Welcome back to the channel everybody today. I'm going to show you very briefly how to set up your own configuration of Neo Vim now I'm not gonna go very in-depth today. I might do make this turn this into a little bit of a series Next time I'll look into plugins and stuff now. I want to start right off the bat by saying I am not a Vim or a Neo Vim aficionado. I don't know everything I wouldn't even consider myself an expert. I'm very much a noob when it comes to them You watch those Vim videos and everybody's just flying through Vim and they know all the key bindings and stuff like that I'm not that person I'm very much probably like anybody's watching this video. I'm Just a guy who looks some stuff up on the internet and thought he'd share what he's learned so far Because I got way more to learn so the first thing you need to do is install Neo Vim and that's just That's just a Pseudo app to install Neo Vim. That's literally all you have to do on Ubuntu if you're on Arch is Pseudo Pac-Man dash capital S Neo Vim Neo Vim is pretty much in all the repositories. It's real easy. Take very long to Install it all. So the next thing we want to do is we want to cd into the .config file Okay, if you do an ls-a on this Basically You'll see all of your config files. Now if you're not If you've been using your system for a long time, you probably see more stuff here than what I have This is just a virtual machine or If you use a window manager tiling window managers a lot of times those have a lot more different config files And this is what they're stored.  Now you want Very specifically called nvim not Neo Vim For whatever reason, it's just nvim is not Neo Vim. Okay, and then we want to cd into nvim and That's just an empty directory. Okay, so the next thing we want to do is Create a general file so make directory now You can't you can just do this you can do touch init dot vim and You could just use that file for everything you could just use that like you would use a vmrc file and Everything would be great, you know, it worked fine like that or you could be a touch more organized and do a put your settings in a general file Okay cd general And that's just an empty file and we want to create a Configuration file called settings that loops settings them Okay, and then we just want to end them into settings that them Okay, now we're in Neo Vim. We're using the stock configuration file and We just want to do some, you know, if you've never used them before I'd answer.  I'm assume some basically I'm assuming that you know at least a little bit of how to use them That's basically all I know. It's a little bit how to use them. I don't know everything So just Insert the first thing we want to do is I always change the leader key So by default the leader key is the the I guess it's the backslash That's way too far away. We want to make it space so insert let G and Then map leader And I make sure I learn how to spell equals Apostrophes and this is a backslash And then bracket or Whatever that is space and then parentheses, okay, and then we want also want to do syntax Mabel oops Spelling is hard and we want to set the line numbers so set number Relative number Okay, and then if we Get out of the skate mode and save this and then do source Dollar sign my Vim RC Wonder why they didn't work. Why is nothing working today? Well, fine. We'll just quit out. We'll just quit out of this and we'll go in here again Why is nothing working today?  I'm a dumbass You got to source it first Anyway, so we got to quit out of this and we got a CD up a level and go to nvm In it Vim and source Source and Then we want to kill the slash dot Home oops Config in Vim slash general Slash settings Okay, and then W Q Just W and then source Dollar sign my Vim RC There we go If you skip steps things don't work That's pretty much the way things work Okay, so now we can go back to the settings and add some more settings So we quit out of that CD into general oops Forgot I'm using bash or not and not zsh nvm Setting and we're just back here Okay, we'll add some more stuff here. We want to set the wrapping so if you're How you set up your text wrapping is really good depending on what you do with them So I'm a writer so I have something specific for Making it so that when you have a paragraph a text It actually stays together as a paragraph even if it's all on one line It looks like it's a paragraph Where if you don't do that it things get wonky so I have set wrap line break No list All right. Now some people Have no wrap Duh, that just means it's not gonna wrap text at all. It'll just keep going and going on and going And that's that's not great for writing so set wrap line break and No list, okay, so it takes care of the texture. I mean we also want to do I like doing set cursor And then do this source dollar sign my my MRC and That'll get you a line You can move I'll do a separate video on how to theme that line because really that's not all that attractive because a lot but Actually, I can just go through it So if you do if you want to go ahead and theme it real quick, you can just do highlight which is hi Cursor line C term oops equal none see Term BG equal gray as you can tell it did not like that C term BG gray and Then a C term foreground equal white That's the text for round and then these are for GUI versions of them BG equal gray GUI BG Gonna make sure I spell it right g r y and then GUI foreground equal white okay, and You know if you do this right source dollar sign my of them or see That's better cool, huh? so there's that and then The next thing you want to do is deal with some splits So you want to split basically means you can have two Files open side by side. It's basically splitting them. Just how it's how it looks bash R.C. Okay. Oh, I'm not I was in the right Directory to get that right, but you get the understanding. So we just Yes, I know I could have done that and the thing about them is you can quit in so many different ways And this is the first way you learn so Getting out of the habit of quick exclamation point is pretty hard Anyways, I want to talk a little bit about splits That means you're gonna have to Insert mode make sure at the end here You want to set split below split right Okay, and then we also want to do That basically just tells where What does that do? What does that do? I'm not sure what that does split below split right So horizontal splits will automatically be below Vertical splits will automatically be to the right that just determines. Yeah, that's what I did You know automatically set your split position to the right or below it otherwise Sometimes they'll go to the top or the left depending on which file you have active or something I don't know how it does default in a default way Oh, next thing we want to do Before we do any of that stuff we want to Go up here Oops, already an insert mode Set t underscore Co Equal 256 That allows your color schemes and stuff to come through because otherwise then won't use a 256 color palette That's just something that you know is default and pretty much everything Now As you can see my mouse works in here. I can replace I can scroll up and down just fine, but I can't Put my cursor where I want to put it now. Sometimes I use my mouse. It's Probably Something that will make me lose my nerd credit to tell you I use the mouse in Vim sometimes But I do I can't help it I just do so We want to Put in here Set mouse Equals And I see our that should Let me use my mouse whenever I want to See if I'm right. Oh, that's because I It really help if I was doing this, you know, right all the time So I should be able to go through and put yeah, I see how now I can go through and put my Perseverance with my mouse now Like I said, that's hypocrisy and Heresy is probably the word I was looking for there in Vim circles, but Sometimes I just want to do that Anyways, so next We want to go through And Set up Spaces instead of tabs. So basically this means it'll Instead of if you use a tab You can only go back and forth a tab at that point if you set up spaces and says has a set expand tab and Set smart tab Basically this allows you to Go back Spaces instead of tabs so Source My So now if we do insert and do a tab This will let me go back, you know spaces instead of tabs That's useful in case you want to Remove some you know spaces there or if you want to either the tab was too long or too wide So I'm not sure We also want to make sure we always show the status line so Insert A set last status Equal to learn how to spell last status Oops, and that's supposed to be a two and out of three Typing is really hard today folks Anyways, and that's just make sure that the status line always shows up and Basically right now you're at a fully functional vmrc file or neovim in it file You could be perfectly happy and this would be all you need now In my next video, I'll talk a little bit about how Key bindings work I'm gonna set key bindings for switching between splits set key bindings for opening up nerdtree after I do some plug-and-work I guess also some Key bindings to Remove many bar the toolbar the right scroll hand right hand scroll bar and so on And then Probably That'll be it But I'll see if I can find so you want to also to resize splits because the way you resize splits right now is Basically dragging as far as I know Is the default is not good anyways that is it for this time if you Like this video go ahead and subscribe and like and all that stuff. I can't imagine anybody actually wants to Watch this nonsense, but What are you gonna do? See you next time. Have a good day


Everybody for us here hoping 2022 top scrim sapphire Baseball five box number two find the random results anytime of late sports cards. I'm gonna go ahead and get started now They're just they're just like steady right now. They got hot now. They're just like smart That's when it start off strong and then you start saying just ride it Can't win the division in the beginning here, but you can lose it. Yes, and they jumped out to the big leads Just McClannahan pretty much And even half on was on the aisle at one point, so All right, here we go y'all Getting big checklist on this but you can hit but we got a purple right away And it is rookie Matt brash nice card Mariners purple rookie five out of ten nice Maddie brash Good stuff Philly's team card Garrett Richards Red Sox legends Brad Keller Mitchie two bags Mike trout Kepler Evan White Bassett and Archie Bradley. You could stand outside for five minutes. It's so humid here. We're just It would work great Deekman. That's RBI leaders Is it literally all braves do ball Riley and all bees? Do ball Red Sox legend Yon Gomes with a gold is Minnesota meet-up that's Otani and my Eda So we'll have to roll a dive for this one 15 to 50 Let me flip to the others first Cobb and Luis heel rookie So we'll go one two three left for the angels and four five six right for the twins Good luck. Nice Minnesota meet-up card. It's gonna go to left angels Nice angels there Trevor Rogers singer Rasmussen. We're just talking about him JVJ as Red Sox still Ward of Escobar Keeboom Raver St. Martin Chapman as in a he's crushing it this year Bobby Baez Jay Hap Lurie Garcia Brian Hayes Thank you sorting the shipping. What are you doing? I Just got done Sean and I had to make a Kyle order and Kyle had to make a coffee order We needed to don't blame you guys Got we got to make it, you know, Yachty Molina Michael Panada and an orange. I'm Jacob DeGrom. That's color match Go Mets number one of 25. I'll tell you there's Kyle right there now. It's a party in here To raise fans to Red Sox fans walking to a break in studio. Let's go. What happens? I That's true. He's a Marlins fan Ernie Clements Marlins team card Brad Miller and Michael Brantley. Oh, it's kind of Yeah, we're just gonna stand around. We're all just watching me break sapphire. I guess Gangs all here Sean Gunther and a gold rookie Reed Detmer's Angels Rookie picture colors looking pretty good so far one of 50 Over arching battery and Byron Buxton Everybody doing ever. It's quite chat. So it's so silence. So do but Dino Zimmerman and Widener That one is for sure this one. Yeah Will Smith Toronto talent Ty France and Willie Castro about gold job. Is that the only one from that one that would be Yeah, yeah, it's gonna be together the knob. They'd be all right Working see that Jake the guy's working Jake Crona words Zach Collins Matt Brash rookie and Reds team card He's like, I'm off the clock. I'm not sure. Yeah, I did Don't do any work then. Okay. That's that's that's illegal when auto rookie Martin Perez Red Sox legend see see Red Sox legend Aaron Hicks Shane Bieber get like a 60 array with the Red Sox Look into we are a for the range My words Shoveling the chips down your throat right on Spencer Kyle and Sean and I are about to be a chugging some chugging some coffees Hey, this is our dough. Yeah, he bought it one time. Oh, man, it's Krause for key. Yeah, I'm gold McLean a hand future stars There we go. Now Jake's excited 50 of 50 gold McLean a hand future stars Sion Really Calhoun on the clock. Oh good for you Spencer red gardener dish La Fonnie Charlie Morden Tiasca Hernandez. I See a magic mat doing that all the time Shoveling chips always on the clock Castillo Logan Allen of a Rio's we got a how far card looks like it's just Uh Yeah, Tatis and Vlad's the ones that are names here, so we'll go one two three left blue J's four five six right Padres Two left blue J's on this one Lou J's Need a big parallel. That's a nice one so far. There's Minoa future stars orange Astros team card color match. That's pretty cool That's sick. That's awesome champion championship year to wow 4 of 25 That's pretty cool with you know who on the front. Oh both these guys, you know auto Lopez Mark Molanson Pirates legend Mark Molanson Yeah, Adam Fraser Chavis as a pirate Lopez and belt belt Torkelson rookie there we go Tigers with a gold of Max Kepler twins 44 of 50 Garrett crochet and Koei Koei seager as a Dodger Kyle Muller Mike Soroka Tommy Edmund and Kyle Gibson Gibby Jesus Aguilar Chris Archer raised team card and Jed Larry Alright two more here pretty solid stuff so far so we're at three to go on dynasty tweet that out really quickly Breaking pretty soon Got a couple of tier one cases, which don't take too long at all and then we're at dynasty We got basketball football Star Wars and soccer as well tonight When our garden needs like a soccer pub I can go to on Saturday mornings Not like a soccer place is that a pad parasha. Oh my god We're not focaccia On so burto pod parasha it looks like right or red All right, I'm confused now. Is it red? I think it's red. I think it's podperosh. I think it's red It's one of the other. It's a big card. It's a big parallel ranger Isaiah kinder for lefa. That's a red five out of five rangers Isaiah kinder for lefa a Sam's boy I kf read for the Rangers James McCann Shane Boz rookie glaver Torres Giants card and Eloy Jake Myers rookie Pat Corbin Lift off and Pat wisdom. You got Lakers worse than I take I got the dubs got the dubs Me we're going to game seven. Got Lakers here dubs there. Yep. Come the Jansen with a gold of Jonathan Daza Rock he's the 50 Louisa rise a Steven Brault police rise best the hitter hitter against the Right, right ran a pitchers like ever Best hitter ever Jose. Hey, I'm a Jose Urena. It's going for Ted Williams bat 400 batting average Connor Overton in an orange of sunny gray reds. It's twins ace sunny gray to 25 Ozzy all these Joe Ryan Recky for the twins Curvin Castro Tigers and This one goes Dodgers because they have two of three here Uriah Swainwright Bueller Orias, I should say Carson Kelly Jorge Alfaro Luke Voight and Xander Bogarts Kyle Freeland with another gold here. It is Colin Moran Pirates number 14 to 50 Future stars McClellan and Ryan Vallejo All right last one Nice more basketball football spots coming into which is awesome. There's only three to go on optic now Just three J who plans to originate survivor? Gotta get it Yeah, I've been playing it a bit It's fun game Robbie Grossman in the Lario and a gold Chris Bassett a's Justin Verlander, did you well? Sky Ninja MVP is rookie No So I'm gonna roll a die here. You got wander and Harper. So one two three left for the rays four or five six right for the Phillies Six right side Phillies Phillies on that one Turn around and they're on the other side Winker Bowman Eduardo Rodriguez and a slam Diego It's uh, it's like partial open world It's like a platforming like open world game You have to get like certain abilities to get to certain areas and things like that I wouldn't call it straight up open world though, but there's like a there's there's a few parts that are A um High five highway Soto Polonko and a Jackson Coar rookie for dugo Keegan-Akin Dickerson and Calhoun It's cool Calhoun still playing Jordan Lyles with an orange rookie Bobby wint jr. Let's go gigantic 14 of 25 royals Huge That's big huge for roger roger kevin pullecky guardians He's not on the guardians. That's a red sock pullecky the guardians team party yandie The yandie man yandie man chad pinder got randy land yandieland Yeah Devers Hoffman and a gold flaherty cardinals to 50 And steven metz. All right, y'all let's do a recap here. I better keep an eye on this All right, gold's to 50 of jack flaherty chris bassett collin maran yonathan dazza max kepler shame mclannahan Three dentmers This card went to the angels on the dice roll is minnesota meetup. It's otani in mayeda Orange of 25 of degrom sunday gray Astros team card purple to 10 matt brash red to five isair kind of a leppa and orange rookie bobby witt jr. Numbered of 25 That's gonna do it. Thanks again everybody more baseball coming up


All right, it felt like after the last session in that I wanted to get up here go. Let's get ready to rumble Kind of fun, right? But there you go, right? It's all good. So Everybody up and awake this afternoon. My name is Dan Weber. I'm the CEO for the election integrity foundation You're not for profit to fund the voting village. So appreciate y'all being out here today Don't forget to go and if you're on social media in that tag it with at voting village DC on Twitter And use the hashtag hash voting village DC So happy to have you guys in this next session is bootstrapping vulnerability disclosure for election systems We've had three distinguished folks up here on the panel First one is Jack Cable security researcher and student at Stanford University I think he probably have his own session going through everything. He's seen at such a young age He's a coder turned white hat hacker and a rising sophomore at Stanford But you know, you need to hear a couple of these fun ones, right? So the coolest thing is, you know hacker one bug bounding program identified over 350 vulnerabilities and companies including Google Facebook Uber Yahoo and the US Department of Defense and For those of you had the opportunity to go the hacker one, you know saying party the other night with 1800 people We thank them for all the free drinks that we got It's all about dopam drinking and other people's money Katie Trimble is section chief vulnerability management coordination for our US cyber security and infrastructures security agency Sysa Department of Homeland Security and You know, she's gonna go through all the different 16 critical infrastructure sectors and levels of US government organizations that she supports and Then Trevor Timmons CIO for Colorado Secretary of State's office He has been there since 2007 after eight years as deputy CIO and director of software development So we'll welcome all three of them and get to the heart and meet of the matter All right. Yeah, thank you to everyone for coming out today so we're going to be talking about vulnerability disclosure for election systems and This is in part motivated because of some work. I've done Trying to disclose vulnerabilities to various states and local governments So I'll go into the stories there my experiences and how that could be improved But first just to set the stage with vulnerability disclosure and why it's so important. So It already so yet in short vulnerability disclosure is a process that allows External researchers to easily find a contact and channel to report vulnerabilities so if I say find a vulnerability in a company I can Email it to security at that company calm and they can easily receive the vulnerability report and this is It works great in industry I've as a researcher I've worked on programs like Facebook Google even the US Department of Defense yet among states and especially for election systems, we have zero states or Election vendors that allow reporting vulnerabilities. There is one state that has vulnerability disclosure policy though It is not actively maintained and they won't even respond to your emails so we need something that allows people to report vulnerabilities and Be assured that they'll get a response and that the vulnerabilities they report will be fixed and Especially for election systems. We know that this is something that is under active attack by our nation's adversaries so if you read the Mueller report or the Recent Senate Intelligence Committee report you'll see that all 50 states have been targeted especially there One of the by nature public-facing systems the say voter registration databases are common targets There have been several high-profile breaches Due to states targeting these even the Mueller report mentions a common attack vector sequel injection Which was the vulnerabilities I found in these state voting databases. So, yeah, I'm joined here Yeah, but Trevor from Colorado and by Katie from CISA and I'll yeah start off with some of my experiences disclosing vulnerabilities and again the point of talking about this is not to shame these Cities and states for having vulnerabilities. It is completely normal to have vulnerabilities and matters much more What is done once they're reported because? It's normal in industry. It's normal in government everyone has these and we need to have channels for researchers to report them And that's not something we see anywhere with election systems. So room for improvement So it all started with election systems for me when I was registering to vote back in October So I was on my cities voter registration site and noticed that Just putting an apostrophe in one form. I could I well, I received a 500 error and being curious researcher I soon realized that this was a sequel injection vulnerability and It's not like I was actively testing for this But once I'd found it it was then my responsibility to get to the right people so they could fix it So I began the process of disclosing this vulnerability. I reached out to some contacts I had disclosed it to several people including the chief information officer of the respective city and Tried many many times to get to the right people. So that was in October in December I noticed a change they had put a web application firewall in front of the site Which would make it harder to exploit the sequel injection vulnerability, but I could still confirm it was there So they had impact the original vulnerability even though they had received the report so I try again and again didn't get to the right people somehow or they didn't address it and Kept trying to disclose going through alternate routes and may comes along which is then six months later. So I Began trying to think of other ways to disclose I then came to Katie and her team at CISA and then in June I decided to just email one of the email addresses on the actual board of elections just a random public contact email address and doing that I was able to get a response and At least according to them. They hadn't heard anything despite all of my attempts to disclose there's some issues say because the city may be siloed from the Board of Elections, but even then you would think that if a city receives a critical vulnerability report for its board of elections They would try to get the report to them So not sure quite what happened on the back end there But once I was able to make contact they were able to address the report and fix the vulnerability But that was seven months after I discovered it So who knows what could have happened in the time between then and time that actually fixed it So that was in one city then in another state that I was I'm also looking at I Realized that there was another sequel infection flaw. This was the state that I lived in so I was also going to check my voter registration status and Again notice this flaw and what was particularly concerning was this state had been breached three years prior so if you It's public if you read up it was through sequel infections So not only had they been breached through this type of vulnerability But the vulnerability was still there or at least there was a page where it was still exploitable even though they had fixed in one area So this was again incredibly concerning I tried again going to say the CIO of the state some other contacts And a couple weeks later. I hadn't heard anything Based on what I tried in Chicago I also reached out to just a public contact email address for the board of elections and that time gone contact with someone who was Technical and they were able to fix it within the day that they received that and again They hadn't heard anything despite I went to All these various people, but they never got the report to the right people. So without a vulnerability disclosure Policy the process for getting vulnerability to the right people as a public individual is Incredibly difficult and it will remain that way unless we give hackers Security researchers, whatever you prefer a way to disclose vulnerabilities in a way that they can be assured one that they're protected And two that will get to the right people and it'll be addressed. So Yeah, that was my experience is disclosing these vulnerabilities so moving forward what we want is for states and election vendors to start thinking about establishing a vulnerability disclosure policies and giving researchers a way to help out and By allowing a form of public contact We can really begin to foster these relationships that we want to have and we can start to be more constructive when it comes to security So I really do believe that vulnerability disclosure policies are a necessary first step towards being more Transparent and better when it comes to security and that there's something that we're going to need to do and we need to do it before 2020 so with that I'll give it to Katie who will talk through some of the work that she does at syssa All right, so from Jack's story you kind of can see the complexity here and all the different pieces And so we at syssa we have some vulnerability portfolios. So if you're familiar with mitre's CVE program So I run that the NIST NVD program I run that Cert CC Carnegie Mellon program. I sponsor that And then the ICS cert vulnerability handlers. I sponsor that So that work all falls within my office Even with all of that experience so cert CC has existed for 30 years We've been coordinating vulnerabilities for 30 years mitre has existed for 20 years doing CVE work We just had the 20th anniversary birthday party at black hat this past week So we have a lot of experience doing vulnerability disclosure But most that's in products and so even with all of that experience We are still in uncharted territory when when jack finally did get to us It still took us probably two months to find the right people for the cases that he brought to us He had already made all of this context He had already done all of these things and then we tried to back channel in and find out the people that we Needed to talk to which just goes to show that when we're talking about vulnerability disclosure. It's not easy It's not simple. It's not straightforward. It's very complex There's a lot of people and when you don't go to the right people There's this amazing thing that has happened throughout the years and it's these a this this training We've done for social engineering like who would have thought a security awareness training actually works So when we call people, you know big companies and we're trying to find contacts to get vulnerability information To the right kind of the product safety team we call and we say hey I'm Katie from Homeland Security and they go. Yeah, I'm sure you are click And we're like no, but seriously, I promise I am and they're like, uh-huh, and then they hang up the phone So it goes it works and so in this case what happened is it's working Negatively because people think when Jack's contacting them that you know, oh, yeah I'm sure you found some vulnerabilities or I don't know what to do with that Thank you for bringing it to me, but I don't know what to do with it and that happens election systems are very complex We categorize election system vulnerabilities in three ways We look at them when we say there's what there's one there's software hardware, and then there's digital services So software is the so the automated software services that allow you to vote online There's several of them Hardware that's the individual machine that happens to be in your polling station Usually these are air gap systems. These are solid machines Industrial control systems and then there's the digital services sites that's your voting registrations your databases the web services that are available to the public They're all vulnerable But here's the thing about it all of these things are vulnerable in every sector So while we feel very unique in the election sector, I cover all the sectors I deal with everything nuclear power plants fit bits nest thermostats Pixar software you name it we cover it So the challenges that are in election systems are in no way different than the challenges in any other system It's just new and uncomfortable But there's only one way to get through that and that's just to get through it So we are looking at weather or looking at climate not weather So each individual disclosure may be painful in the beginning But once we move through that and get used to doing them and develop processes and get those things because those processes in place It will be so much easier. It'll be so much more straightforward So what I have behind me is the ecosystem and this is DHS's ecosystem. This is specifically designed for products It's not designed for digital services We don't normally accept digital services vulnerabilities because we're not the internet police and I despite you know the fact that I work for Homeland Security I am here to help. I am not a government suit. I'm sorry. I'm wearing a black jacket. I normally don't But my other jacket got like a spine. I don't know anyway So I We are here to help we do try to help We've expanded our scope when it comes to election services because we think it's so pivotal to just daily life for everyone That we really need to take this and run with it as a serious matter So what we've done is we said, okay, we're gonna also take you at the website vulnerabilities We always prefer that a researcher contact the asset owner or the vendor directly in the in the first round But if something happens and that's a negative sort of relationship come to us and we're we will we will take that and we will Try to do everything we can to get that fixed. We're all about getting stuff fixed We believe that things should be in the public sphere should be to shine the light on it The light is the best medicine It's uncomfortable in the beginning, but we promise it'll get better So all of that said there's my soapbox, but let's go through the slide So when we do this vulnerabilities are reported to us by a researcher. We can't go find vulnerabilities on our own There's some legal liability issues that happen with that. You don't really want DHS hacking your stuff It's just not a good idea So researchers bring us vulnerabilities. We work with a researcher. We do the collection the analysis and the coordination We try to independently verify that vulnerability exists That happens at cert CC or Idaho National Laboratories depending on whether it's IT or OT We then notify the vendor we work with the vendor to develop a patch We create a patch mitigation schedule usually it's 45 days and we say at 45 days. We're gonna we are gonna disclose this Once we've originated and worked on that schedule made sure everybody's in agreement. We all hold We reserve the CVE we are CVE naming authorities ourself so we can reserve a CVE Then afterwards when we've reached our deadline. It's time to publish. We all publish at the same time Usually it's within minutes of each other. So the The researcher publishes their advisory the vendor publishes their information with a security bulletin and usually a patch And then we put out our technical alert or vulnerability note at that time The CVE is populated and made public then it flows over into the NIST NVD catalog Quick between NIST and MITRE so if you the difference there is CVE's are kind of like a dictionary. They're just a this is what it is NVD is like the encyclopedia. It's the elaborating and reaching information that describes that vulnerability So quick difference there Okay, so we're gonna hover on this slide for a bit So that's kind of the ecosystem as it as it stands right now for us We're in a learning curve, too We're trying to figure out how do we as a government agency adapt to the change How do we as a government agency do better about reaching out to researchers reaching out to vendors building positive trust relationships? We tell people we don't hoard any vulnerabilities. The Department of Homeland Security does not hold any vulnerabilities My job is to close tickets and I cannot close tickets if there's information. It's not been disclosed I'm counted my performance plan is directly tied to how many tickets I close So if I want to keep my job we publish There are a couple other programs that are Intelligence programs we do not submit to those intelligence programs that one is called the vulnerabilities equities process if you're familiar with that Any vulnerability that comes to DHS from my private researcher does not go into the VEP I know because I run it. I'm the DHS rep to the vulnerabilities equities process as well So in the VEP charter there is a section that says that vulnerabilities that were discovered during the course of incident Response or security research which are intended for disclosure do not make the threshold for VEP That is the exact verbage because I say it so often we do not hold Date vulnerabilities we publish vulnerabilities. We work with vendors to make sure that they have the opportunity to fix things We work with researchers to make sure that their needs are being advocated for I Always tell people I'm not on the side of the vendor and I'm not on side of the researcher I'm on the side of the taxpayer and I'm on the side of the system administrator who needs to fix that system So we try to be the honest broker in the situation and we realize that's a little bit of a shift from typical I'm in a black suit and government official But we genuinely try so I have nine federal employees and three contractors and fifty consultants in seven states And we all have that same ethos. We all want to make this a better place So we have some takeaways here Things that we can do when we look at this there are all of these positive things That happen this is an uncomfortable position to be in because it's new it's so new and we don't know how to handle it But we've done things like this in the past So I specifically look at the medical sector and we say okay. Well the medical sector about five years ago Was very you know hands-off. They didn't want don't touch my software. There's nothing to see here But they actively embraced it. They said you know what we're gonna change some laws here We're gonna make it easier for researchers to do research We're gonna accept those those vulnerabilities and we're gonna fix them and that has made so much difference It's now a routine thing so much so that it's not even newsworthy anymore And that's where we want to go. We want to make it routine There are so many positive things that happen when you just get things out in the light when we try to hold things back That's where the opportunity for negativity lives so we say Researchers positives for researchers takeaways. Okay So yeah from the researchers side Just some thoughts if you're either if you found a vulnerability or if you want to help say your local Government be more proactive when it comes to security. One is to offer help. So there's great resources out there and say volunteering with your local or state election board and really helping to Improve security because the truth is is that often they're strapped for resources and Some free help can go a long way and with that say if there's a vulnerability disclosure policy established Which we can hope to see some soon then participate in those and give states the feedback that they need to get better so really just to continue pushing The organizations to adopt those best practices out there that we've seen in other industries and we've seen how vulnerability disclosure policies can be really effective and to keep pushing organizations to adopt those and foster a type of Relationship that really focuses on working together rather than Say doing work separately. It's with a vulnerability disclosure policy It connects the researcher and the organization so that we both can become more Or well the organization can become more secure. So Trevor. Yeah, if you'd like to so Again, you know, I work for a secretary state in Colorado and a Colorado nor our office today Currently have a vulnerability disclosure policy or a program. That is something that we're changing My eyes were really open to this We've always had people that reach out to us and report issues that they may see with our website and that sort of thing That's the type of thing. I think we we tend to be fairly responsive to and But we don't have that formality around that and and really my eyes were open to this about five six weeks ago You know around the protection of the researcher from, you know Prosecution liability anything like that. I mean, it's the type of thing that we engage with all the time when we have external vendors Coming in and doing penetration tests, you know and doing that sort of thing They're concerned about the impact of what they would do and whether you're gonna kind of nail them to the wall And so, you know, Colorado We're working with our state chief information security officer and within our office to make sure that we've got a solid policy I'll give a ton of credit to Bowwood from the Atlantic Council to Eric mill from the Senate rules committee administration And to the folks at CISA for actually kind of leading the way providing some good advice in terms of how we can do this with You know companies like bug crowd and hacker one and Sinek to actually take this and move it to the next level In terms of a VDP, you know kind of working together with with you and you with us And I want to touch this really quickly on the election vendors in terms of creating those channels There is hope, you know with the designation of elections as critical infrastructure They established this government coordinating council and the sector coordinating council where we're bringing the public sector private sector federal state local resources together to actually talk through some of these issues, you know the folks on the SCC so again, those are the folks on the private side who are providing election systems some voting systems voter registration databases Election night reporting systems all these kinds of things systems and services when they're providing them to states and to locals That's their group. Okay, they've been talking with the folks to the IT ISAC in terms of how those disclosure policies Work within that context, you know with fortune 10 companies that that do this do it well and do it effectively To actually improve the landscape for all of us and so there is hope I mean they're they're talking with those people so we can figure out how this is going to work within the elections within the election side So the last thing before we go to the resources. I just want to say so I always put this quote up And those of you see me brief before you've seen it before So I love this quote. It says vulnerability sounds like truth and it feels like courage truth and courage aren't always comfortable But they're never weakness So the point is that this is uncomfortable. We get it there There are so many moving pieces here. It is it is hard to admit that there are flaws. There are failures there There are vulnerabilities in every system everything has vulnerabilities in it But the the point is that we have to work forward We have to we have to move past that the opposite of love is not hate It's indifference and so when we can't have a conversation because we're so caught up in the in the politics or in the Negativity or in that bad feedback cycle That is the worst place to be we need to be able to have a conversation and we need to move into that conversation from a place of Understanding that it's not weakness just to talk about it. It's it's truth and it's courage So that's that's where we stand on it. We do have some resources that we listed here If anybody wants to talk to any of us where we're happy to go outside and do it I think there's another brief that's that's coming in. We don't want to just let delay them But do you guys have any closing thoughts? Yeah, I would just say yeah, please do come talk to me or Katie or Trevor I really do want to help out as much as I can in say Giving advice for starting vulnerability disclosure policy and making it as easy as possible So yeah, we have some resources up here. The Department of Justice has published a great vulnerability disclosure framework There's disclose.io, which has open source vulnerability disclosure policy terms You can look at other vulnerability disclosure policies out there. So yes, please do come to us and talk and see how the process for starting a vulnerability disclosure policy isn't that hard and By putting it out there you can begin to get external help and begin to know what you can do better and Start really improving security. So yeah, I would like to thank you and Thank you


So I have a question for you. Can you respect human rights and culture at the same time? What do you think about that? Well, in this lesson, we're going to be discussing this debate because it's one that is quite important in the human rights conversation. But first, I think we should start by taking a look at what culture is. And I'm going to write it on this little diagram here in opposition to our genes. Our genes being the genetic material that make us physically who we are. So they compose a big important part of our biology. So if you were to put your genes in opposition to culture, I think you get a pretty good idea of what culture is. If you look, your genes determine things like your natural skin color, for example, like that. Something like that, so your natural skin color, maybe your eye color. It might affect things too, like the shape of your body or your health. Things like that, though not completely just your health. There are some very complicated stuff going on there. But in a sense, your genes are not completely fixed. Science is coming up with new stuff about this all the time. But they are generally considered to be quite fixed. It's something that's quite unchangeable and it has to do with the individual in many ways. Culture, however, is just about everything else. So you can think about things like language. You might want to think about things like the clothes that you wear. Maybe something like this word that a lot of people use these days, your world view. So the way that you see the world, the way you understand the world. Things like your habits can be culture, although some people have very individual habits like me having a messy room. You have things like art, maybe your ethics and values, maybe your religion. These things are all things that belong to our culture. Not just as individuals but as groups as well. You also have things like relationships. And where we see culture come out the most, where we see it especially in groups, is in the way that we experience life events. We all at certain moments in our lives are born, we all die, many of us marry, we all go through puberty. And in these moments culture is particularly strong. It has a lot to say about how we experience those things. And in that sense culture, especially at these moments of life events and in all these other areas, give us our sense of identity. So it's very personal. Culture is something that we're very connected to. But one thing is if you look at culture from very far away, if you're a step back from your own life and look at maybe a foreign culture or a culture on another planet, maybe we go far away from the earth and look down at some other group, we can actually see that usually culture is not fixed. So culture is often a blend. So you'll see other cultures mixing and touching each other and changing each other, affecting each other. And you'll also see culture changing over time. And right now in the moment that we live in, culture is changing very quickly in some places, which many people are saying it's not a good thing, other people say it's a great thing. And it's all stuff that comes up in this conversation about human rights and culture. As a quick definition, so to sum up all of these definitions that we came up with over here, all of these examples really, I'm going to quote an anthropologist named Edward B. Tyler who said, culture is that complex whole which includes knowledge, belief, art, morals, law, custom, and any capability and habits acquired by man as a member of society. And there even in the last few words you can see a cultural habit of his which was referring to men and not people, which is something that today people do much more than they did before. So you want to remember that culture in many ways and like he just mentioned actually also has a lot to do with law, which is something that we've been talking about in this course a lot, and actually makes a really good transition into the next idea that involves human rights and culture. And this important idea is actually more about a debate. In that debate people are asking are human rights universal or are they relative? What do we mean by that? Well, there is a group of people out there who say that human rights apply to everyone everywhere. Everyone and everywhere. So we talk about this with things like the Universal Declaration of Human Rights. There's another group of people and they're also spread out and I would maybe say a smaller group of people who say that these things are relative. That human rights happen in bubbles if you want to think of it that way. That for example the people who are saying for example that human rights are universal live in maybe a big bubble and they have a certain set of human rights but that there are other cultures and other ways of seeing the world that allow for those people to have a different definition of human rights and that they should be allowed their own definition of what a human right is. In reality however most people I would say fall on the line somewhere between these two views. Many of them over here further to the left, closer to the universal view. This is definitely for example where you'll find a lot of the human rights community, people who work in campaigns and advocacy for human rights. And on the other side a lot of times you will find things like governments of different countries who are trying to express their will or trying to express their identity in relation to some sort of maybe something where the human rights community is saying you're doing this wrong and this government or this country or this society says no or not because human rights are relative so we'll pull up an example of that in a second but generally topics that we're talking about these are usually talked about as topics not as a bigger broader discussion in the way that we're talking about it. A lot of times people talk about slavery, they talk about genital cutting so this is a practice that's also quite common in some parts of the world and they talk about things like child labor. Another discussion like maybe a good example of what we're talking about might be something like women driving cars in certain maybe Muslim countries for example. We can pull that as an example. So women and driving. If you were to look from an international perspective the right to mobility or the right to get around and go places that you need to go is seen as something that's valuable. And in certain and in a very small handful of Muslim countries women are not allowed to drive. This is not like a really hot debate so that's kind of why I'm pulling it as an example. And if you were to go to those places and talk to people in those places particularly members of the government or sort of the ruling structures might say well that's just our culture, we live in this bubble, women aren't allowed to drive in this bubble they can drive in other bubbles but not in our bubble. And members of the outside community might say well no but human rights are universal so there is just one big massive bubble and these little bubbles don't count. We all have one big bubble and all these human rights like the right to mobility for women to drive they apply there as well. So these are the kinds of discussions that are being had. A lot of times this comes along with a really great deal of tension between this sort of especially in the cases of governments and of societies and bigger global organizations because the history behind this is actually kind of a hard one. If you think about it you might have a country here, maybe a country that falls into this category who is further closer to this relative side who has been colonized and maybe an organization from a former colonizer so maybe people who used to boss these people in this country around are coming in and again saying well you're doing it wrong you should do it this way. And both sides have an argument. These guys over here on the left might be right in some ways and these guys on the right might be right as well. And this is the moment in which we then have to ask ourselves some hard questions and think about what are we really talking about? Are we talking about rights? Are we talking about history? Are we talking about certain conflicts that we've had in the past? What is the discussion really about? That's something that you should be thinking about as you go along. So when we're having this discussion we want to remember that no culture is perfect. That when we're having these discussions people have agendas, people have ideas on both sides and then we want to remember that we're talking about the topic at hand that we're talking about slavery or we're talking about genital cutting that we're talking about child labor or maybe we're talking about the right to drive a car. In any of these cases we want to try to take a look at the history, understand it but also understand it in context and think about our space in time where we're at and where we want our global community and our local community to go in the long run. So this is all very important. I'm going to let you walk away with that thought in mind maybe thinking about whether you've seen any examples of this debate in your own community. Alright, so that was your lesson. We're going to move on to some very similar stuff in our next lesson.


There's a poignant scene in Ron Cherno's biography of George Washington that really captures the genius of Washington's leadership. It was 1783. America had won its independence, but Washington wanted to keep the Army ready in case the British decided to re-engage. However, the officers were feeling mistreated by Congress, and a mutiny was on the rise. So he called a meeting to disarm the hostility. He pulled out his prepared remarks and tried to read them, but he couldn't see. So he pulled out a pair of glasses and made this passing comment. Gentlemen, pardon me. I've grown gray in your service, and now find myself growing blind. And just like that, the crisis averted. In that moment, the officers broke down and cried because they remembered their leader has suffered with them. When they had been tired and cold and hungry, he was with them. When they had suffered loss, he had suffered with them. That was the genius of Washington's leadership. So leaders, make sure your people know you're with them. Tigers lead.


fyddwch i gweithio llwyddaeth a chawdd, ac i fynd i'r ffairgth Saturday, oedd y nidio uneddaeth ymddell, yn cyfan. That ends General Questions time. We now move to First Minister's question. Question 1. Johann Lamont. Thank you very much Presiding Officer. Now we're getting into the afternoon. Can I ask the First Minister what engagements he's planned for the rest of the day? Can I take the opportunity, since this is the First Minister's question since, to thank the people of Glasgow, every member of Team Scotland, all of their support staff, our wonderful Clyde Siders for all of their efforts in making the Commonwealth Games a magnificent show for the people of Scotland, and measures to take forward the Government's programme for Scotland? Of course, as someone who has lived and breathed the Commonwealth Games for the last 10 years, both as a family member and a citizen of Glasgow, I would join with the First Minister in endorsing everything that he has said about what a wonderful, a wonderful spectacle Glasgow and Scotland put on for the rest of the Commonwealth and the world. In the increasingly unlikely event that Scotland votes yes, and in the likely event that the First Minister is unable to agree a currency union with the rest of the United Kingdom, could the First Minister tell the people of Scotland what is plan B? The First Minister will find the answer on page 110, and page 111 of the white paper will be taken forward to the people of Scotland. I say to Johann Lamont that the reason we are keeping the pound in a currency union and the reason we are so unambiguous about it is because we are appealing to the greatest authority of all, that is the sovereign will of the people of Scotland. After a yes vote in the referendum, I am sure that Johann Lamont will be among those who accept that sovereign will of the people of Scotland. It is Scotland's pound, it does not belong to George Osborne, it does not belong to Ed Balls, it is Scotland's pound and we are keeping it. I do not know what Nicola Sturgeon made of that answer, but I dare say that I shall read what she thought from her unnamed source in tomorrow's papers. Let me try again. Maybe I shall have more success than Alistair Darling in this regard. The First Minister has said on many occasions that he has a plan B, C, D, E and F if there is not a currency union. It is clear then that he has at least entertained the possibility that the currency union might not happen, so he claims to have a range of other options. Please share with us what is plan B. The options are on page 110 of the white paper. Those are for the euro that we do not support, a fixed or flexible exchange rate policy—perfectly viable but not as good as keeping sterling—and it also points out that we cannot be stopped from keeping the pound because it is an internationally tradable currency. Now that I have had to inform Johann Lamont of the page 110 of the white paper, will she not accept that the reason that the white paper puts forward the view of keeping sterling in a formal currency union is best for Scotland, is best for the rest of the United Kingdom, is our pound and we are keeping it? Johann Lamont might convince your back benches that it will not convince anybody who lives in the real world. Of course, the First Minister talks about his sovereign mandate. He talks about Scotland's sovereign mandate, but the Prime Minister of the rest of the United Kingdom will have a sovereign mandate to say no. It is not. It is not. It is not. Order, let us hear Ms Lamont. It is not for the First Minister. No matter how limitless he thinks his powers are to determine what is in the national interest of another country, that is not within his gift to decide. The First Minister has been told by all the relevant UK politicians and the civil servant running the treasury that there will not be a currency union. The First Minister has said that he has a range of other options. I do hope that the currency is not like the EU legal advice that he said he had when in fact he didn't. Let us take the First Minister at his word when he said that he had a plan B. Can he please just share with us and tell us what it is? First Minister, I just listed the four options of the white paper. I was interested John Lamont citing the Prime Minister of the nation saying, no, but isn't that exactly what Gordon Brown the previous Prime Minister warned about in the daily record of 2 June? He said, if the only propaganda that comes from the Conservatives is Britain says no, it is bound to have a reaction in Scotland. It is bound to make people feel they are talking down to us or are not taking seriously or are trying to bully us. So perhaps John Lamont should take the advice of the previous Prime Minister as opposed taking this better together, no alliance and citing David Cameron, the Tory Prime Minister. I think that there are three reasons why what the Prime Minister and George Osborne and Ed Balls say now and what they say the day after a yes vote in the referendum are two entirely different things. Firstly, there is the sovereign will of the Scottish people and many people will respect that sovereign will of the Scottish people. Secondly, this plan is in the best interests of Scotland, but it is also in the best interests of the rest of the United Kingdom. Businesses in the rest of the United Kingdom will not want to pay £600 million in transaction costs. Thirdly, Osborne Balls and the Prime Minister are not saying that they can stop us using the pound. They are saying now that they want to keep for themselves the asset of the Bank of England, nationalised in 1946, an asset and a bank that holds some 26 per cent of UK debt. But if you keep all of the assets of the United Kingdom, you end up with all of the liabilities of the United Kingdom, which amount after the work of George Osborne and Alistair Darling, amount to £1.3 trillion of debt. So we are expecting to believe that next year in the UK general election, George Osborne and Ed Balls are going to campaign round England and say that the people of Scotland want to take their share of that liability, but we want to keep the Bank of England. We want to give them a present of £5 billion a year. That is why the best interests of Scotland, the sovereign will of the Scottish people, will prevail. It is our pound and we are keeping it. I am not surprised that the First Minister is quoting from the daily record in June, rather than the daily record this morning. Three times today, and for many many times in the last two years, I have asked the First Minister about his plans for the currency. It is a serious matter for the people of Scotland. Each time, I get a response but never an answer to the question that people are asking. It is clear that the First Minister has a strategy to get Scotland to leave the United Kingdom, but what is becoming increasingly clear is that he does not have a plan for Scotland. For those of us who remember what the First Minister used to say, once the pound was a millstone round Scotland's neck, then the euro was Scotland's choice. His former deputy, Jim Sillers, says that we should have a separate Scottish currency and that the First Minister's plan is stupidity on stilts. The First Minister says that he is a range of options and a plan B, C, D, E and F. Do not the people of Scotland deserve to know which one it will be? If he does not tell us, which one will it be? If he does not tell us, is it not clear that, although he may have a plan to break up the United Kingdom, he does not have a plan for Scotland or the future of families across this country? I did point out that the options were contained in page 110 of the white paper. I pointed out that it was the euro. I answered this question two questions ago. I pointed out that it was the euro, which we do not support. I pointed out the fixed or flexible exchange rate, which are perfectly viable but not as good as keeping sterling in a formal currency union. I pointed out that you cannot be stopped from using our own currency. That is not even the position of the Conservative Party. You cannot be stopped from using sterling. All of these things—not just that I have done twice today—are in page 110 of the white paper. We are putting forward the position that we are appealing to the people of Scotland and their sovereign will in a referendum, which is why we are unambiguous. We think that the best position for Scotland, the best position for the rest of the United Kingdom, is to have a formal currency union. Therefore, it is our pound and we are keeping it in the interests of the Scottish people. I add the heartfelt thanks of myself and my party to those of the First Minister, to everyone who helped put on such fantastic Commonwealth Games in Glasgow. I add also to those mentioned all of the police and the armed forces that help to keep Scots and visitors safe throughout the duration of the Games. Can I ask the First Minister when he will like to meet the Prime Minister? The First Minister is trying to lead the Scottish public up the garden path here. He is trying to pretend to people that he can deliver a currency union with the rest of the UK if there were to be independence, and he knows that he can't. The First Minister often likes to pretend that he speaks for all of Scotland, but he is now claiming to speak for all of England, all of Wales and all of Northern Ireland, too. Can we all just take a step back and can he admit to the people of Scotland in this chamber right now that if there were to be a yes vote, a currency union is not in his gift to give? First Minister. I have just set out the reasons why I think what is said the day after a yes vote in the referendum is different from what has been said now. I accept that, apparently, George Osborne and the Prime Minister have drawn a line in the sand on this matter, but, as Ruth Davidson well knows, lines in the sand have a habit of being washed away. Therefore, I welcomed Ruth Davidson's revelation in the 15th of June this year, in the Sunday Post, that she will back a currency union in the event of a yes vote if that is what is best for Scotland. I can only assume that Ruth Davidson is responding, as Johann Lamont did not seem to, that she would accept the sovereign will of the Scottish people. Mind you, there is less enthusiasm than there is from the deputy leader Jackson Carlaw sitting alongside her. On 21 February, he said after a yes vote, he would man the barricades for the pound after independence. Can I say to Ruth Davidson and to Jackson Carlaw, I will be there on the barricades with the Conservative party? Ruth Davidson, a slightly kamikaze approach to be quoting newspapers today, First Minister.  In June, I think that we have got to look at what is best for Scotland. I think that monetary union we have is the best option for Scotland, which is why I am fighting to keep it as part of the United Kingdom. That was the actual quote that I gave. The First Minister's answer is to settle down, Ms Davidson. So far, we have had a nonsense on skills argument that a sovereign will will make this happen. If the First Minister's preferred option was a link with the dollar, a yes vote from Scotland does not mean that Barack Obama has to submit to the sovereign will to have a currency union there. His other argument has been that it is in the rest of the UK's interest to have a currency union. Let's look at this, because the vast majority of the people in England and Wales said in June that it is not in their interests. The First Minister of Wales has said that it is not in their interests. The permanent secretary of the treasury has said that it is not in England, Wales or Northern Ireland's interests. The chancellor, the shadow chancellor, the chief secretary to the treasury has said that it is not in their interests. The markets have said that it is not in their interests. But I didn't ask the First Minister to tell me anything about sovereign will or what's in the best interests of the rest of the UK. I asked him whether a currency union was in his gift. It's not, and all the wishing in the world doesn't make it so. So if he can't deliver, we are back where we started, needing a preferred plan B, not a range of options, a preferred plan B. He must have one, so what is it? I've listed the currency options twice to John Lamont for page 110 of the white paper. I can certainly do it again, but I've done it twice as the record will show. I'm talking about records. I think Ruth Davidson might come to regret only reading out that quote and not going a couple of lines down, because she was then asked what would happen if Scotland voted yes for independence, and she said that she would back a currency union if that is what was best for Scotland, a Sunday post 15th of June. Ruth Davidson is there, and the full quotation is there, as she very well knows what happened when she was then asked what would happen in the event of a yes vote. I anticipated that that was because she acknowledged the importance of the sovereign will of the Scottish people. I've also said that it's not as enthusiastic as manning the barricades with her deputy leader sitting alongside her, but nonetheless it's quite important. Ruth Davidson tries to give the impression that this argument, that it's best for the rest of the UK, is something that is held by myself alone, despite the very substantial arguments. I noticed a letter in the Financial Times from Jim Spout, who is the head of intelligent finance, Professor David Simpson, a highly distinguished Scottish economist, Angus Tullard, Michelle Thompson, Professor Sorddonald Mackay, 25 years adviser to the Secretary of State for Scotland, Sir George Matheson and James Scott, former chief executive of Scottish financial exercise. He said that there's a positive outlook for the financial sector because the likelihood of a currency union is strong. It is not only in the best interests of Scotland and the rest of the UK but of our financial sector industry. I said earlier on that the issue was not whether Scotland could keep the pound. I assume that Ruth Davidson accepts, as I was telling him the other night, that it cannot be prevented from keeping the pound. We cannot be prevented from keeping an internationally tradable currency. I would like to say also that, in terms of the debt, there's no doubt now that the Treasury has accepted full liability for the debt but, presumably in reasonableness, the Conservative Party, the Unionist Coalition will accept if the Conservatives, if the Westminster Government tries to keep all of the assets of the United Kingdom, like the Bank of England, then they end up lumbered with the debt. The point that I was making seems to me incredible that Ed Balls and George Osburn will go round campaigning in a UK general election telling the people of England that they were offered up to £5 billion of debt interest payments as a reasonable proposition put forward by the people of Scotland, but they don't want it because they want to have exclusive control of the Bank of England. That is why what they say now and what they say the day after a yes vote are two entirely different things. That is why it's our pound and we are keeping it. The First Minister will be well aware that Sturco will be closing their call centre in Brorach and will make all 21 local workers redundant. This is a devastating blow to the small rural community with a population only 1,200. Will the First Minister agree to meet me and send a beacon of hope to all the affected families in the north? I will certainly arrange for that meeting. I saw the announcement. I know that Mr Swinney and his officials have been engaged already on those matters, but I will certainly meet David Stewart and his constituents. I agree with him that 21 jobs can be sound like a relatively small number. In a small rural community, proportionately, it is a huge number. I think that those matters have to be a real concern for companies when making such announcements. Therefore, we want to be sure that the views of David Stewart's constituents are fully taken into account as we discuss with Sturco how we can move forward on this issue. To ask the First Minister what issues will be discussed at the next meeting of the cabinet. Issues of importance to the people of Scotland. Will the First Minister accept that he has not been fair to people in Scotland? He says that he has an alternative currency plan, but yet the First Minister cannot even bring himself to describe the consequences. After a lifetime of campaigning for independence, when the big moment of truth came on Tuesday, he could not explain his currency plan in front of a million people. Surely he should have another go at an answer now. People in Scotland do not get another go in September, so please can he describe the consequences to Scotland of his alternative plan? I have laid out page 110 of the white paper that you could have the Euro that we do not support, although previously the Liberal Democrats and myself supported it. You can have a fixed and flexible exchange rate, perfectly viable but not as good as the option that is being put forward as plan A in the white paper. We cannot be prevented from using sterling, using the pound that is our currency and we cannot be prevented from keeping it. I have also pointed out that the reason why the white paper puts it forward in these terms is that we are looking for the sovereign will of the Scottish people to back the plan to keep sterling in that currency union. I know that, as a liberal democrat, Willie Rennie will be first if not to demand the barricades to accept that the sovereign will of the Scottish people should prevail. That is why it is in the white paper, that is why we are backing it and that is why it is our pound and we are keeping it. He knows those page numbers off by heart but he cannot give the answer to the question. The First Minister often refers to the fiscal commission, but I suspect that most people do not have a copy of the fiscal commission handy at home. Their names are not on the leaflets that are sent to every house. People do not know what they are recommending. They do not knock on the doors. The First Minister does. They are supposed to be his ideas. What are they and why can he bring himself to give us a description of the consequences of his alternative? Why can he give an answer? The First Minister? I am glad that Willie Rennie mentioned the fiscal commission, of course, to Nobel laureates, to highly distinguished economists, but I was not quoting from the fiscal commission, I was quoting from the white paper presented to the people of Scotland in page 110. If I remember right, Willie Rennie was complaining about the amount we were spending promoting the white paper and giving the information to the people of Scotland. How can he complain about it in the one hand and say that this information is not now available? On the consequences of other currency options, Professor David Bell, when he gave evidence to this Parliament's committee, pointed out that it is the UK debt, not the Scottish debt, and the UK has agreed that it will pay back the debt. That is the first thing to say. It might be extremely attractive for Scotland to be in a position where the UK sees the financial assets but is not prepared to accept that it means that it has the liabilities. It would be extremely attractive for Scotland to be debt-free and would be in balance of payments and budget surplus, but it is not a reasonable position to put forward. That is why in the white paper in the articulation that we are offering to pay our fair share of the massive liabilities built up by the likes of George Osborne is dependent, of course, and properly, on having a fair share of the assets as well. That is an entirely reasonable, responsible proposition. It is the proposition that is in the white paper. That is why, as part of a formal currency union, it is our pound and we intend to keep it. Aileen McLeod, to ask the First Minister what impact privatisation of the NHS in England will have on the budget that is available to the Scottish Government. Well, extremely serious. As people in this chamber will know, our budget for public services in Scotland is currently allocated as a relative proportion of the spending in England that is determined by the Barnett formula. The impact on the austerity and privatisation agenda being forced on the NHS in England will consequently see our budget eroded. For every £10 lost to the NHS in England, Scotland will lose approximately £1 in funding for public services. It is a serious question, a serious issue. Therefore, the idea that we can be immune from the privatisation agenda being pursued by the national health service by the Government in England is not reasonable in terms of how Scotland is financed. The way to defend the national health service is to have control of Scotland's finances and therefore not vulnerable to the privatisation and fragmentation carried forward in England. Does the First Minister therefore agree with me that the only way that we can protect Scotland's NHS from Westminster's on-going austerity cuts and privatisation agenda and ensure that it remains true to its founding principle of healthcare free at the point of need and remains firmly in public hands is by voting yes on 18 September. In terms of expressions of that, I think that Dr Philippa Whitford, somebody, as far as I know, has never been involved in politics before, but one of Scotland's prominent breast surgeons who has spoken out so articulately on this issue, exactly because she can see the danger to the national health service in Scotland, which is the consequence of privatisation south of the border. We are fortunate at Scotland that we have policy control of health. That has allowed us to protect our health service from the deeply damaging so-called reforms that Westminster Governments have made to the NHS in England, not just over the last two or three years, over the last 15 years. While devolution, we can set a different policy. Without independence, our budget will be beholden to the whims of a privatisation agenda. That is why, to protect Scotland's national public health service, we need independence and control of Scotland. Given that the Scottish Government has received £1.3 billion by its own admission in consequentials from Westminster, specifically for health in this Parliament alone, can the First Minister confirm when, during the summer recess, the Scottish Government's referendum advice became so desperate that ministers felt that their only recourse was to indulge in malicious, unsubstantiated, shameful and shabby spear-mongering about the future of Scotland's wholly devolved NHS as a public service, to which every party in this Parliament is profoundly committed? We seem to have touched the raw nerve of the no campaign, and certainly we are going to take no lectures on scaremongering from a no campaign that is entirely best and scaremongering for the Scottish people. The position is clear, and Jackson Carlaw of all people, since he previously believed in fiscal autonomy for Scotland, understands it and understands it full well. He knows that every penny piece of consequentials for the health service has been passed on to the health service in Scotland. He also knows that the entire purpose of a privatisation agenda is to reduce expenditure, public expenditure, on the health service. Therefore, it follows. If expenditure is reduced in England and we are still part of the Barnett formula, then there will be less money available for public services in Scotland. That is why the threat to Scotland's public health service is real unless we control Scotland's finances in the way that he once believed in, and we believe in, and the people of Scotland will back on 18 September. To ask the First Minister what the Scottish Government's response is to First ScotRail being fined more than £2 million since 2011 for running too few coaches in a practice known as short-forming. It is a serious question, but we should remember that 99.7% of trains ran with the planned capacity this year, and 0.3% of the journeys did not meet capacity. In any of those terms, that is a strong performance. It is also a performance that is significantly better than when the previous administration was in charge. In 2007, for example, the penalties that Mark Griffin spoke about for not meeting capacity totaled more than £830,000. The figure now stands at £574,000, which is a drop of 31 per cent on the Labour record. I and everyone in the chamber would like to see that at 100 per cent, not at 99.7 per cent. In fairness, Mark Griffin should deflect that the record this year, which he is rightly concerned, is significantly better than when his party was in office. Does the First Minister agree that a publicly-owned rail operator within the interests of customers and services before profit would be best placed to address issues such as short-forming? Will he support proposals that were outlined originally in Scottish Labour's devolution commission, now adopted by the United Kingdom Labour Party, to allow publicly-owned companies to bid for the ScotRail franchise? Does he agree that it is a good example of a progressive Scotland working within the United Kingdom, leading to more progressive policies across Britain? The First Minister is a pity that he did not think of changing the law when he was in government in this chamber, but he will have noted that I have spoken out publicly that I think that the publicly-provided west coast service should be able to bid publicly for that line. It also should be noted that the rail network has a 90 per cent satisfaction rating among passengers that compares to 82 per cent for the rest of the UK. There is still a lot more to be done both in terms of what Mark Griffin has examined but also the investment in the rail network, including £430 million in new rolling stock to fund the 38 new-class free 80 trains. I know and understand Mark Griffin's concerns, but he will agree that there is a substantial reasonable level of satisfaction in the progress that is being made, albeit that there is still more progress to be made. Mr First Minister, what the Scottish Government's position is on the Credit Suisse Research Institute report on the success of small states? The report by Credit Suisse Research highlights the very strong performance of small independent countries across a whole range of social and economic measures. The importance of the UN human development index is that it does not just look at economic performance alone, it looks across the range of social and economic criteria to evaluate and say how states should be judged. However, the report adds to a great chorus of voices who agree that Scotland can be a successful independent nation. For example, Credit Suisse estimates in that report that Scotland would be ranked ahead of the UK on the UN development index. Thank you, First Minister, for that answer. Is it clear that two key findings in the report are that economies of scale for larger countries does not necessarily benefit their population and that it is less costly to fund public services in a small country rather than a large one? Does the First Minister agree that this report directly contradicts the scale mongering of the likes of Alistair Darling, who could not even bring himself to admit that Scotland could be a prosperous and successful independent nation? Of course that the report adds a great deal of strength to the view that there is a substantial body of evidence that small countries in Europe and beyond are extremely successful economically. I think that we are reaching a consensus in these matters. Are we not? We are reaching a consensus that Scotland can be a successful independent country. There is nobody in this chamber who surely is going to disagree with that point. If anybody is disagreeing with that point, they should speak up now that Scotland can be a successful independent country. What I take that is unanimity in this chamber. So let the message go out to the people of Scotland that now, if established, we can be the question to be answered on September 18, should we be? I think that it will be a yes answer. The next item of business is a member's debate. Members should leave the chamber, should do so quickly and quietly and I'll give a few moments to make sure that happens.