Hi everybody it's Sam at Mixed Upcraft thank you for watching my tutorial today I've got a really fun huge tall gift bag which I'm calling my piñata gift bag because I've done all of this you can hear it this lovely kind of tassel trim which reminded me of a piñata you can see it all on the side there now the whole box folds flat whole box whole bag like so but again that's optional and I'll talk you through that I just recycled from some handles from a fancy bag that I had and then I've got this lovely big gift tag here all the papers and everything that I'm using are from the fiesta fever paper pack which I'll show you in a moment but it's really big so this is using A4 so it's this piece on the front is the whole piece of A4 it's not been scored or nothing that's the front piece so this is very very similar in terms of structure to the big 12 by 12 one that I've done but I was looking back through my gift bags and realized I hadn't done one that uses the full size of A4 and you can also use letter size so you can use this if you've got 11 by 8 and a half or the A4 okay so I'll talk you through that and then the back I've just kept plain again if you want to you can obviously do all that but I've also finished off my holes there with little eyelets just to give it a bit more of a luxury feel and it is it's gorgeous I absolutely love this so I'm going to fold it back down flat because it can still store I mean they're not going to go completely flat even if they're up against something they will still just want to pop up so yeah so let's crack on so that's the paper pack which I've down to a few pieces now so I did use a lot of scrap for this one which was another reason why I wanted to do it okay so you are going to need I've got all these bits here which is the tassels so again that's completely optional you might just want to make this as a very large gift bag so that's fine I've got some again recycled handles there you can obviously use your ribbon that one's the tassel that I'm going to show in a minute and there are all the other bits and pieces so the main bag it's really really straightforward there as well so you need two pieces of A4 or letter size paper it's entirely up to you this is A4 so it's eight and a quarter by eleven and a half okay so I've got two pieces if you've got the letter paper that will be 11 by eight and a half and that's fine to use as well so you need two pieces of whatever size you want there then you'll need two pieces of five by whatever length card it is you're using so either 11 or 11 and a half or even 12 but the width needs to be five okay so five by whatever length you want there and then one piece of five by this is eight and a quarter I'm sorry this is five by nine and a quarter because this is to go if if you're using let me just work this one out because I want to make sure that everybody can do it so this is the size you need for the A4 paper which is the width of eight and a quarter if you're using a letter paper which is eight and a half then this piece will need to be nine and a half long okay so it just needs to be the width of whatever it is you're using so hopefully once you watch me put this together then you'll get what I'm saying but this is for A4 size so five by eight and nine and a quarter for letter paper size it's still going to be five but this will be nine and a half just add an inch because you're having a half inch tab on each side okay so back to our two big pieces here if you want it to fold flat one of the pieces will be your back and along the bottom here you want to score it too okay that's all you need to do if you want it to fold flat then on your two side pieces here you need to score it half an inch and at four and a half okay then if you want it to fold flat rotate it and score at two okay and then rotate it back again and score it two and a half all the way down I just come up there all the way down to that first score line just that one that you done before that's only if you want it to fold flat okay these measurements here are all the same even if you're using the other sizes okay and even if you've got that longer at nine and a half this will still be the same okay because we're keeping the width as long as your width is five on everything so five five five then you're fine and then this is the base so that's that five by nine and a quarter or nine and a half along the five inch side you want to score it half an inch and four and a half sorry bring that down so you want to score it half and at four and a half then along the long side so you're going to score it half again and basically just rotate it and just score it half it's easier then so no matter what size you've got just score it half an inch on all four sides should have said that at the beginning trying to do it so that you can use any size card that you want and try not to confuse you too much along the way okay so that's done now with the scoreboard so these side pieces here where we've scored down to this line here so this score line down here we're now going to score from there down to this corner and then there down to that corner not to the corner of the card just the corner of the score lines on each side and this is what you do with all of your fold flat gift bags so the little I'll put a little um playlist up now of all my fold flat ones and you're seeing all of those tutorials this is exactly what I do so I'm just scoring there with my metal ruler along the bottom okay so construction for this is very very easy especially if you don't even want it to fold flat because all you've got is these two score lines here you're not doing anything else all you need to do with these bigger pieces is just take a little wedge just tiny just stuff of all of your sides your kind of you know the little tabs just so you don't get any of it overhanging not a lot because you still want it to obviously stick to the bag the other side of me but just a little bit there you can see I'm taking hardly anything off okay like so and then just burnish those score lines you should then be able to see these better once I've burnished all of this on the bottom one and then you can just kind of pinch that one in and then if you bring it up kind of push one of the triangle score lines there you can see there just bring it up just to kind of define all those score lines okay so just repeat that again on the second piece okay so you'll have two side pieces like this then with your base here all you want to do is cut those squares out in each corner like so so just go around and just remove those squares okay and then we're going to tidy them up as well so just take again little wedges off of each corner again just to stop any bits of cards sticking out from over the edge and then just burnish all those score lines you can burnish before or after it doesn't actually make any difference like so okay so that's our base so you can kind of see now what's happening is all of these pieces here all going to stick to the bottom very easy but before we do that I want to decorate my front piece so if you are having this as a fold flat and you've got the one with the two inch score line there that's your back so the plain piece here is what I'm now going to stick all of these on and this is what is the fun part for me this is what makes the gift bag so what I've done is cut strips that are the width of whatever I'm using so this is the A4 so it's eight and a quarter obviously if you've got the letter paper then you would have yours at eight and a half and then they're two inches thick okay and then I've got my trusty vegetable scissors here but these are great and if they ever get blunt just cut them through some foil you know aluminium foil kitchen foil just to kind of sharpen them up again but all you want to do is just go along and just cut up leaving about a quarter of an inch from the top it's really really quick and this is what I use and this is the same technique to make tassels so these could easily now be turned into tassels if you wanted but not today and then just at the end there so you've just got this trim and then just with my bone folder depending on what pattern you want I might want to have that one but whatever pattern you want showing you want that facing down so I want the plain green so I'd face that down and then just curl all of the edges there like so and now we've got this fun trim so I've done 17 of those but again you may have more you may use less it's entirely up to you now I've already gone ahead and I've put strips of red tape along the top there so you can see and now what I'm going to do is lay them out in their piles so I can kind of pick up from each one as I go so that's more pink I've got some more of some others because like I said I did raid my scrap drawer like so okay so on this one here I started with the green and I started quite high up because obviously it's two inches down so I you come up yeah about two inches all right because it does curl up at the bottom but you want to stick your first one so let's go for what have I got more of let's go for this pink one and find it here and you start from the bottom up so obviously you're layering over the top of each one so I'm just going to peel off my backing okay and then just roughly I can kind of straight and one out to see where I need to be put that one down and again just make sure that one sits nicely and then stick it down already there's our first one looks so good now when I stick the next one down I stick it let me just take the backing off of here stick it about a quarter of an inch half an inch up above it let me just check that is what I've done yeah so I just bring it up here so I'm just going to stick this one about half an inch up like so okay just like that I'm trying not to get my fingers stuck and then again you just want to the main thing for this is making sure that you keep it straight if you find yourself starting to go off at an angle and you can you know rectify it so each time you stick one down just hold it up so I can see already I've gone slightly down on that side but it doesn't matter at this point but as long as you're aware then you can obviously change it so now I'm going to do this blue one and I'm just going to work my way all the way up and I will come back when I'm nearly finished okay so that's now all done I just love brushing it you can see on the side there how it looks looks so good so now I've got the top now you could leave that nice neat strip there but I have already cut these so these pieces here are half an inch by whatever the width is that you're using so in my in in my case it's eight and a quarter yours would be eight and a half or 12 or whatever it is like I said you're using so all these measurements will be in my blog as well so if I have sounded confusing at all just to revert to that because you'll be able to see everything so I'm just going to add this over the top is very very sticky excuse me if my head is in the way but I want to make sure they get kind of lined it all up then the other one is to go on the back here so where your two inch school line is keep that at the bottom and then just run this along the top okay so that is my front and my back so now we can start putting it all together so with your base where you've burnished and done all of your school lines there it's entirely up to you whether you want to use red tape or wet glue I'm going to use red tape and I'm just going to run it along here it doesn't matter that it doesn't cover the whole half inch tab there this is the red tape which is very strong anyway but I'm just concentrating on keeping it as close to the school line and not the outer edge okay so if you have got a tape and you know it's a strong one but it's not thick enough don't worry because what I can do is run just a little bit of my wet glue along this other piece here okay so that's the base ready then get these pieces already as well so these are the two side ones with your tabs so again I'm going to run my tape all the way along again concentrating on keeping it closer to the school line than the outer side okay and again whenever you're using red tape just go along with your bone folder or a ruler and just squeeze out any air bubbles and you'll see because there'll be white little dots and when you go over them it will go nice and red and that's what you want you know then that you've got all of that tape stuck down okay so now we're ready to put it all together so flip your base over and turn in your sides and then what we do first of all is we stick down these so turn them over and basically you're going to stick this lining up your score lines and stick it down to that fold it over you just want to get a nice clean join like so and then do the other side this is when it's going to get too big for my camera now so I'm going to end up again facing down fold that one under line up your score lines and fold it like so again there's the sides and now these bits are going to all come in along with the base sides and those sides and we're going to stick the front and the back on so we do the back first okay so fold this one in take off that and it's up to you how you want to do it but this should just be the whole width of that tab so you just want to make sure that you get it perfect like so okay and then you can take this side one off here it's up to you which one you want to do first fold it right in bring it up and then basically starting from the bottom you just want to keep it completely flush your two inch score line should meet up perfectly with the score lines on this here you can see there's my two inch one and it matches with that one there and just very carefully slowly make sure it's nice and tall and it meets the top and you can just go in like that and then with my bone folder I'm just going to go in and just really push down on that red tape again getting all the air bubbles out and make sure it's all stuck down if you've got wet glue then obviously you've got the wiggle room once you use this tape you know once it's stuck there's kind of no way out so yeah wet glue might be good if you haven't done this style before and then again take this next one off it's so much static it's all sticking to me and again fold it under and just I'm holding it up with my hand so it's not actually touching I can really kind of control what bit I want to stick down as I go so again just slowly pinch it as you join this two together there and then when I get near the top just line that up flip it over like so I've opted to go for a contrast with the white sides it but you don't obviously have to do that you can have it all the same okay so there's our back done now we need to do the front so if you take this bottom piece off and you can just tack the bottoms down of your sides there like so and then just kind of fold them in and grab this piece all right and first of all you can just lift up the corner of one of these you don't want to take them right off so just kind of fold see what I've done there just kind of fold it over and then you can just very carefully line that up with the corner and all the way along there and again I need to take that one off as well I'm just going to catch it with my scissors there we go and just kind of don't pull it right off just keep it hanging out so and then I'll go back to this side here and hold the top in place it's all lined up the bottom's already tacked down I can just then pull that red tape out and I know that that is all lined up perfectly I'm just going to turn it on its side even though it's got the tassels on I can still flatten it just to make sure that's all stuck down back to this side here hold the top in place make sure this is all nicely lined up and just pull that red tape again if you're using wet glue then obviously you can't do it this way but you'll have the wiggle room so it won't matter and again flip that over just go in and look at that really lovely this is so strong this box or bag sorry really really strong we've definitely hold like heavy like wine and beer and stuff like that now to check that it obviously folds flat push your finger into the top of the triangles there and at the same time along that score line at the back just kind of bring it all together it will go and just kind of help it along a little bit there and you can see open it back out again now I just need to add my holes so this is obviously the eight and a quarter inch length so I came in at two and a half inches from the outside and half an inch down so I punched just below this strip that I added so two and a half I'm just going to put a little pencil mark on the green there and again here two and a half and again flip it over okay and then I've just got my hole punch and I'm just going to line that up and then you can add the metal eyelets it's optional I'm going to leave them off for the minute feed them through then I've got this lovely big gift tag which I'm going to feed through there and then that one and then just pop the ones in the back and there you have it a really lovely huge A4 or letter paper size gift bag it's just it's lovely it's so so nice I love this and obviously I've got this piñata style so just show you the side there the back and the side again and you can see inside you've just got so much space they really are spacious and they fold nice and flat so that's that one there and here is my other one oh I love them they're so colourful they're so fun and I just keep touching them so there I hope you like it I love this one as always if you've enjoyed it please give me a thumbs up and subscribe to my channel so you get to see more thanks for watching bye


The recording is set. Excellent. Welcome everyone. Thank you so much for being here today. We are in the last part of week four for social equity. We are thrilled to have you and we are going to get started with the meeting. I'm going to call it to order. Before we go over that, again we've called the meeting to order. We're going to talk about public comments today and before we do that so we can go in order. May I get a motion from someone to approve a minutes from 9.27? Question? Do I have a second? I'll second. Thank you so much. So because we are September 30th, I'm going to flip back one slide just as a quick reminder that we have our first milestone tomorrow. To put forth a plan for reducing or eliminating fees for social equity applicants with our second coming up on the heels. I feel like a sports commentator today. Sorry about that. So we have October 1st and October 15th coming our way. So I am going to jump back over to the agenda. These are the topics we'll be going over today. The minutes have been approved so now if you're okay everybody, I'm going to move over to a summation of the public comments. There are five of them or either six of them today. So if you'll bear with me, I'm not going to read them all but I am going to hit some of the highlights since you all did receive them. So Kelly's story brought up the point that disability benefits may not provide enough funding to support the cost of medical cannabis products for those who need them. She also wanted to make note to the board and others here that people that live in government housing are not allowed to cultivate cannabis. So medical marijuana is not financially obtainable to many of those who may need it and can't manage their own crops. She noted this was a problem. She has thoughts and ideas. I'm sure hopefully we'll hear more from her on that but she also wanted to note that cannabis should not be financially unobtainable to anyone who relies on or benefits from it. Again, that's from Kelly's story. Ronald Williams from Mr. Seacraft Cannabis. I'm not going to go through it completely because this has already been addressed by the subcommittee members. He did not want the requirement of the one-year residency. We have touched on that but what is important to note in his comment is that he does want to ensure that not only is Vermont the Vermont cannabis market equitable but that it remains attractive for young diverse communities that are currently underrepresented in the state. So we thank Ronald for that. And then Joseph, and I'm sorry I can't read his last name, I think it's Burger. The important thing he wanted to note is what went on in Missouri with some applicants and that folks were paying people to help consult with them to fill out applications. He noted that the former president of the Missouri chapter of minorities for medical marijuana lost approximately $70,000 putting together her application, which I believe was possibly denied, yes, was denied. And he said knowing that folks would have to compete for a limited number of licenses, many applicants did pay top dollar to consultants for their experience in legal marijuana markets for help with applications. He said the high cost and license caps created in industry in Missouri accessible only to those with money and connections instead of more black owned marijuana businesses given the disproportionate impact of the war on drugs in communities of color. Also, Michael Shane noted the best thing the cannabis control board can do to help small cultivators is to provide a provisional license and allow small cultivators ahead start to grow over the winter when cooling costs are low and then fell to the integrated license holders in May. He also noted that forcing small cultivators to begin cultivation in May when costs are the highest will put them at a disadvantage. It will ensure supply shortage and encourage only the very rich and parenthetically he said or the illegal may be able to participate. Again, that's from Michael Shane. And then there was an additional comment from Michael Shane that he said people should understand how competitive the market really is and raise the point that all New England states will have legal cannabis soon. He also noted a few different links that people can access and I believe everyone on the subcommittee should have those that you can look this over. And he said a quote from one of the links is the general consensus among plant scientists and horticulturists as much as it takes many of us to admit it is that the highest quality fruits and flowers are achieved in a controlled indoor growing environment. Again, that's from Michael Shane and he did also add some resources. As a reminder to everyone in the public, if you would like to submit comments, you may submit them at ccb.vermont.gov and the public input form where your comments will be noted, logged and submitted to the subcommittee members. With that being said, and I know that wasn't mouthful, I am going to move on to the start of the topics. And Gina and Jeffrey, I'm going to turn this over to you to talk about the relationship to the impact of the individual and impact of family. Thank you, everyone. Hi, everyone. So we started with impact of family. I know we did vote on this, but there was a advisory board meeting with all of the people from the entire board, including all of the subcommittees. And we had C-bonds yesterday make a recommendation that we include domestic partner to this list. I'm not sure why the bottom of this is not showing up. So it should be relationships to the impact of individual partner, legal guardian, sibling, spouse, child, minor. I think it's just rearranged. Minor in their guardianship, grandparent and grandchild. The grandparent and grandchild is not on this list. So please note that that is what is included in all of this. Are we okay as a committee to include domestic partner to our definition of impacted family member? I was just going to say yes. I think that we should include domestic partner. Ashley, I agree that was a really good addition. And Leo? I don't know what domestic partner means in this context. Vermont used to have domestic partnership before same sex or marriage equality came to the state. So you had as a civil equivalent of marriage, but now that we have marriage equality in the state and in all 50 states, I'm not really sure what domestic partner means. Is there a definition, especially if we have applicants work from out of state and you know, state domestic laws. I mean, there are 50 different state laws about family law and marriage. They're not uniform. So is there an explanation of what counts as domestic partner and how you would establish them? So just from what I found using the links on the Vermont website, it says you would have a relationship agreement or a contract. So there would be, you would need to cohabitate together regarding property and finances. And that you would need to create this contract and it would need to be signed. It's sort of similar to a prenuptial agreement. And then there could be a power of attorney as well. Then you can make one debt just for healthcare, but that would not relate to us for the subcommittee. And well, so for the subcommittee terms, it would be if you had a contract or I guess power of attorney over someone. Hallelujah. Does that answer your question? Is that definition going to be disclosed in the application material? I know the applications are... So if you have a relationship agreement or contract or a power of attorney over someone, so we can put that in parentheses if you like when we disclose domestic partner and then parentheses. Relationship agreement or contract and or power of attorney. So you can have a power of attorney over anyone, like if you have a neighbor who's elderly and they have children who are out of state who want you to have power of attorney to assist them with medical decisions for a limited period of time before the children can fly into the state to participate in those decisions. So should we just have relationship agreement or contract? Jada, can I interrupt for a second? I'm just going to share with you the state of Vermont's HR policy on domestic partner. My familiarity with domestic partner is, you know, in adding someone to your insurance and I wonder if we can maybe copy some of that. Because typically it's similar to what you're saying, but I think we'd provide a little bit more to answer Julio's question. Can you read that out for us, please? It's a long policy. Hold on, let me see if I can go back to it. Julio, what would you like to say? Well, I'm not sure what we're agreeing about. Like I said, my familiarity with domestic partnership and this is something that our office was involved in. Our civil rights unit was involved in advocating for marriage equality in Vermont. So I only understood domestic partner in the context of what Vermont used to call civil unions. The statutes were amended to just sunset the civil union law because it was no longer necessary because the U.S. Supreme Court recognized marriage equality. So that's where I'm coming from in the state policy. I don't have it in front of me. But prior to the Supreme Court's decision and the Obergefell decision that recognized marriage equality states that wanted to recognize civil unions would use the phrase domestic partner. But I don't know that it has like an agreed upon meaning. So that's all I'm saying. I don't know what I would be agreeing to because some people, some applicants might have relationships that this committee or subcommittee wouldn't consider to be the equivalent. But what we would regard as a family member and some of us might, so that's all that you're just introducing in terms that I don't think has like a settled meaning. And so I'm trying to figure out what that meaning would be. So I did drop in the chat pod a couple of links for the state of Vermont. There is a state of Vermont offers coverage to domestic partners and employees in order to be eligible. You must certify the following criteria and it lists out six different things. It's the second link is from the human resources page that maybe that may assist anyone as well. Novor has his hand up Tina while. Yeah, I just copied and pasted the six different things that define what domestic partner is. So we can all read that and that puts in the Vermont human resources packet for adding people to your health insurance. I really liked the first one on here, which is that you are each other.  Are we okay with using that definition for a domestic partner? And obviously it says neither one of you is married to anyone else. You're both 18 years of age. You're not blood. You're not related by blood. You are both in a legally binding contract. And you have agreed between yourself to be responsible for each other's welfare. Leo, are you okay with using that definition? Yeah, I like the definition. I just want to clarify. Five doesn't mean that the relationship is a legally binding contract that each person is mentally and physically capable of entering into a legally binding contract. Which, you know, this is a modern substitute for what some laws or criteria would say that they're both a sound mind and body. That's really what it's about. But I don't understand five to say that the part, because I think earlier you said that they have a contract and I've never heard of a domestic couple actually having a contract. Rather, they just had an informal personal agreement to be together, which is what I take factor number six debate. I'm comfortable with this. The domestic partner has to find on the screen. I'm really appreciative for the clarity there. Yeah, I'm fine with that. Can I add that added to the definition on a separate page just to give more clarity for everybody applying? Yes, Nader? Just one small thing I wanted to be able to modify for number two. It says the persons are 18 years or older. It's my understanding have to be 21, at least 21 to be in possession legally in Vermont. So, in this context, should we make it that the persons are 21 years or older or would that be irrelevant because we're just talking about domestic partners. And I wouldn't want to create something at 21 because we're not saying that the partner needs to be 21 years of age. But I believe in order to do it, I'm not sure what the age limit is to get a license, which I'm assuming would be 21. So, if one of them was 21 that they can, the 21 year old would be able to get a license even if that partner was not 21. Right, that makes sense. Okay. With the definition of domestic partner, are you, Julio, okay, with adding domestic partner to the impacted family destination? Yeah, I guess the related question is whether the child of the domestic partner is included within the definition of child now. Because when you were just talking about spouse, I guess we don't have here step children. And, you know, it's sort of, I guess that brings it into further release the, I think the state policy that was just shared a while ago, I think had something about, or referring to the, maybe I was wrong, maybe I was reading something off of the actual webpage where it was talking. Yeah, in the state of Vermont policy for coverage of domestic partners, there's a section on domestic partners for health coverage and then there's a section on children of a domestic partner. And I guess that's what brought it to mind. You're muted, Gina. Are you interested in including step children into the definition, which then any marriage and domestic partners should be the same. So that would also cover domestic partner if you want to add step children to the definition of family.  I don't have any new comments or questions. I saw your hand raised. Oh, sorry. Do you like to add step children to the impacted family? I'm sorry, I didn't hear your question. Did you add step children into the impacted family? Yes. Yes. Ashley? Yeah. I think that would be wise. And Julia. Just to follow up on what's in that state of Vermont policy, their definition of for children of a domestic partner are ones who would be classified as a dependent child. So someone who lives in the household and is dependent on the domestic partnership, you know, they're married couples and domestic partnership couples that, you know, for which one may have children that are 30 years old and living on their own. And so if I don't know that that would be, that might be a little bit attenuated to draw the line to say that you had an impacted family member if you've got an adult child who doesn't live in your household. And maybe you don't really know. So I think if step children are dependent, like the state policy says, I think that's a little closer. I just worry about diluting the standard for the candidates here so that people who would, we wouldn't typically consider to be connected to social injustices and, you know, personally as a licensee or an applicant. So I raised that question. I think, you know, something that what I think is a pretty helpful guide from the state of Vermont about covered relationships. I just wonder what the other folks think about that.  Great point Julio. Great point. I would like us to go to a bowl. Based on all of the information that I have so far is that an impacted family member would be a spouse domestic partner, a child or step child that resided in the relationship when they were a minor. I hope that works for everybody. A minor in a guardianship, a legal guardian, a parent, a sibling, a grandparent and grandchild. Ashley, your vote? Yes. Thanks for that definition. Just to be clear, I'm saying yes to the definition. Yes. And child and grandchild is, if they were there as a minor, not as an adult. Nada. My vote is yes. Thank you. And Julio. Yes. Thank you. This is going to be a very extensive comprehensive definition, but we will make sure to have it exactly stated for the Vermont cannabis control board. The attachments as to what a domestic partner is considered as a definition for the Vermont social equity program. Then we are going. Here's another vote. Are there any last comments or questions about application waivers and reduced licensing fees before we make a vote on this today? Okay. I'm going to go to Nada. How do you vote on this recommendation? My vote would be yes. Ashley, how do you vote on this? I'm voting on the definition of, what's the question again? I'm sorry. The slides are not linking with that. No, they're not. I'm sorry, that's my fault. I'm sorry. So we're on the slide of Vermont recommendations for eliminating and discontinuing fees for social equity candidates. The answer to that is for about Q&A already. Just to get all the applications will be waived. We want more recommendation one that the first year would be waived. The second year would be 25% of the fees. The third year would be 50%. The fourth year at 75% of the fee and the fifth year at full price. And that there is a fee waiver recommendation for your first or second year if you can show financial harm, but also show a plan on how you're going to remedy the situation going forward. And to clarify, Nada, you just voted yes for recommendation one. Right. So based on what I was seeing on the screen, I thought I was voting on the definition for the domestic argument. Oh, sorry. Yeah, that's what I thought. That's what I thought. You want to start on that? Yeah. So let's start this over. Nada, how do you vote on the recommendations for eliminating discounted fees for social equity in terms of application and licensing fee? Did you say eliminating discounted fees? It's on slight tax matters. Okay. I'm voting for recommendation one. And application fees should be waived as well, correct? Yes. Thank you. Ashley. The one thing that I did like about the recommendation two was the possibility of the second year being waived with qualifications being met as I just came out of the compliance and enforcement.  So I do like the idea of if there's a qualification met, which has generally been set that qualification as well, of possibly waiving the fees for the second year. Yes. So that is part of recommendation one. I'm sorry. It either is or isn't. Yeah. Okay. It is. So it's recommendation one, first year waive, second year 25%, third year 50%, fourth year 75%, fifth year, you pay the full price. And first and second year, you're allowed to submit a waiver if you have financial hardship, but along with the waiver, you need to show a plan on how you go and remedy the situation. Because yes, we do want to support them financially, but we also need to make sure that they are on track for financial independence. Then yes, I vote yes to recommendation one. Thank you. Actually, Nader, I'm sorry, I do not know why this is going the way it is, but did you fully understand the recommendation that you're making right now that it is the tiered system plus the waiver included with it? Yes, I do fully understand. Sorry for any confusion earlier. No worries. I'm sorry for the text difficulty today. And Julio, what is your vote? Yes. Thank you. Okay. Let's have that for the record. Everybody has said yes to that. Don't worry. We're going to talk about other fees. We're not done yet. There are some other fees that have been suggested by the market structure subcommittee, which has gone into effect today. And there was a provisional license application fee, which I think it is now intention to apply fee. They're calling it, which would be at $500. My recommendation is because it's part of the application fee that would be waived as well. Julio, how do you feel about that? I agree. Great. Ashley, I agree. And Nader? I agree. Okay. And part of Vermont cannabis legislation, there needs to be an employee registration fee for everyone who participates in the industry. That is at $100. The recommendation was for that to be paid by businesses, as it is done right now for the medicinal cannabis industry. Ashley, how do you feel about that? Yeah, I think that's fine. I mean, I'm thinking about like pay data and what is going to all be involved for the fees for the business in and of itself just to have registered and paid employees. Like, you know, this cost is still a cost, but it's inconsequential to the actual paying people's salaries and what it takes to a pay data through cannabis. So I think this is fine. Julio? I agree. It's less than a day's wages or it should be. I agree. Thank you. And Nader? Just to clarify, this is a $100 that pays for the identification card for the employee, or is that another $100 fee that's separate from this registration? This is an identification card that in order to become employed in the cannabis industry. Okay. Yes, I support that. Thank you. So please note for the record, the provisional license application fee, which is now at the least called the intent to apply fee, is recommendation of ways employee registration fee as well. So the identification card for all of the employees is a yes from all three people. And now we have a local fee that will also need to be included within an application and it will be a max of $100 at this moment in time and that is what was submitted. Please note that all of the pricing is subject to change. Nader, how do you feel about either that being weighed or paid by the applicant? I think that since we've done away with the residency requirements, we should have a local fee and $100 isn't that much. And I think it would be good to create that connection between the applicant and their community that they're planning to work in. So I would support it. Thank you. Ashley? Yeah, I agree. Good if it says so. Agreed. Thank you. And Julio. Julio, are you on mute? I understood whether that's an annual fee, one-time fee, an application fee or what? From my understanding, the local fee would be an annual fee attached to be paid when one renews their license. But I mean, Julie, do you see it as an annual fee as well? Yes, I think that's correct. The licenses are on an annual basis and that's intended to be an annual fee that goes with that. So the licensing fee is waived for your first year, but you would still pay a local fee of $100. What does that reflect other than just revenue to the locality? I mean, what does that serve? Well, that's any expenses that the local community will have. And some others say so. For example, Massachusetts has the 2-3% community fee saying that there will be additional charges for that. So this is like police enforcement if they're having more issues with parking. Anything else that would create time and expense to the community for now having cannabis businesses there? My favorite waiver for a social equity applicant for the first year. Okay, thank you. So, Nate or Ashley, are there any changes that you would like to make? Are you still yet to do the social equity candidate paying local fees of $100? I mean, in the spirit of compromise at the fine with reducing the fee, maybe about 50%, I think that there's two sides to it in my mind. When you look at the numbers and you think our $50 or $100 isn't that much, but it does eventually add up when you start tacking on other fees and then the purchasing of equipment. But then there's also the fact that we want to make sure that these applicants are creating some sort of connection to that locality. And we have done away with the residency requirements. And also $50 or $100 is able to manage that to start creating a business. It's kind of algorithm, in my opinion. Thank you, Nada. I agree with that statement. Ashley? I need to think about it a little bit more.  Again, this is the hard part about having my compliance and enforcement break coming into social equity is that we don't really know, like, how towns are going to deal with the municipal aspects of the cannabis market. Most importantly, I guess I'm thinking about the need for, you know, possible law enforcement if that occurs, if really more on the side of protecting the people in the facilities. And I'm already, you know, we're already trying to figure out ways that, broadening the Department of Labor and Lottery to help with the increased demand that's going to be needed for enforcement and compliance for the cannabis base on top of the agency's agriculture, expanding perhaps their enforcement officers and their teams so that they can handle the influx of the cannabis industry. So I agree with what Nader said about, you know, establishing that local relationship and that fees. And since we don't really know exactly what the percentage tax is going to be to municipals, I think this is just another win for towns to feel that they want this in their town, that they feel that the industry is already giving back to their community. But like I said, I need a little bit more time understanding exactly how we're going to pay for more enforcement individuals as a result of the industry and ourselves. And so this would be just for local fee, whether they use it for law enforcement or not. The feeling behind having a social equity candidate pay for the local fee with that connection.  You know, this can start to establish a connection between the candidate and the local community that they will be working as a business partner, essentially. And but, you know, Julio has made a good point that we've waived everything and maybe that first year should be waived. So Julio, I see your hand up. Yeah, just to explain my thinking a little bit, I mean, I think it would be kind of the idea that I had behind all of this is that for social equity applicants, if they want to get in the industry, I would like, I was envisioning or I would like the state to be able to say, we want you, if you want to enter into this market, we want you. And no fees for your first year. No government fees. There'll be other costs, clearly. But for me, just to be able to say that cleanly and not like, oh, there are minor fees and that sort of thing. So I just think that you aren't, the localities aren't losing very much. I would think that local law enforcement, the community is going to allow the business in their town that the law enforcement, because of security issues, because of making, and you have a new business and it's a new industry and it's got a history, that I don't know that $100 check buys that relationship. It should be, that's what the town's doing anyway. And hopefully the business person when they select the town, it's because of something more favorable. And that's, I just don't, I see it as a bit of unnecessary expense and I don't see it as a great loss to the town. Again, there are a lot of towns that would love to have more businesses in there. People who, you know, engage in business to more commerce in their town is a benefit for them. So I know, I agree that it's not a huge barrier, but I just think just to say, you know, for our social equity pool, you know, if you want to get into this market, we're not going to impose any state fee barriers for that and let you have that and hopefully it'll take off. That's the thing. Thank you. So can we have, and Nader, how do you feel about just having the local fee waived just for the first year and then charging the local fee the following year? Yeah, I mean, I can get on board to that. I mean, a lot of good points are being brought up and I don't want to drag on, but yeah, I'd be okay with that. Thank you. Ashley, waiving the local fee for the first year and not the other year. Yeah, I like those points a lot. Thanks, Ashley. Julio, yes, to the first year of local fees waived following the year the candidate. Yes. So that are three yeses for the record for local fees being waived for the first year only. Great. We are up to license transfers, which will conclude this and then we get to go up to what benefits we want to create for the program. So we're getting there. For social equity license transfer, this is if you've started a business and have used the social equity program to do so about if you transfer it over to someone else. Your business is being sold. So if you transfer to another, transferring of the social equity license is permitted. However, the new social equity licensees, their social equity candidates, they must take over their previous owner fee schedule. For example, if they're in the third year of the transfer, all of the third year fees apply. If they're supposed to pay that third year, they are able to get that 50% of the fee. The new social equity candidate cannot just restart the clock on that business. If you transfer to a non-social equity licensee within the five years, the new licensee will need to repay any cost savings the company received to the social equity program. After five years where you will be paying regular fees, transfer of ownership is allowed without penalty. Ashley, your thoughts? Nutter? One point of clarity. So with transfer to another social equity licensee is permitted, does that also cover the other license that we were talking about the, I think with the diversity and inclusion license? Is that under that umbrella? We will be talking about the diversity and inclusion license once we fully discuss the social equity program. So this is only for social equity licensee to another social equity licensee. Okay. So, sorry, so I'll just, I'll wait until we discuss further, but at the moment this doesn't make sense to me. Thank you. Julio? Just so I understand how the first, the transfer to another social equity licensee works. If I want to transfer my license in the third year, but, or let's say, yeah, it's the third year, but in my second year I got 100% waiver because of financial hardship. The social equity licensee, and let's say, let's say that they, they didn't have a hardship that they, they did, they were very well off. Their, their market took off. That's maybe why they're acquiring licenses. They would not have any obligation to backfill that waste fee, but rather just, just take it going forward. Is that right? Yes. Yes. That's correct. Because it's not based on the licensee holder. It is based on the licensee's business. So we're not determining when we give the waiver. We're saying how the business is doing, not how much money the licensee holder themselves have. But if, but if the transfer was to a non-social equity licensee under my example, they would have to backfill that waiver? Yes, because the non-social equity licensee holder would not be entitled to any of those benefits. Okay. I understand it. I just want to make sure I understood that part. I understand about like the fee rates, but I didn't know about waivers, how that might occur. If you had to repay, if a fee waiver was considered cost savings, and I think you said it is. It's a great question. Great question. I guess the part I'm thinking about, and I'd like to hear other comments is just whether five years is too long to repay the cost savings. And with this, would this continue like for successive licensees? Let's suppose I acquire the license. I've got five years to pay. I pay one fifth of the cost savings, and then I transfer my license now to another person. And suppose that person is also non-social equity license. Does that, does the second non-social equity licensee acquire the debt to pay off? And do they have five years, or do they have four years now to pay off that? So the non-social equity licensee would not have been entitled to any of the benefits that a social equity candidate received. So within that five years, if someone acquired a social equity candidate's business, they would need to pay back any cost savings that company received because they were a social equity candidate. So if they acquired the company in the second year, and so they must pay back the application fees, they may pay back the first year of licensee wage and whatever benefit they received the second year. So 75% of the fee. From whatever was before, not after because they haven't received those benefits yet. And are you paying prorated over five years, or you could just pay the lump sum on the last day of year five? So whatever the person received up to the date where it was transferred. So if they received two years of benefits, the new owner of the company would just need to pay back whatever the two years of benefits the company has received. But they have five years from acquiring the social equity license to pay back, right? No, within five years just meant for the first five years, after five years, you could transfer the business without any penalty. Oh, I see. So the five years is, I'm not able to transfer to a non-social equity licensee at all for five years. Is that right? Well, you can. If you transfer within the first five years, and the licensee holder is a non-social equity candidate, then the new owner would need to pay back the cannabis control board, or a social equity program specifically, the revenues or the benefits that were waived. So today, if the first year is 10,000, the second year is 5,000, and you took it over at the end of the second year, then the new owner would have to pay the social equity program $15,000 for business, upfront. Before acquiring the license. Before acquiring the business. I see. Okay. I just read this to me that you had a five-year payment plan to repay the cost savings. So that was, I'm glad you cleared that up. Yeah, I think that's fine. We just have to stop here for a moment to see if there's any public comments. I do see Ashley and Nader your handphrase. Sure. Can I ask a quick question, or are we going to public comment? We have to go to public comment, but I will, and we have questions. We do. We have public comment. Hello, everyone. My name is Nicola Shore, and I'm with Vermont Normal. I've been attending these meetings frequently, but I think it's my first time speaking from the camera. I understand it's Thursday at 4 p.m. and we're all being regularly, but I kind of wanted to put, you know, someone with a big picture idea out there, which is that, you know, one of the main reasons why we are here today, creating a regulated market for cannabis is because it was made illegal in the first place under the, you know, under racist and xenophobic frameworks. So as a result, moving forward, the regulatory result of us regulating it should be a value-driven marketplace as opposed to a profit-driven marketplace. So with that said, I think it's imperative that we look at, you know, any chance we can have to waive fees for social equity applicants should absolutely be taken up, whether that is with a local fee, a license fee, which you've obviously been discussing, and that it is important to go out and have this not from a profit-driven mindset, but from a value-driven approach. And I think you've all been doing a fantastic job at keeping that mindset at the forefront, and I'm looking forward to seeing what you all have to come up with in the coming weeks. Thank you. Thank you. Other public comments? I think that's it, Gina. Thank you, Julie. What was your question about this slide? Can we go back to the slide, please? Absolutely, as soon as it comes up. So it was just a quick clarification that if a social equity licensee wanted to transfer after the five years to a non-social equity licensee, that new non-social equity licensee wouldn't have to pay back any of the fees that were waived, is that correct? That's correct. Okay. I was just curious about that. Thank you. Ashley? So I appreciate that public comment. I'm thinking of this from the lens of a social equity applicant gets these licenses. Is there any provision of... So it's a year, right? If they bought that, or if they acquired that license, it's up to them if they want to renew that license for year or two, year, three, year, four, year five. So there's no stipulation in there of how long they need to maintain that license before they can sell it. I'm just asking for clarification on that. So we assume if there are social equity candidates that they will be getting four years of reduced fees. With that being said, if they transfer, if they sell their business within that time to a non-social equity licensee, we would want the business owner to repay that after fees for the business has received because the owner was a social equity licensee holder. Because it is for the help of the social equity candidate. Right. I understand that part, but they can sell it year two. They can sell it at any time. At any time. And I guess I'm also looking at it from the lens of we're working really hard as a state and as a committee and as a board to create as much social equity and fairness and diversity for the candidate space. I guess I'm just a little bit nervous about the transfer into a non-social equity licensee. That feels a little bit like I don't want to prevent growth or financial growth of anyone. But I just feel like there's a little bit in there that doesn't feel great as far as, okay, I come into this program. I get this license and then I can sell it to an MSO. Is that possible? Is there going to be any sort of provisions of that? No, but it would be any business. Since there's unlimited licenses, we're not saying that any MSO can't come. So if a social equity licensee has started the business and by the second and third or fourth year, they say, you know what, this is too much for me to handle. Or I'm not enjoying the cannabis industry, but has made a name for themselves in the business. We want them to have the ability to be able to sell their business. You know, this is a program benefit to help them advance. We don't want to limit their advancement by saying you shouldn't have the right to be able to sell your business to someone else. Right, I don't want that to be misconstrued. I just want to make sure that there's not, you know, I'm looking at this from five years, 10 years, 20 years, you know, 100 years from now and making sure that in these first five years where there's going to be so much movement and so much influence. That we're looking at it from all those angles to make sure that we are getting these quality social equity licensee holders and that they feel that it is in their best interest to stay working and creating the state-first market from Vermont. And so I just need a little bit more time to think about that specifically. Okay. Thank you for your suggestions on that and the different viewpoints. Julio, Nadar, are there any other questions that we have for social equity licensee transfer? I have a question, but I'll see if Nadar does first. I don't have questions at the moment. There's, I probably will have questions by Monday, but yeah, I have some stuff to think on and then I will probably have some questions by our next meeting. So I'll just pass it to Julio. One thing I would like to add before we conclude Julio, sorry, and this might be added for more understanding is that the first one, what we're trying to prevent here with a social equity licensee holder is that we don't want one social equity licensee holder to come and then they're at the end for the middle of their licensee and then they give it off to another social equity licensee who might be in the same company in the same organization. So we don't want that someone can come in and just keep on running that time and continue to get the same benefits for the same business. We have to say this business receives a benefit because of the holder. It's okay if you are a social equity candidate, but we cannot start the time again because we can just continuously restart the time. And so that's what our prevention is. One business, one time clock. And with a transfer to a non-social equity licensee, we want to prevent that a social equity candidate came in, started a business, but their true intention was for another person to take it over. And they let someone else take it over and pay because they could have a reduced amount of fees. We want to ensure that these social equity benefits are going to social equity candidates. So as you said, Ashley, we don't want an MFO to come in here, start it off with a social equity licensee, take as many reductions that they can possibly get by having a social equity candidate start the business, and then really just take it over once the benefits are completed. Now at five years, there would be no benefit. At five years, we're hoping that the social equity candidate shows enough time that actually you wanted to run this company and you wanted to be with this company. And we also don't want to prevent transfers of licenses of businesses because it would then hold people to something that may not be right for them. And we don't want to control it, we just want to provide support. I hope that gains more clarity to the reasoning behind these transfers. And Julio, what was your question? My question was whether I was trying to look at it from a buyer's perspective, the one who's going to purchase the non-social equity buyer or prospective buyer. So the licenses that they acquire are the licenses specific to a particular site operation, or they're pretty much all licenses look alike for the size of the operation, like a cultivation, let's say it's a two-acre cultivation license. It's not specific to the original social equity operators or their cultivators. They are two acres, it's just two acres anywhere, is that it? To whatever the license the application. So if it was 2,000 acres of land, it would just be that 2,000 acres of land. So I'm trying to figure out if I wanted to enter the market why I would ever pay for a social equity license, because I would have to pay for back fees, where if I can compete, I can just apply and start on my own. Why would I ever, I don't understand the incentive for a buyer to purchase a license from a social equity seller, as opposed to just getting their own license. Could you explain that? Well, it would be brand recognition, client held lists that they might have already supplied to. You know, all of those connections that have been made in whatever amount of time they've been in business, that becomes equitable for a company. I understand that, but what does the license have to do with that? So they're being taken over the brand, I'm sorry. So we're talking about them taking over their company. Right, but if I have a license, let's say it's a retail license, and I want to buy your business, but I'd rather apply for my own retail license, because I don't have to backfill fees. So I think the point that Julia was missing is that it's already created. There's already profit being generated. That's the advantage of somebody who's not just starting fresh with the application process. So in cannabis businesses, they call them license transfers instead of business transfers. Sorry. It might be misunderstanding the name. Thank you. Actually, I see your hand raised with it. Any questions or comments? Oh, no, that was from before. Sorry about that. Is that enough clarity? Does everybody have enough clarity behind that? Shall we hold off on voting on this so next time, people's feelings? Or do you want to do that now, Ashley? I need a little bit more time. Okay. So let us adjourn. Do I have a motion to adjourn? Thank you. I'll second that. Thanks. Thank you so much, everybody. It's been a great meeting. Thank you for going over those few minutes with me. And we will pick up from this license, social equity license transfer next time, and we'll be going into the benefits of the program. So, you know, put those thinking caps on on how we can really give as much benefit to a social equity candidate as possible. And remember, it's not just for the licensee holder, but for other people trying to get into the industry from all different years. Thanks. Okay. Thank you. Bye.


Thank you very much. Right, good afternoon. Oh, look at them sitting there. Good afternoon. Hey, thank you. Hey, I thought I'd start this afternoon with three really dumb questions for you. So the first two come off a thing called a 994. Now most of you won't have to fill these in. It's an immigration form for the United States. So the first one it says, have you ever been, are you now involved in espionage or sabotage or in terrorist activities or genocide or between 1933 and 1945 were involved in any way in persecution associated with Nazi Germany or its allies? Answer yes or no. The second question they ask you when entering the United States, this is a current United States immigration form. Have you ever been arrested or convicted for an offense or crime involving moral turpitude? Anyone know what moral turpitude is? Please tell me afterwards. Or a violation related to controlled substances or been arrested or convicted for two or more offenses for which the aggregate sentence to confinement was five years, etc., etc. Answer again yes or no. Would anyone be daft enough to answer yes to any of those questions especially with the humor that the United States Border Patrol are renowned for? The third question is how many of you out there believe that your corporate firewalls, your business firewalls are actually stopping the hackers out there? Anyone care to answer? Oh, some very brave people out there. If you look at the Gartner report and it was reported yesterday in another talk at Black Hat, 70% currently say Gartner, if you believe Gartner, 70% of all attacks are application attacks. In other words, they walk straight through your firewalls. Think about it. Fishing, all the attacks that we get, all the blended threats, again, they're sending you emails with the intent of trying to get you to click on a poison web link. Again, it walks straight through your firewalls. Your firewalls do no good whatsoever. So, where does the Jericho Forum fit into this? Well, basically the Jericho Forum is a group of the Global 2000 corporates out there and vendors looking at just that. How we are going to operate our businesses, our corporations, our users, our home users in the future without a firewall. The reason is not doing you any good at the moment. All it's actually doing is inhibiting business. Now, don't get me wrong. It is stopping the script kiddies. It is stopping the lumps on the Internet. It's stopping the denial of service attacks. But actually, more than that, effectively, it's not a security boundary anymore. All it's doing is keeping the noise level down off your network. It's a quality of service boundary. If you think about it, it is not a security boundary. Don't get confused by the two. So, the Jericho Forum very quickly before we get on to the panel session exists as a group of corporate companies, mainly. It doesn't stop individuals joining in to demonstrate the fact that corporates want to operate in this new paradigm. Want to operate so that they can deliver better services, more secure services from the premise that you can't trust your Internet, let alone the Internet. And as it says there, aims to demonstrate how deprimaturized solutions can work in the corporate space. What is the Jericho Forum? Not just to fight up front. The Jericho Forum is not about defining standards. It is not a standards body. It's certainly not a cartel because this isn't about buying a single solution. And it's not here to compete or even dismantle existing good security. Jericho and a deprimaturized solution is reliant on good security. Don't get that wrong. But all we're doing is saying you actually need to look at it from a particular point of view. In other words, don't trust your Internet any more than you trust your Internet. So, for the day job, I'm actually the CISO at ICI, which is one of the largest chemical companies in the world. And that's the principle we've been working on for a number of years. My enterprise, my WAN, my corporate WAN, spreads to 335 sites in 55 countries and has 36,000 IP addresses on it. Can I secure that? Absolutely not. And we're not going to waste time trying. Yes, we're going to do good security. Yes, we're going to cut down on the really obvious stuff that we're going to do. Do we still have firewalls? Absolutely we still have firewalls because it acts as that quality of service boundary. But we don't believe our Internet is secure. And we certainly don't build systems based on that premise. So, what is deprimaturization? Well, first of all, it's a hell of a long word. Don't try using it after some of the parties tonight, okay? Very difficult. Fundamentally, an acceptance that all your decent exploits are going to transit your perimeter security anyway. This is the email web. If you haven't been asked by your corporation to do it, you're going to be asked in the next year or two to let through voiceover IP as a business imperative. It's coming. It'll come to you if you're a security professional very soon, sooner than you think. We let through lots of encrypted traffic. SSL, SMTP, TLS, all the VPN tunnels we make.  You say, yeah, but what happens when I use an SSL link? Oh, I can't look at that. Well, there's a problem, isn't it? We have multiple partner connections as well as all my connections. I have 3,000 connections to my network of stuff that we don't own. Joint ventures, third parties, business partners, connections with people who maintain our networks, people who maintain just one server on our network. Being a chemical company, we have some very strange applications on our network doing very bespoke things. And so we literally have a company who wrote the software who have the ability to come into our network so they can do the admin on it because they're the guys who wrote the software. If you look, I suspect you'll be exactly the same. What we're seeing is the border is an untenable solution going forwards. So, as we've said, your border is effectively a quality service boundary. Protection has little or no benefit at the perimeter. And ultimately, and we've seen this before, haven't we all know this? I mean, you only have to talk to the Secret Service who look after President Bush. They don't try to use the border guards with a nice I-94 to actually keep the bad guys away from the president, do they? They do a thing called close protection. Why? Because it's easier to protect something the closer we get to it. It is as simple as that. Works just the same in the computer world as it does in the physical world. Ultimately, from a business point of view, business does not want another DMZ. Because you know the old story, don't you? The business comes to you and says, we've got this nice new application. We've just bought this company or we're just going to start up doing business with these people and we need it next week. And you say, well, hang on a second. We're going to have to do a study. We're going to have to look at it. We're going to have to put it into the DMZ. We're going to have to put some special kind of proxy server in there. That's going to need some custom code in there. We're going to have to buy some bits and pieces, probably about two months. And you wonder why senior management, regardless of security people, is the guys who like to say no. So what is deprimaturization actually? It's not a solution. I'm not going to stand up here today and offer you a solution. Because what it is, it's a concept. It's the concept that when you're designing any system for any enterprise, no matter whether it's internet, intranet, corporate, user, or whatever, you have to design it on the principle that the transport layer, the network over which it is transiting, is not secure. It is quite as simple as that. Anyone care to tell me what the default protocol for managing a Cisco router is? Absolutely. Telnet, username, password, and all data sent in clear.  If you want to update a Cisco router, I'm picking on Cisco because I can. But if you want to update a Cisco router, what do we use? TFTP. TFTP, absolutely. Even worse, no username, no password, all data sent in clear. Crazy, isn't it? And we don't seem to learn. So, deprotorization, set of solutions within a framework we can pick and mix from. It is defense in depth. It is a business-driven solution. And it's not a single solution. It is a way of thinking. We have as an industry to change our way of thinking. Like all good vendors, and I'm not a vendor, thankfully, but like all good vendors, they say, here are some of our customers. Well, here are some of our members. And hopefully you'll recognize an awful lot of them up there. We've got a few people up here today from some who are Jericho members, some who aren't. Unless I can get at Cisco because they're Jericho members. Okay, what we're going to talk about very quickly before we get on to the Jericho challenge is some of the fundamental work that's come out of Jericho. Jericho is aligned to the open group. Everyone heard of the open group? Some people might not have. The open group are based out of California. They own such intellectual property, open source intellectual property as Kerberos on behalf of the internet community. And they are pledged that everything they produce will be open source and will be freely available to the community. So Jericho is part of the open group. It's a management trick, more than anything else, to make sure that we don't have to do the day-to-day management of Jericho. And we can get on with our day jobs. But they manage it for us. But the key thing is that intellectual property that we produce is owned, therefore, by the open group. But what it means is you can go download all this stuff I'm going to talk about from the Jericho forum website for free. Use it, take it, adapt it, change it, whatever you need to do within your businesses to actually raise the profile, use the documentation that we're producing to go out and do requests for, quote, with vendors in terms of what they need to provide for features, a whole load of stuff. It's there, it's free, take it and use it. So Jericho forum in a nutshell, your security perimeters are disappearing. What are you going to do about it? We need to express it in high-level terms. We need to do a distinction between good security and there's some very good security around there and deprimaturized security, which is good security working on the principle that the media that you're transiting over is not secure. Think of the Jericho forum commandments. We couldn't quite get it down to 10 commandments. We only made it to 11. But there we are, again, freely available. The 11 Jericho forum commandments sitting on the website. We haven't got time to go through them today. If you were at Defcon yesterday, we actually went through them. But I hope you'll agree with the rationale behind them and go get them. As I said, you'll get used to this freely available www.jerichoforum.org. On top of that, we've been doing a whole load of what we call position papers. The position papers are a look in detail at various aspects around deprimaturization. And the aim behind this is to pick a subject, either because it's currently media friendly or sexy, or because it just needs addressing, and actually looking at what we produce. What we aim to be a two-page document, that is it. So in other words, your CIO might actually read it. So we aim to have them as two pages. I think the worst we've ever got to is four. But the idea is they are short, they are CIO friendly, so they can understand them. This is part of one that we produced. And like any good Gartner analyst, if I was a Gartner analyst, you have to have a four-box model. So here's the JerichoForum four-box model. And this is about good and bad protocols. And we've said already, what's bad about the internet? Well, we're still using too much Telnet, we're still using FTP, we're still using TFTP, we're still using all these insecure protocols that are out there. So here's the model and basically it works like this, that currently where we work today is sort of this space here. We work generally insecure-closed with a little bit of open and insecure and a couple of point-solution stuff up the top. We're moving as an industry into sort of this kind of space and where we need to move ourselves is here. We need to get up into this top box. We start needing as an industry to use inherently secure protocols for everything we do. And that means everything. And yeah, okay, we use HTTPS on a reasonably regular basis. But as someone was saying, SMTP, there is a secure version out there. SMTP TLS exists in every single version or modern version of SMTP server that is out there, even though just notes has it. There is no reason why you can't go to your SMTP server today and switch on TLS. It is literally a config line change for most systems. You can self-certify with TLS, you do not need. I mean, if you want to put a public cert in, you can, that's fine, but you can self-certify with TLS, there is nothing to stop you doing that. The correct, no one is going to trust it is you, but at least it means it is encrypted in transit. So yeah, basically, if you are a public company, you should be using a public cert on TLS. But that is just an example. It is available today. How many people in this room have got SMTP TLS enabled on their servers? Probably around about 20, 30%. So if you take anything away from this conference, go back to your organizations and just switch it on. It costs you nothing to do because it is backward compatible. It defaults and falls back. So it costs you nothing, nothing to change, nothing to configure other than generally one configuration line and perhaps putting a cert in. Not hard at all, we can all do it tomorrow. So anyway, position paper on secure protocols. I said you are going to get fit up with this.  We are there for you to go and use with your businesses. Wi-Fi. Sexy subject, we are all using it at DEFCON at the moment. The Jerichoforum position, again, is that you shouldn't trust what goes over the air. We have had a whole load of fuss, haven't we, with Wi-Fi, with people trying to secure the air interface. Why? If you actually used a deprimaturized solution, you wouldn't care about the air interface because the principle behind deprimaturization is you don't trust the wired interface, the transport, or anything else that goes with it. Again, paper available, Jerichoforum.org. Voice over IP. Of course, we all know there's, you know, anyone using the secure version of voice over IP? Absolutely. Why? Because there isn't one. It doesn't exist. So, okay, you might go and argue with me that I'm using Skype, but that isn't really corporate-ready. Ashley, if you want an interesting trick, take your corporate name and go and put it into the search for it in the Skype name and address book. It's really, really interesting what you find. We put ICI into the Skype corporate address book and found ICI Indonesia reception. Yeah. We soon put stop to that one. Anyway, it's really, you know, Skype, forget it, it's not corporate-ready, it's not corporate-friendly. Do you really want to expose all your corporate users onto a public address book? I don't think so. Anyway, secure void doesn't exist. Secure void needs to exist at the end of the day. If teams from DEF CON want to go away and work on a problem that's actually going to benefit mankind at the moment, go and work on secure voice over IP. Yes, sir? The question was, have I heard a Z-phone? And the answer is yes, I know Phil Zimmerman very well and I have heard a Z-phone. I've yet to see, I mean, again, he's only in beta-3 at the moment. I wouldn't call it corporate-scalable as yet. So, I think it's a very neat technology. Is it corporate-ready? Absolutely not. So, if you think about it, what are the parameters you need from secure voice over IP? It's got to be secure at the box, got to withstand attack. Who went to the voice over IP hacking demo at Black Hat? Few people. I don't know if they're repeating it here, but I hope they are because it was very impressive. They just basically spend the entire hour crashing telephones all over the place and doing nasty things with them. It was really funny. Very good presentation. You've got to have phones that are remotely and securely maintained, especially in a corporate environment. It's up there. Again, go get the paper. It's all in there. Tell your vendors what you actually need rather than the nonsense they're going to give you. Web access. Web access is great, isn't it? Who here uses either, well, you know, the popular ones, Surf Control, WebSense or one of the others at their corporate boundaries? Yeah, absolutely. Why?  But it's funny. If you think about it, you know, my CFO travels around the world, you know, corporate results time. The most valuable thing for any corporation we dual list both on London and New York stock exchanges. The most valuable piece of information a corporation ever holds is its annual financial results. And at one minute to midnight before they're released, in my organization, they are known by five people and five people only in the world. And at one minute to midnight, they become public information. So while my CFO is travelling around the world and in hotels and connecting his laptop, standard, you know, standard Dell laptop just like this one, he's got the corporate financial results sitting on his laptop. And how are we protecting him? Well, you know, personal firewall, all the standard stuff. Meanwhile, back in the office, his secretary is doing email and all the routine office stuff. And what are we doing to protect her? Well, we've got a nice intranet and we've got some IDS floating around and we've got some firewalls at the border and we've got surf control doing all the proxy stuff out to the web. We're spending an awful disproportionate amount of money protecting his secretary doing email from protecting him when he's actually out in the big bad internet. You know, what is wrong with this picture? The Jericho principle, the Jericho form deprimaturization principle says we shouldn't differentiate. We should apply the same level of protection to all our devices we're trying to protect irrespective of where they connect. It's a fundamental principle, isn't it? It's obvious when you think about it. But we don't do it because it's hard, isn't it? So web access, we need to have a single corporate access policy regardless of location, regardless of connection methods and we need to protect all our users, especially our web users. And again, you can fit up with this, aren't you? Position paper available from the Jericho form.org website. If you go and get this one, just as a reminder, currently version 1.0 is up there. 1.1 was released last Friday. I don't think it has quite made it to the website. So if what you pull down is 1.0, wait a couple of days and go and pull the new version. It's just got some pretty pictures in it more than anything else. Nothing major. I think it's fine anyway. Digital rights management. Well, you know, we all know this one's been usurped by the media industry, hasn't it? But if you think about enterprise DRM, we talked earlier about, you know, it's easy to protect the data the closer you get to it. Again, easy to say, hard to do. Ultimately, this is what DRM is about. Enterprise DRM needs to go out and protect your data at the data level, such that we don't have the crazy situation we have with Windows at the moment that if I can read, you know, if I've got a secure server and it's got some data in a file area, I can go out and read that data. If I have rights to read the data, it then resides on my machine. Now if I hit the Save button and save it somewhere else, it's mine. I own it. I'm now the creator owner in Windows terms. I can now say who has rights and privileges to it, and I can totally change it. And obviously as that document gets passed around, we all know what happens and we wonder why there's information leakages out of companies. The answer obviously is that as the original owner of that document, I should be able to specify who has the ability to read it, who has the ability to print it, who has the ability to copy it, who can do even do a screen print and screen capture it. And I should be able to define those parameters with that document. Such that I can then mail that document to every single one of you in this room. But the only people who can read it, change it, modify it are the people I have authorized, irrespective of how many people you then send it to. Again, easy to say, hard to do, not impossible, but the problem is, like everything else, there are some nice point solutions around for this at the moment, but a complete absence of standards. This stuff is only going to work if we have open standards. Again, spotting the trend here, go get the paper, not quite available, it is in draft, it's probably about two weeks away this one, possibly slightly more, but certainly a month away you should be able to pull this off the Jericho forum website. Oh, look, fine, yeah. NAC, we forgot about NAC. Anyone got NAC installed completely across their entire organization? Oh, no. This is a problem. Some brave person. How many computers have you got, sir? 10? NAC is a marketing idea more than anything else. I totally agree with you, sir. Absolutely, yeah, NAC is a great idea as long as you're only trying to secure 20 or 30 computers, but at the time it gets beyond there, it's a nightmare. You know, I said earlier, I've got 335 sites. Am I really going to go and pull out all of my old routers out of those sites and replace them with nice brand spanking new Cisco kit? Well, I'm sure Cisco would like me to do that. Good for my salesman's bonus, but not really good for anything else. It's a nightmare. There's also, it doesn't work in the real world. It works really nicely in confined situations. So if you're going to build it into your brand new wireless system, absolutely. But it doesn't work on an existing system particularly well because of all that legacy kit, if nothing else. And yes, there are stopgap solutions, and the vendors will tell you they can make it work, but trust me. The other problem is obviously with endpoint security, it's all about trust. That's what you're doing. You're raising the trust level. Trust is temporal. Trust has user integrity and integrity strength. There's a whole bunch of issues around this. Again, draft paper available probably in about a month's time. Endpoint security, go get it when it's available. Finally, this is finally, the picture here is for anyone who believes in the old principle of city walls as, you know, people come up to me and say, yes, but security is well tried and tested throughout the ages.  This is a castle wall. This is what happened to the European castles of old. They now sit on roundabouts and traffic islands, and they're there for the tourists. They don't have any practical purpose whatsoever. So architectural security drivers, you can see some of them here. There is available an architecture paper on deprimaturization. Again, freely available, go get it. Future position papers coming, stuff that's been worked on by Jericho. You can see them up there. I'm not going to read them out. A whole load of stuff. Go back and visit often. That brings us on to this thing called the Jericho Forum Challenge. Basically, the concept behind the Jericho Forum Challenge is that we feel the time is right to actually challenge the industry to start building some decent systems. And to do that, we are proposing the Jericho Forum Challenge to actually go out and design them, build demonstrator systems. Here's the format and timeline. Basically, we launched it yesterday afternoon at Defcon, at Black Hat. And the concept behind it is very simple. Build us a demonstrator system. We'll talk about the why's, the wherefores, and the rules in a second. But it might be great. It might be fantastic. It might do all the things. But then, of course, it's easily broken in two minutes. So, of course, there is this other little conference going on which happens after Black Hat. So our thinking was that you bring it to Black Hat and we judge it from a corporate and architectural point of view. And then we give it to you guys to play with. And see if you can break it. And we award prizes. Monetary prizes. So, format and timeline. We're announcing, obviously, the other part of the Jericho Forum Challenge now. August 2006 to May 2007, registering interest, plea Back Hat, obviously submitting, and we're going to finalize a short list. Black Hat 2007, we're going to get people to come and give their entrance. DEF CON. The aim is that they will be connecting their systems for you to have a go at. Simple as that. DEF CON participants will be invited to test the security claims of all those various systems with prizes for those who breach the most systems. And the result, basically, we're going to score them from a corporate point of view. And then we're going to add a multiplier based on the results of the DEF CON. So, if it lasts for two days and no one gets into it, it gets a one. That's the multiplier. If it lasts for 10 minutes, it gets a zero. And at the end of the day, at the end of DEF CON, we will know the winner and not before then. Main sponsorship. What we're looking at, the kind of figures, we're in discussion at the moment. Currently, we're looking for the main demonstration systems. Currently sitting at about $50,000. We are looking and talking to people at the moment about getting sponsorship up to quarter of a million or half a million dollars. This is a serious competition. Currently thinking for DEF CON is the first prize for actually breaking these systems is going to be $10,000. That's not bad for a weekend at DEF CON, is it? So, what's this space? And that brings us nicely onto the panel. With down one, Pam censor apologies, I'm afraid. She got run up by work and asked to do some real work. Today, they had a slight panic of some description, and so she censor apologies. Can't be with us. But we have a very distinguished panel. On my left, David Mortman, former CISO for Siebel Systems. Henry Tang, Enterprise Security Compliance Officer from Philips in the Netherlands. And finally, Steve Whitlock, Chief Security Architect for the Bone Corporation. Now, we want to try and make this in the... What have we got? 10, 15 minutes that we've got left. Slightly interactive. What we're doing is, if you haven't noticed it, there's a little pair of microphones here. And I'm sitting recording this. We recorded yesterday's session when we looked at the other side of this question. And what you're going to see next is some of the work that came out of that. So this is real hot off the press. This was 5 a.m. this morning when I got up, putting this slide together. But what we're doing is recording this. So if you do have a question, we're either going to have... You're going to have to shaft it out so we can hear it and repeat it. Or there is a microphone up here for anyone who's in this vicinity to come and sort of talk into. And what we want to understand, what we want to try and do is gauge from people what they think a fair test is going to be for next year's DEFCON. So here's what we came up with out of yesterday's meeting, looking at the other side of what we would like to see from a corporate point of view as a demonstration system. So the first one was to define it as the business problem. Deliberately vague. Because we didn't want to stifle original thinking. The solution has to be recognized by the business. You know, it has to be said, yeah, I could see that working in my business. So there's the draft specification. I'll go back to that one in a second. So the question initially for the panel and quickly for the audience if people want to chip in, or afterwards, feel free to grab me. I'm here till Sunday afternoon. So if people want to grab hold of me and say, hey Paul, I thought about it. What about doing this? Or wouldn't this be a good idea or anything else? Please feel free, grab me and give me your suggestions. So what we want to know is what you think would be, the panel thinks initially, then you think would be a fair testing criteria. Panel, who would like to start? They're not normally that shy. I suppose... Ann? I suppose capturing a file or something is fairly typical, but I think forging a sequence of transactions might be a little more interesting. Yes, this is Henry. Well, I have a compliance job to do, so some of my test criteria probably will come from that perspective. We work with auditors quite a bit, and as part of the test criteria, I would say I like to see a QA based on some of the audit ways of working. And in this particular case, Jericho, well, the principles and details obviously are posting quite some challenges to the audit community because of the increase of gap versus what they already have in mind of what is a total control environment. And when Jericho brings in these new principles or basically challenges, certainly the control framework is being challenged as well. So from this perspective, at least from my perspective, I think it's important that as part of the test is to make sure that what we have understood as a control framework is either meeting that challenge or we may have to actually up the framework. So it's a more challenge on both ends. Okay. David. That's an excellent question. One of the things I'd like to see is how the system can be gained in a broader sense, especially given the requirement for mutual authentication. I'd like to see how that can be used in abuse to say actually pretend to be in one of the authentication servers or one of the actual main servers in a malicious way to get access to data you're not even supposed to ever see. Sir, there's a mic up there if you want to stand up. It'll be probably easier for all of us. It says me having to repeat it anyway. Are you taking into account how you're going to be putting compartmentalization and the assets that are going to be protected because really what you're dealing with is a scoping and you're also dealing with the trust that you're trying to assign to each individual that has information that is trying to be protected. By that, whenever you were giving the example of having the secretary and the CFO, okay, the CFO has very sensitive information as opposed to the secretary maybe having access to it but not garnering it directly. And with anything that you're doing, am I looking at using something like DAC as a standard access control or can I go into Mac but that's still going back to the person having control over what's being shared as opposed to if I pull in something with TPM all of a sudden I've taken out control of who of what you have or hit he has and brought it into a more process driven the computer is taking care of it as opposed to the person themselves. Okay, so basically what we're talking about is subverting either the access control method or the trust method. Well, no, I'm bringing it out to you've got scoping issues that are there. In other words, I can build one system that I can guarantee you a severe problem getting any information out of it unless you're authorized. Yes. But that won't necessarily translate to 30,000 systems. Correct. I cannot do Mac accurately across that many systems because I start losing the granularity that I need. Yes, one of the asset tests for the first for the actual the CSOs to do at Black Hat will be does this scale to a corporate environment? Well, but that's what I'm talking about with you need to for what you're trying to bring out tell us what the scope is that you're going after. Are you going after the compartmentalization of financial information which is very sensitive or are we trying to stop mail going across an entire network? Those are hugely different problems. Yes. Essentially the idea at the moment certainly with this specification up here is to try and give us broadened attack surface and as a realistic attack surface as possible. Yeah, I just want to make a comment. I think the question is excellent because part of the thinking here is when it comes to classification of information here basically what we're trying to understand is the risk because if you have different types of information that you need to protect and you have different ways of partitioning or segmenting that information the risk analysis comes out different and therefore actually the test criteria may change. So giving example like on a system if the system actually is breaking it is not completely saying that that system is 100% gone because if the system actually has a certain partition and certain what we call sensitive or maybe confidential or even personal information is protected then from a risk perspective I can still or put this way the business can still live with that breaking situation that maybe just sacrifice some email and in this case I assume that the email is properly protected but not or in this case confidential information is protected to some degree. So breaking into the system is part of the story but the second part is how much are you actually getting access to and then determining the value that you were able to obtain I would say is part of the test criteria as well. Good point. Sir I'm being told we've got to wind this up so you get the final question. Okay I wanted to make a couple of points. Certainly. Your metric should be everyday usage metric for any organization so the system needs to be available you need to maintain integrity data integrity and system integrity at the same time making it available to local and remote users and users that use the system in a variety of environments from filthy computing environments like DEF CON to sitting in your office and you know just using it very generically so you know and it needs to adhere in my opinion it needs to adhere to the same set of issues compromise of data regardless of what that data is compromise of data the integrity of data the privacy of data the availability of the systems in terms of denial of service and those types of metrics so you know I think I'm taking a step back and rather than dealing with you know what happens to email versus your confidential data files what if that email contains confidential data files so you know it needs to adhere to all of those one other point I wanted to make stepping back you made two disparate points one is security is not privacy is not security and security is not privacy so a lot of the points you put up on the board in the you know right upper quadrant were privacy driven and not necessarily security driven so if you take HTTPS into consideration or if you take TLS into consideration someone can use HTTPS or TLS and get a private connection into your environment and then have a field day into your systems you're actually right yes wouldn't disagree with you at all I mean don't I got to wind up all I can say is what's this space there's going to be a lot happening with the Jericho forum challenge in the next few months so what's the Jericho website I suspect what's the DEF CON and Black Hat websites what's the press and thank you very much for your attention and your input