuel is important as well. We don't see a lot of modern wood heating used in Burlington. We see it in the rest of the state, places where people may be relying on oil or propane. Obviously Burlington is 95% natural gas. What we're seeing is largely either people are using natural gas or increasingly they're using electrification, geothermal, heat pumps, VRF systems. So we don't really see a huge number of wood heat systems but nonetheless, we left that as an option to the extent that that's necessary as a complementary system or in some cases could be a primary system. The high school building, I believe had a wood heating system. I believe they're moving towards having a geothermal system for the new building with our support but there may be applications where that's necessary or appropriate. The more you limit the definition of what's renewable, the more costly the policy could potentially be, the more impractical the policy could potentially be. So our view is that it would be sound to include a broad and comprehensive renewable definition just like they're doing at the state level but that debate will happen and I just wanted to preview for the commission kind of where we've been coming from in terms of the department's position in that discussion. I think I covered the net zero roadmap item a little bit. We do expect to have metrics for April, early read at least on the building side. I don't have transportation data yet is I believe we have an increase in natural gas use in Burlington from 2022 relative to 2021. I've asked Chris Burns to kind of dig in on that. That's not final. So we may find discrepancy from what we see original from the original data. It's conceivable and this is not a per capita measure. So it's conceivable if there's construction and new uses then that might be a source of additional natural gas use. It's also possible that buildings are running air ventilation systems or air tempering systems in a different way now as we come out of the pandemic than they were previously that could also account for it. We're digging in on that but that just reinforces to me if that's accurate the incredible importance of continuing to push aggressively with our incentive programs and with policy to try to move the city in the direction of net zero and to ultimately bend that curve downward. We've seen it come down and then kind of it's bouncing back up a little bit as we come out of the pandemic period our goal is to see a kind of firm and durable bend of the curve downward on emissions and fossil fuel use. So we'll get more into it in April but that's something that we're gonna be following very closely. So I'll pause there. Happy to answer any questions. Just a compliment on forceful argumentation that changed renewable energy per month's view about McNeil. Thank you. We appreciate the opportunity to have those conversations in a collegial way with those types of groups. So thank you. Hearing none, we'll go on to item number six, financials for... Good evening everyone. Make this a little larger for you. Hopefully that is someone visible for you all. So here... Nice to be getting lost. Okay, so here to present January results. As I previewed last time as you just heard from Darren, these are not good results. They're materially worse than budget which we sort of knew they would be based on the weather we saw in January. I think this is the single worst month of the mild winter, kind of where we're seeing the worst effects. We had a net loss for the month, a bit of $566,000 that compares to a budgeted net income of $1.1 million. So about 1.7 million worse than budget as you can see there. Two primary reasons, first big one being purchased power and the second being sales to customers which unfortunately broke against us as well, the mild weather contributing to lower sales than expected. So you can see there was a $388,000 unfavorable variance to budget in sales, both residential and commercial sales were lower than budget for the month of January. For the year to date, there are only about 2% under budget which isn't too bad really, but it definitely didn't help us this month. Other revenues were favorable to budget by $119,000. Most of that is efficiency, energy efficiency, utility reimbursements. And then on the expense side, you can see the big $1.39 million negative variance in power supply. Just about all of that difference was due to purchased power and most of that was due to unfavorable variance in the ISO exchange caused by lower than budgeted energy prices. Just to give you a sense, we budgeted at an average energy price of $230 per megawatt hour, actuals were about an average of about 50. So really significantly lower than we had expected. Really the other income and expense lines are pretty immaterial compared to that one and not a lot of variation really from budget. So that brings us down to the bottom line. Or again, we're at a, we were at a $500,000 net loss. For the year to date, we have a actual net loss of $775,000 compared to the budgeted net income of about 1.9. So about 2.6 worse than budget for the year. And just as Darren said, I think February will not be on budget, but it won't be this comparably worse. So you won't be losing as much. Right, exactly. We actually might still be making money in February. We just won't be making it relative to the budget. I keep that in mind that we are not probably losing money on the power prices, but we're not making $275 on the excess sale. Right. Making it good for our safety. But the problem is you budgeted to that number. Right, correct. That's right. Right, right. Yeah. But I think the other point is that the budget was set with that assumption and that's the expectation that that's how much money it's going to pay. Correct. Right. That's the source of our challenge. Yeah, this budget was, we kind of noted at the time was uniquely, that was our one risk factor and it broke against us, but it's a big one. And so we are budgeting more conservatively next year. And we'll probably have a slightly higher rate need because of that than we would otherwise. But I think that's gonna be necessary. Okay. The use of natural numbers. Same thing deal is fair to the cost of $66. I guess $35 right. And it's $31. You guys, the energy price has to be above $31 for it to be made money. It's well above $31. It's not $2.75. So again, it's a loss of revenues not a loss against cost. Correct. Yeah. And I guess my only point is that's fine, right?  I thought you were gonna get it. Yeah. Correct. That's because that's why you're in trouble, right? Not because you're losing money on the sale of each unit of energy, but because it's counted on that money. I understand that I just wanna be very, very clear that our power supply costs have not increased because saying we're losing when our hardfly has a very good counting. So I just wanna be clear that you're correct. The harm is there, but it's not a harm of losing money against our heart. Okay. So then moving on to capital. We have spent about 4.7 million January year to date against the budget of about 6.3 million at this point in time. That's about 52% of the year budget of 9.1 million. So we're generally I think tracking well in terms of capital spending on the pace that we had planned. Moving down to cash. We did see an improvement in cash versus the December numbers. A lot of that due to the timing of when we received a drawdown from the Revenue Bond Construction Fund. So we received the amount for December in January. So December was kind of short and January was richer than we had thought it would be. So we've improved a little bit on the cash position. $6.8 million in operating funds. That is still about $4 million off of where we had budgeted to be in terms of cash flow at this point in the year. And then you can see the credit rating factors here. We had a debt service coverage ratio of 2.69 for the most recent 12 months. The adjusted debt is low as you would expect at 0.77 and we currently have 95 days cash on hand as of the end of January. Questions, commissioners? But it's one question I have. So what are your trade-offs? What are the levers that you can use?  There's impasse of the volume. It's borrowing money more expensive or? If the decrease in cash on hand leads to a rating downgrade, then yes, it would make borrowing money more expensive. It wouldn't affect any of the rates that we have sort of currently set for the bonds we've already issued or a line of credit or anything that's kind of out there. It'd be if we were to issue new debt and our credit rating is less than it is now because this days cash on hand has declined or has sort of hit a level, right? Then that would be the impact on future borrowing. I guess it's a little, so you're not taking enough money into pay all your bills out. So where, how are you covering? So we're evaluating kind of places where we can either draw down more funds from the construction fund than we had planned or kind of accelerate that. We're looking at our re-riges and weather because that's essentially cash that's owed to us that we haven't collected. And is there a way that we can whittle that down a little bit? We are looking at things like overtime and vacancy savings. So try to think of the other things that we're looking at. You know, we're trying to look at everything we can but it is challenging because a lot of the expenses are fairly fixed. In a normal year, if this was gonna happen and we didn't have the revenue bond funding kind of locked in over a three-year period, we would have had a capital budget that was relying on our cash more than this year's budget is and then you would defer capital projects, for example, to conserve cash. That's been a tool we've used including during the pandemic. So this year's budget's unique because we actually have a pretty significant capital spend but deferring projects doesn't actually help us. It just means we're not gonna draw down as much revenue bond which we need to over a three-year period. And we also have the GEO bond that we have to draw down against as well. So there's almost zero, very close to zero in terms of like capital projects that are not sourcing from one of those two areas. And so that tool is not on the table for this budget. So and the other thing is just positioning McNeil strategically for the remainder of the year trying to bring in whatever additional variants, positive variants that we can't against the potential energy markets. And we did, I think in March we saw a mild decrease in the fuel costs as diesel is coming down. We have a ratchet now essentially. So we had a slight decrease in the wood fuel costs and that could continue if diesel prices continue to come down. That helps a little bit, but really cash is your flux. And so the 90 days to me is not just important because the Moody's Braiding, it's really what during my time at BED we viewed as the prudent level to try to maintain just for operational purposes as well. I guess I don't know where you get the money then to pay the bills because... Well, we have enough via cash on hand. So that's where you would go. Right. And so to the extent that number starts to creep down from instead of being 90 or 100 or 120 or something like that. So if it's lower, it's because when you net everything out with the income, the revenue and the expenses, if we're not pulling in as much we need to pay, that cash is there to be the buffer, essentially. But you're correct. The fundamental problem is that operating income is not sufficient to cover operating expense kind of in the past few months, right? So I've come up with two which is then there's a problem with the rates development process in Vermont because the BPS when evaluating our rate case last year used four words that were higher than our budget or when determining how much money they would agree that we should get. So if we go to file a rate case, they're gonna plug in four words and say that determines how much money you will make in the spot market. And so again, in other states, there's a fuel-adjusted process. We automatically pass this through to modulate rates to recover these expenses, but it does not have that. And to date, the BPS has used these projections of price in rates setting. We raised all of these concerns in the last rate case that said it is putting us in a position or if there's a lot of winter, you know, and that's the math they're using. So there's a challenge you can ask me for more money to rate process. You're like, well, Vermont does have that for alternative regulation. So like BGS and GMP get it. And we don't. Excuse me, would you mind coming up? That we can hear you better? So since you're coming up next, wait. I'm done. Well, you're next anyway, but... Yeah, if you notice just, if you notice on your BGS bill, if you're a BGS customer, fuel adjustment went up in November. So your bill went up and then, and now it's coming down and that's commodity cost-based. And that's part of alternative regulation. So that's a six month or a four month period where they can recover more money because fuel prices went up and then that comes off the bill. Whereas we do traditional rate making where you set your rates for the year based on what's known at the time. And there's not a process at the municipal level currently to be able to adjust because the winner didn't go the way we wanted. We can't put in a fuel adjuster for three months to try to recover. So that's a tool we don't have in the toolbox as well. So even had we budgeted a higher amount, the DPS wouldn't have agreed to let's recover that in rates. So there's that challenge. Now we're gonna be in a position in asking for higher rate. It's difficult to build past expenses into forward-looking rates as well because typically rates are designed to recover the expenses for a forward-looking year. You know, there are methods, and we're talking about it, to deal with past issues, but they're not easy. I mean, you're not, you can't just say, I want this much for next year's known and measurable changes.  That process does not directly exist. I guess I was thinking because, you know, Burlington, it's a little bit of a, we've had a history of this. I think the school district is the biggest one, like, where there was just financial problems and nobody, and then we're like, what, we owe how much money? We can't do, right? And so that's why I'm sensitive to how, what the answer is, what the end game is, and how we can get out of this. Also, Burlington's so expensive already that any increase is going to be biggest challenging sell. I think that the balance there is the issue, is, you know, we went 12 years with no rate increase. In retrospect, part of me wishes we had had a one or 2% rate increase each of those years. We'd be in a better position now, but at the time people enjoyed those benefits. So we're now in a position where we need rate changes annually. Inflation is sky high over the last few years, and that affects our business as well. Even our rate change last year, 3.95%, well below the rate of inflation. I mean, almost half of the rate of inflation, so a relative, you know, positive. I mean, in utility rates, I've always been talked that if you're under the rate of inflation, then that's a positive. So that was a good thing. We're gonna try again to be, you know, either at or below the rate of inflation, if at all possible. But yeah, I think the thing that would, the thing that, if I was in your shoes, the thing that would worry me is if we were coming to you showing these metrics and saying we don't need a rate increase next year. Cause at that point, we would be putting ourselves in a position that's much more precarious and as painful as it is to go through, and it's not a process any of us relish or any of you relish, and certainly not one that our ratepayers and customers want, modestly increasing the rates on a regular basis to account for the costs that we know and to maintain the cash margin that we need to be able to manage when things don't go well is the best financial strategy in the long run. I mean, that's the classic thing, right? Like you got to deal with it early rather than. Right.  Right, and we're gonna always be aiming for something that's, you know, we're not looking to have a double digit rate increase that has not happened in a very long time. I think 2007 maybe was the last time. 2009, I think. 2009. So we're not looking to be in that position either. So we want to kind of stay in the single digits, have a kind of reasonable trajectory and do all the things we can do. And perhaps next year, the power market's breaking a different way and we're in a different position, but that's just, that's not something we can predict. Or I've asked James and he said, if he could, he wouldn't be working. I would be giving Elon Musk a run for his money if I could foresee the future in the markets. You know. Are you feeling okay about the mitigation strategies you talked about, the levers you talked about and being in a lot of... I, you asking my personal opinion? Well, you talked about some other things you were looking at in terms of ways that we could kind of... Well, again, the concern is that the economic damage that Emily's talked about has happened, right? It's going to be hard to undo that level of cash loss with minor levers, right? I mean, that's, and my concern about the methodologies by which rates are made in the state remains, but the forwards for the next winter, which would be in a rate case, are lower than $275, which also aligns with more with the budgeting we're doing this year. So, and there's a couple of things we can do. I'd rather not stay out specifically on camera right now, but there are a couple of things we can do to potentially help over time recover that past damage, but it wouldn't be quick and it would tend to increase rates. So it depends on whether the rates can sustain that too. So, again, things that can be done, I wish it had come in at $275. Yeah, I think it's a, it'll be a short-term pitch for sure, right, but then long run, right? I mean, some markets are breaking our way. The problem is like the Ford capacity market is falling. That's good for us, because we're in that capacity buyer, but that doesn't take effect until three years from now, right? So the new market just, the new auction just closed lower. Great, but it's not great tomorrow. But even in the, Emily, correct me if I'm wrong, even the position we're in, we're gonna work as hard as we possibly can to end the year with the 90 days cash on hand. That's the goal. The net income may not look good. The adjusted net metric may not be where we want it, but that's our primary goal, is to end with 90 days cash on hand. Not gonna be easy, but we're, that's everything, all the mitigation strategies are working towards that end. Is 90 days the particular thing that Moody's looks at, or they look at all this and potentially downpour in a server? Well, they have multiple metrics and they look at it over multiple years and they look not only at what you've done, but what your forward-looking plans are. So the fact that we're on a trajectory that we've demonstrated we're willing to raise rates, and that we're on a trajectory that's relatively consistent with a rate path that we laid out for them, a five-year rate path a few years ago, those are positive factors for us. The fact that the power markets didn't go our way for one winter doesn't necessarily mean that there is a negative correlation for your credit outlook. It may mean that some metrics are not where we want them to be for one particular year, but they tend to look at things on a three-year cycle, not a one-year cycle. We did have improvement in a variety of metrics last year, so that'll, in order to our benefit. So I think if we can maintain the 90 days cash on hand, which is the A rating metric for Moody's, that'll be in our favor relative to those other pieces that may not be as much in our favor this year. And looking two years out, softening energy markets reduce the cost of replacement power when our contracts expire. So again, it's nothing without its benefits. It's just the timing of it can create the pinch that they're describing. So again, the price of replacing our expiring contracts is coming down too. So things are moving, but they're not tomorrow things. They're two, three out, two years out things. Do you know if other utilities are experiencing a similar situation?  The answer is absolutely yes. In New England, I don't want to speak nationally, although I think it's a phenomenon nationally as well, but in New England, and remember, other states have different regulatory mechanisms. So they may have those fuel adjuster clauses that we don't have. And in places where they do, we've seen double and even triple digit rate increases that happen this winter. For Massachusetts, for example, there was an article on CBS News where somebody who drives an electric vehicle in Massachusetts because of those rate structures now pays more to fill up their EV than they do when they use gas. They have a plug-in hybrid. So that's how dramatic the shift has been in other states. And even in Vermont, there have certainly been double digit rate requests from some utilities and higher single digits for others. So this is not unique to BED. And in fact, our 3.95% for the current year is one of the best rate numbers I've seen from any utility in Vermont or New England that had to raise rates. So we'll always look at things relative to how we're doing. Our residential rate remains one of the lowest in the entire region, for example. I know that doesn't help when your bill is going up by 3.95% relative to what you had last year. But if we look at it relative to the costs elsewhere, we remain incredibly competitive, particularly on the residential rate, yeah. So the investor on utilities did just. Yeah, well, and they have those adjusters which aren't even part of the base rate, but they may reflect the fuel cost changes. So going into the winter when natural gas commodity costs were going up, that means that the energy market costs were potentially going up and those didn't materialize the way we thought, but those utilities raised those fuel adjusters for that period of time and now they'll be coming down.  Your bill might have been really high in the winter and you hit the shoulder season and maybe it's going down. I mean, the thing you get with our model is at least a measure of stability. You know kind of what your bill is for that 12 month period. So each model has its benefits, but Vermont tends to be more stable than the rest of New England states because of our regulatory model. So. And I would say that the absence of a fuel adjustment clause hasn't been, hasn't had this result because market volatility is never this high. If it was going from 65 to 55 or to 75, we wouldn't be pulling our hair. If it's going from 275 to 55, that's not something that's happened before. So again, you know, this is one winter where the fuel adjustment clause might have been very, very handy out of how many years. So, but it would have been handy. Nope, I'm set, you're set. Any other questions from? No, just keep up the good work.  So I mean, you're doing well, so. We'll move on to item number seven, the IRP update number two with change units. Good evening, everybody. We're going to try to make sure that we come to you guys each month on IRP stuff regardless of whether we have a really fancy PowerPoint or we're just telling you what's happened since the last IRP update, but in the interest of keeping you sort of aware of what's going on, I thought I would tell you some things that have happened in the last month. We did receive the IETRON forecast. We received it over this weekend. And of course, Tuesday was a holiday. So we have not fully assimilated that forecast nor have we signed off on it. I will be candid and saying it is materially lower than the net zero roadmap forecast, materially lower. And we want to make sure that we understand what is not included in the assumptions or is included in the assumptions if I have which one you're talking about before we show that difference to the world and say this is our IRP forecast, particularly for peak loads in the winter. The IRP forecast is much lower than the net zero roadmap was saying. And again, we need to understand that, but it's two different entities doing it two different ways at two different times. So we're running it down. We will be sharing it as soon as we're comfortable that it is not inherently wrong. We have had some DPS engagement. We started the DPS engagement process, which was a requirement of the MOU for the prior IRP. So we have started talking to them. We've shared, we will typically share with them things that we share with you right after we share them with you. So the last PowerPoint went to them for consideration and we're scheduling a meeting with them to talk about how we want to show them other stuff as time goes on. But in general, you'll see it first and then as part of our engagement process we'll expose it to them right afterwards. We have started actually exhumed a contract for the updated McNeill Economic Study, which was one of the appendices to the 2020 IRP and one of the requirements of the MOU for the 2020 IRP was that that study be updated. So that study is being updated. It is being done and its delivery date is end of March. So we would hopefully be able to share that updated economic study before the next meeting and answer questions on it. The five-year budget model is done and the very next thing we do is we take the five-year budget model and we extend, well, as we're preparing the five-year budget model we put in any longer projections that we have at the time and do energy prices, capacity prices, transmission prices and all of that. We'll finish populating the 20-year projections of those and turn it into the IRP model, the economic side of the power supply. At the same time, Casey will also be able to use that to do a quick litmus test against the RFP responses we got last December, because really you would need to test them against an IRP and it's a lot more rational to test them against a current IRP assumption than a 2020 IRP assumption. So that'll be part of that. And the last thing I want to mention is that we're working on talking about what topics will be in the chapter that was the Net Zero Roadmap chapter. One of the things we think we'll do is we'll update the Net Zero Roadmap chapter for current assumptions. Make sure it still holds true on changes in energy markets, changes in costs of construction, transmission, distribution equipment, things like that. So that chapter will get updated, but we think we're going to add to it some other topics and we'd just ask you to sort of take them away and mull them over, right? They're not work we're doing today, but it would be inconvenient to do too much work on them and have you say that doesn't make any sense at all. And so the topics were, we were thinking about what would happen to the power supply portfolio and cost if you tried to switch from an annual average renewable metric to an hourly renewable metric. If you then said, I want to be able to meet my load with renewable resources on an hourly, a more granular basis than just annual average. What would be required for storage? What would be required for load shifting to make that happen and what would it cost? We're talking about what would happen to our portfolio if we simply ceased rec arbitrage. That's not a very complicated math compared to the first one, but it is at least something that's of note to us to keep track of that. Changing potentially to the renewable energy standard as in if something starts to get sort of solidified or gelled at the legislature, we might run that through the model. And that's really the, those would probably become additional pieces of that chapter of sort of current topics that last year or last IRP was really all around the implications of the net zero roadmap. We think we'd be bringing in some more stuff on the renewable energy standard and more granular renewability. And so those are kinds of the things we were thinking about. We would always do the evaluation of cost of new generation, which ones look economical. That's normal, but we're talking about adding a few things to the chapter that was net zero. And that is my update number two for the IRP. Well, it's still abstract for us at this point for that chapter at least. Some parts of it are fairly tangible, but how do you model hourly renewability? In other words, you're moving all of your resources to the line with your load and what do you do to do it? We'll figure it out, I think, but it's of note. It's the ultimate step. If everyone is 100% renewable, then the hourly generation has to match the hourly load one way or the other. It's only at lower levels of renewable saturation that you can have this sort of free banking effect that we've been utilizing to good economics. But how much would our portfolio need in terms of load shifting and resource movement to sort of weather that change? So I think that's interesting, very interesting. It's probably a little early. I don't think it's gonna happen in three years, but starting to move in that direction and acquire storage assets if needed and understand how much load control we're gonna need, I think that's valuable for sure. Thank you. Item of our agenda for many questions, chicken. Are there any other items or things that the questioners want to bring up? Hearing none, I will entertain the motion. I move that we adjourn. Motion? Second. Second. All in favor? Aye. Aye. We stand adjourned. Okay.


All right. Good afternoon. I'm Vic. That's my email address. This presentation has changed a bit since I submitted the slides to DEF CON. I'll submit an updated copy to DEF CON, but you can also email me. How many feds in here? Yeah. Okay. Here's my usual disclaimer. Please read it, sign it. And this talk is actually four talks thrown into one and unfortunately when I was going over today, I realized there was no way I was going to cover 70 slides in 50 minutes. So we are going to skip one portion of this talk. If we have time at the end, we'll come back around. But you know the slides are there and I'm always available to answer questions. Next. Okay. If you're here and are interested in trying to crack on some of the Stego images, this URL, I don't see anybody with a laptop like trying to do anything, but we're going to get to this later in the talk and we will reveal some Stego stuff and show you how it works. But if anybody need this URL, all right. It's case sensitive because it runs on SunOS so that capital S and capital P has to be put in. What is the secret? We all know what a secret is. Why would we protect secrets? Well, because they're secret. Why would we share them? Actually, we will go over why sharing secrets sometimes adds secrecy or security, also for fault tolerance. So the next section, Chaffin and Winnowing, is the section I'm going to skip. It's pretty interesting stuff. It's a technique developed by Ron Rivest of RSA. He's a crypto god. If we have time, we'll come back around and it's a pretty interesting topic, but I had to cut something. So we're going to roll through these slides to the next section. Okay, secret splitting and sharing. What is it? It's just what it sounds like. You take a secret, you split it up and share it to make it more secure. We'll be explaining in detail. Why not use crypto? Well, you will encrypt data, but then what do you do with your encryption key? If you encrypt the encryption key, you're not solving the problem. You're just perpetuating it. So that's not a solution. You can store the key in a secure location, such as on a disk or in your mind, but if you die or the person who knows it dies, you can't recover it, or if the disk gets wiped, you can't recover it. You can store copies of the key in multiple locations, but then the potential for complete key compromise is increased. So to make the secret key or otherwise reliable and robust, you break the secret into pieces, distribute those pieces to different persons or machines, and then have parts of that, not all the pieces, needing to come back together to get to the protected information. So subsets of this group can then put their shares together and recover the information. Secret splitting. A secret sharing scheme has two parts, a set of holders and an access structure. The access structure is the subset of holders who can recover the secret by pooling their information together. Shares or pieces of a split secret that every holder holds. Two components. Here's an example where we have a set of holders, H1, H2 and H3, and an access structure set. So in this example, the subset of holders is who can discover the secret or uncover the information by pooling their information. So if holder one, holder two get together, they can recover the information. Holder two and three, they can recover it. All three of them together, they can recover it. H1 and H3 in this scenario, if they get together with their information, they cannot recover the data. A perfect secret sharing scheme is where any qualified subset can reconstruct the secret and any unqualified subset such as H1 and H3 in this example has no viable information on the secret. For any set of holders, there can be many different kinds of access structures. So for example, for a set of three users, you can use a lot of different access structures. So in this case, A or B or C means that all of these entities hold a big enough piece of the secret or the whole key to where any one of them can retrieve the information. Or you can have it where A holds a big piece and B and C, if they get their information together, they can recover the protected data. Or A, B and C all together at the last example can recover it. So just with a simple set of three holders, you can have a lot of different access structures and more than these examples even for just three. So why would we even care about different access structures? Because different secret sharing schemes may require different levels of fault tolerance and secrecy which you can realize by using different access structures. So if you have A or B or C can recover the information, that increases the fault tolerance. So I distributed a key to three people. I can get any one of those three people to bring their information together and recover the data, but it decreases the secrecy because it can be fully compromised by any one of those three people. If I require all three people to get together to recover the information, that increases the secrecy, but the key becomes more unreliable. Because if any one of those information or machines goes down, I've lost an integral piece of that shared secret and I can no longer recover my information. This is not limited to protecting like passphrases, although that's a common example. So you can look at this model in a lot of different possibilities. If you take say an organization that's going to make financial payouts and you have some top level business manager that has to sign a piece of paper to authorize that payout and you maybe need two mid-level accounting managers to sign that same authorization. So you need three signatures, one top level, two lower level to authorize that payout. That's an example of a split secret in a different model. So you can apply this to a lot of different scenarios and you can apply it a lot of different ways depending on your needs. Share sizes. So the larger the size of the share is, the less secure it becomes. So if I have a 20-word passphrase that I give to someone to protect, what are they going to do with it? Are they going to remember it? No. I mean, so what are they going to do? They're going to write it down. So now they know it and they've written it down. The potential for compromises there, the system is less secure because they've written it down somewhere because it's too much information for them to remember. So that's kind of important. And from here we could go into bounds and threshold schemes and logout algorithms and entropy and conditional entropy and theoretic notions, mathematical proofs, unions. This topic gets pretty geeky, but the concept is the same and we don't really have time to go into that much math. And I'm not that good at math anyway. Next slide. So here's just an example. If you're John Nash in that movie, A Brilliant Mind, I don't know if you've seen it. You can sit in the library all day and draw all these formulas and try and come up with some mathematical proof and apply it to business in some new way using this technique of split secrets and maybe become famous and get a movie done about you and Russell Crowe will play you. Secret splitting risks. The risks of authentication error or inconvenience, distress, damage to your organization or reputation, financial loss. I can give an example where I work. We have these inline storage encryptors. So we have back end storage area networks and NAS and SAN. And these inline encryptors, as data is written from Unix systems to those storage devices, it's encrypted as it goes through them when it's read off the storage devices. It's decrypted. And if you need to decrypt everything on the storage device, we have these crypto cards and crypto readers. And these are split secrets and they have to be provided. And our scheme was originally we had two card holders that had to provide these split secrets to recover or decrypt the entire storage. And we had a case where we're adding some storage and we had to decrypt everything. And a guy who works on my team was supposed to be in to support it on the security team. And a guy in operations had the other key. Well, the guy in operations comes in. It's a schedule change. They take down systems. They start swapping stuff around. And the guy on my team doesn't show up.   He said he's supposed to be here for this change. He's got the crypto card. And, you know, I asked if he called this house and his cell phone and he had and he wanted to know if I had his home address. And I didn't. So he was going to go knock on Rob's door and, you know, find out where this crypto card was. Couldn't reach Rob all day. I finally reached him late in the afternoon. He had been out the night before. Late. He was hungover.  So on Monday morning, the secret splitting scheme kind of changed. And yeah, our staff might have changed also. Personal safety just kind of is a wild example. If you have a safe room in your house and you and your wife or girlfriend or boyfriend or whatever, both have to put in some code to get into it. And only one of you is home when someone breaks in. Then you have a risk-based consequence of an authentication error. So the point here is to only use secret splitting where needed and justified and make sure you plan and manage the setup properly. Secret splitting uses. Nuclear launch codes.  They both have to put in some pass codes. Bomb components. They don't own it. So, you know, I don't endorse terrorism or anything, but just take an example.  So if they split up those ingredients to where you have, like, instead of one guy carrying a bomb or all the ingredients, you have 10 guys carrying pieces of it, they get past these checks and once they get to that destination, they put it all together and launch a successful attack. Level three and four, PKI. I worked at a federal agency. I actually set up the first production PKI in the federal government. And as our PKI matured, we had a secure room where we had to have two people badge in at the same time. We had to have, you know, different signatures to sign certificates, multiple people. So we had split secrets in that scenario. Intellectual property protection. So, you know, just as an example, if you work for Cisco and you're responsible for iOS, you don't want that leaked out to your competitors. Maybe you have all your developers working on pieces of iOS and only managers have the authorization through change controls and operations group to put all those pieces together to make a viable product. So you've split your intellectual property across all your developers to make it more secure. Where's filing? Illegal substance smuggling of possession. So say you know that the magic number with ecstasy is if you have 20 hits of it, that's where possession becomes trafficking.  Well, don't carry 20 hits of ecstasy. Carry 10 and get your buddy to carry 10 or carry 19 and get your buddy to carry one. Not that I'm endorsing illegal drug use. So that's just, these are examples of secret splitting. I hope I explained it somewhat clearly. All right. Moving on. Stegonography. What is it? It's covered writing. It dates back. It's been used for a long time, wax tablets.  This is a really slow message delivery system. But if they got intercepted, the message was not revealed. But when they got to the destination, they shaved the head and get the message. You can hide text in the same color as the background. Lots of different things. Digital stegonography hides information in digital files. And we'll go to the next slide. So why is it effective?  Because nobody expects the Spanish Inquisition. And to quote Kaiser Soze, the greatest trick the devil ever pulled was proving to the world he didn't exist. But my quote, and it's not original, is that the best place to hide something is in plain sight. And the point is that stego is effective because people take what their eyes see on face value as a rule. So if you get pulled over and you have a six pack of soda along with some groceries and you have a receipt from the grocery store where you just went and whatever, border patrol or cops are searching your car. They see that six pack of soda and think nothing of it. Well, maybe that six pack of soda is really some kind of container of illicit material. But at a glance, your eyes take what you see on face value. And that includes digital files. When you're looking at programs that actually execute or you're looking at digital images, what you see you tend to believe is what it is. And steganography works because of that. Steganography history, we're going to skip this slide. It's just boring history. You can read it anytime if you're interested in the topic. Simple DOS example, not denial of service, which I've had a couple of those tried against my laptop at DEF CON. Getting smurf attacks, plenty of port scans, good fun on the DEF CON network. DOS example, so you would open up a text file in binary mode instead of text mode. Append another file to the end of the first file and write and end a file flag at the end of the first file. So that anything in the second part of that file, if someone does a type command, type the file, it's not going to be displayed to the screen because it's going to hit the end of file flag because the type command reads in text mode by default. So the only way to get to that extra data that's hidden in that file is to switch to binary mode and open the file. And for improved security, maybe you encrypt that second part of the file. So if anybody actually opens it in binary mode, they think it's garbage data at the end of the file. So that's just a simple DOS example. Another example is where you would append a zip file to a gif file. So you end up with a file that's readable both by zip programs and gif programs, image viewers. But because it's got a .gif extension, if you try to open that file by default, you're going to use an image viewer and you're going to see an image. Meanwhile, you could have a zip file embedded in it. And the zip program will still open it, but you have to know that there's zip data in it. And the reason it works is because the gif information is stored in the file header and the viewers read that. And zip information is stored in the file footer and zip programs read that footer. Excuse me. All right. Modern implementations. Modern steganography attempts to be detectable only if secret information is known, the secret key. So this is similar to Kirchoff's principle that a cryptographic system security doesn't rely on the algorithm. It relies on the protection of the key material. This is a modern stego implementation. For steganography to remain undetected, which is not the same as unbroken, the unmodified cover medium must be kept secret or you must use a cover medium that is not common. So if you're hiding information in programs or images, you don't want to use pictures of Paris Hilton that everybody has because they'll see the original file size and attributes and see your same picture and see that the file size and attributes don't match or some popular song on mp3 compressed at 192. Well, if they have a copy of it that they can compare to your mp3 file that is different in its attributes, they'll know that file has been altered. So that way you might not be able to crack what's in there but you know something's going on but because then they'd have to figure out the algorithm that was used and know the passphrase for certain products anyway. So let's move on to the next slide. The color of secrets. So image file colors are important because of the amount of bits that are used and because images or slight changes in images are not detectable to the human eye. 24-bit color is true color. So you have one pixel in an image, it requires three bytes to create that one pixel. Each of those bytes represents a level of red, green, or blue, RGB color. So we have a purple line there and the color of the line is red. There's a value of 191, green is 29, and blue is 152. So you have to have those three bytes to make up one pixel of purple. So, you know, we'll go into a little more detail that kind of explains this next page. So what happens in steganography of digital images is it uses least significant bit overwriting and what you do is conceal or embed a secret message within the least significant bits of those color bytes. This works because the human visual system isn't acute enough to pick out changes in color. Next slide. So the least significant bit, and I kind of wish my laser pointer would work here, I thought the slides would be further back, the projection screens would be further back, but it overwrites the least significant bit, which is basically you have an 8-bit byte as you go up the string, the values are greater, one, two, four, eight, sixteen. So the least significant bit is that number one bit. So you're going to change that end bit, that right end bit. So in this example you're going to hide G in three, ten minutes. Okay, damn. We started way late. Okay, so, you know, you're going to hide B in like, G in the last eight, in the three pixels. So you're going to change the last byte of eight of those in three pixels. Each line represents a level of red, green, and blue. And so, like, this is a level of blue that's 200. You've changed it down here to two, I mean, that's 201, that's 200. So you're going to only have a slight change in blue in an image. So if you have an image file that has a bunch of flowers, yellow flowers, white flowers, red flowers, and you're changing just pixels in that from one shade of red to a slightly different shade of red, the human eye is not going to pick it out. All you see is flowers. Meanwhile, you've hidden data within that using a program that can change these bits and then read through them again to recover the hidden information. Next slide. Overview of some Stegotools. We're just going to roll through these slides.  Keep going, keep going, keep going. Detecting Stegonography Use.  So you can run those programs on an operating system that you're doing forensics on, say. And if it detects, you know, whatever this program, explore.exe has different attributes than it's supposed to have, then maybe that means that executable has been modified. These programs will also detect the existence of Stego software. So if you're using Stego to protect some kind of secrets, you really want to use it kind of offline and not keep your secrets and your Stego software on the same machine because if your machine gets seized and Stego software is found, then every file becomes suspect. Now maybe you're using good Stego software and you're using good secret keys to unlock it and maybe even if they discover it, they can't get at the hidden data, but you know, the smart thing is to not have those eggs in the same basket. Here's an example on some ABC broadcast. There's the original image at the top and this is using Steg Detect and Steg Break. These are free pieces of software. You can see kind of the results of running them. It revealed there was a Steg image and the passphrase was ABC. It's easy to crack that kind of passphrase. You're going to use good passphrases if you're going to use Stego, obviously. So next slide. We have some online examples. And because we only have ten minutes, I would, you know, let me roll back around and try to reveal a couple of these, but we're going to roll on and then come back to that because I only have ten minutes. Stegonography uses hiding information, you know, the drill. And it's actually cool. It's easy to use and, you know, if I show you these examples, you'll get a better gist of it. Hiding and sharing secrets physically. So these are spy tactics and practices. Don't steal secrets, make copies. So use a camera, use a video camera. One technique that's kind of cool is stick a camera inside a copy or machine and just as people make copies or printouts, you just capture copies of that and retrieve it later. Establish creative two-way communication. So you're going to use some signals to communicate with someone without actually talking to them, just some physical signals. Use dead drops where parties never meet. So when spies exchange information, if I wanted to exchange information with somebody here and use a dead drop, maybe I take something, I stash it in the stairwell on top of some light or under the bottom stair, and then I go out and make a mark on some DEF CON poster and that's my signal. The person I'm communicating sees that mark that we've pre-agreed on. They know I've stashed something. They go get it out of that stairwell at some other time. That person and I never meet. We're never seen together.  Employ creative envelopes or containers for secrets to be exchanged and use common or public areas. So you can go down a trail in the woods and drop something, go on an elevator, stash it in a little emergency thing or up in the ceiling in a library, stick something in a book that somebody's going to pick up later, sports stadium, whatever. Next slide. More spy tactics. You must keep the secrets hidden until time of transfer through a variety of methods. You may use caching where you bury your secrets, weapon, money, tools or whatever. If you're using caching or storing them somewhere, you have to weigh the accessibility against the secrecy. So do you need to obtain that often or rarely? How far away is it? How hard is it to get if you need to get it back? Use a booby trap container that will destroy the contents if they're not opened properly. So that's a pretty good technique. That way maybe you've lost the material, but the material is not compromised in a way that's going to end up in the wrong hands. Destroy obsolete records, receipts, tools. If you're doing this kind of secret exchanges, you don't want to keep any information you don't need because it might incriminate you later. Next slide. Two-way communication. You may need two-way communication, so I mentioned make a mark on a poster. Well, maybe somebody has to do some other communication to give me information that the secret has been picked up. So you'll have signals to note that the drop is made, may need a different signal. You can use a, you know, throw a drink can somewhere, break a tree branch going into a park, make chalk marks. So hobos use this to like designate. They do war chalking, not for wireless access points, but like where you can get a shower or a free meal or something like that. Maybe a rock somewhere. And before the Civil War, people who were helping slaves escape would hang quilts that showed direction to some escape routes. So that was kind of a two, you know, secret communication channel. Secret envelopes only limited by the imagination.  Only limited by your imagination. Lots of interesting ideas here. So you could do a lot of different things to hide information in containers. Next slide. Dead drop uses, you know, drug deals, classified information exchange, stolen goods exchange. Use your imagination. Next slide. A few live containers. I have a bunch of containers to like just show stuff. And I have a bunch of things, but I've been here since last Friday.  So instead I just put together some slides with some images for some examples. Leftovers. You could use real leftovers. You know, put something in a pill bottle and stick it in there to where it's not getting ruined. Or you could buy these fake leftovers. A thing of hairspray. That PBR can. There's a hemp shop down the street across from the stratosphere tower that has a bunch of soda cans that you can hide stuff in it. Don't ask me how I know that, but... But you can buy one there. Next slide. Inside a candle, inside an electric outlet. Who's going to look there in a house if they're looking for something? The sprinkler head. A sprinkler system in your yard. Who's going to walk around and pop in every sprinkler? People see a sprinkler head. They think it's a sprinkler system. Next one. You know, this fix-a-flat. This fire alarm thing is kind of my own. You know, some of these things you can buy online. This fire alarm thing, I actually happened to get a fire alarm and gutted it, and you can use two-way tape and stick it anywhere and people think it's a fire alarm and ask something for someone. Plastic models. Ask me about this Goodyear Blimp off-camera. Specifically, I used to have one of those. So... Holocoins. I have that silver dollar. No one can tell the difference. Same weight. You can store obviously small things like microfilm or something in there. That fate nickel has a cipher in it. A mantle. No attack on that young lady, but that's one ugly mantle.  But, you know, people see a mantle and they think it's a mantle. Okay, one minute. The sandbox. I have another story about that. So, you know, ask me later. Next slide. Holosticks and branches and stuff. So, you go hiking in the woods. You have a hollow stick in your pocket with something in it.  It's out of the way. Nobody sees you drop it. You're off the trailhead. You're down the trail somewhere and nobody sees that person pick it up. So, next slide.  Cold War spies have actually used dead rats to hide secrets and when they started doing this, both US and Russians were getting carried away by animals that were eating them. So, they found out that if they put some Tabasco sauce on them, the animals would leave them alone.  So, next slide. Jean-Avie from Brush Hour 3. It's kind of that whole tattoo on the head thing. Next slide. References, some additional reading and, um, yeah, I think I'm out of time and I'm really apologize. I would love to show you the Stego images. But, thank you for being at this talk.