the overlap but maybe I'll just send this to Bonnie as is I might be a faster way to do it so um sorry just one second I'm going to maybe yeah what's the best way to proceed yeah I was going to say maybe we'll take a five minute maybe a maybe a 10 minute break um which I'm sure I'll use and maybe councilmember commentary Johnson you could would you mind doing a kind of a compare and and yeah break it and then that way we could get to one document does that make sense I hate to not give you the 10 minutes and I know I'm I'm okay with doing that yeah I thought councilmember Cummings was going to speak so I thought I had a unfortunate um so you guys take a break and I'll try to cross out what's already been said question or comment yeah I did I was going to mention that I it's similar to uh councilmember commentary Johnson and councilmember Golder I also had recommendations for language to be incorporated some of which I think overlaps and some of which I believe might be new and so I guess the question is you know what's the best way to try to reconcile three sets of recommendations um why don't we start with councilmember commentary Johnson sounds like she'll go through and compare I don't know councilmember Cummings if maybe you could do that just make sure there's not repetitive and then we can work from councilmember commentary Johnson we'll just have to work line by line through again to see what we can get to if that's amenable I'm not sure how else to do it unless uh martin you have your hand at martin Bernal oh just a good question uh with respect to the date just to clarify that one did you mean April 13th which is the first April is that the next county yeah so the next county meeting is the 23rd March 23rd oh what's the first one in April I didn't want to be so it was like because sounds like a lot it sounds like a lot of work I don't want to be a jerk like it's just giving too much work so I meant the first one in April that's the 13th then yes that was okay all right okay thank you just to clarify that remember Cummings is that will that work where we just we're just going to be pulling out new language um is that is that amenable to you I mean yeah I don't I don't think there's any just trying to see what we can do by going through language and making a comparison mayor it might be beneficial for councilmember calentary johnson to submit um what would be a friendly amendment I assume and then we could work with that and then councilmember Cummings can do a his friendly amendment with anything left member calentary johnson doesn't encompass councilmember Cummings wait yep you can record him as friendly amendments um we'll take that 10 minute break is that okay yeah yeah let's let's take 10 minutes and then we'll come back and we'll go hopefully with friendly amendment okay if councilmembers can um turn on their videos and their excuse me they're uh Michael uh be ready great everybody's here um councilmember calentary johnson did you have enough time to look at your materials and councilmember Cummings did you have enough time kind of okay um I may have missed something but I I sent the um motion language to bonnie if bonnie if he could pull it up and then I'll um also just invite councilmember Watkins if I if I missed something um to to chime in friendly amendments to councilmember golder's um amendments are um the first one is to um provide clarity on where safe sleeping is uh permissible and explicitly identify those areas where the nighttime sleeping is permissible as opposed to listing where nighttime sleeping is prohibited uh in addition to the storage uh program uh that safe sleeping program is up and running primed prior to implementation of prohibition these other areas that I've crossed out I believe were already covered by councilmember golder's amendments um around outreach there was a question by staff about the intention of outreach and it is to connect individuals to available shelter um safe sleeping options but also to provide education on where and when camping is permitted and not permitted the other one is um moving down to number five that families with minor children are not subject to arrest or citations um and I believe councilmember Cummings has some more specific language around that so we might want to consider what he's drafted that daytime restrictions um this was part of councilmember golder's amendment but um the suggestion here is to shift the language a little to um state yellow tier or cdc guidelines change whichever occurs first and um again this the misdemeanor enforcement piece was brought up by councilmember golder the language here is a little different um I think I think it's saying the same thing but I just wasn't sure and then there is policy direction to add to the policy directions that councilmember golder provided and that is to stand up a managed camp at 12 20 river street um and have staff report back to council on stuff taken to stand up the managed camp at 12 20 river street um by june 2021 uh actively develop and pursue restorative justice programs as part of our enforcement efforts um work with the county of Santa Cruz to fully integrate the city's safe sleeping and storage programs into the continuum of care the regional continuum of care that was brought forward by the board of supervisors today and um and ensure that all county managed shelter and housing resources are made available to eligible individuals that con that are contacted by city law enforcement or outreach personnel develop and implement with the assistance of the members of the public safety committee a semi annual review and audit of the outdoor living ordinance um specifically around arrests and citations and work with the uh city police auditor to ensure public transparency of enforcement um of the court and and adherence to its principles um work with the two by two to explore expansion of shelter traditional shelter programs this was the piece this was what the board of supervisors has brought forward so it's really it's just confirming that we are in alignment with the board of supervisors and that we will continue to work with them um and contribute to the to their strategic plan and the ways that make sense for our city sorry really quick councilmember um i think it would be good for you to read it verbatim yeah sure people who have called in i can't see you what you're oh thank you i wasn't sure that that okay thanks for clarifying the city's two by two members to work with their county two by two counterparts to explore expansion of transitional shelter programs into the city jurisdiction in concert with the county's three-year strategic plan on homelessness and new policy counties set forth on march night 2021 to expand the county's shelter programming into the unincorporated urban areas of the county and direct city manager to return to council in low later than june 2021 with an update do i need to go back and read some of the other one bonnie um no i don't think so okay um the next one is to invite county staff to come to the to um a future city council meeting to present to make a presentation of the work plan that was passed today and then ask city staff to serve as a liaison for future updates of how this work plan is moving forward and um finally develop and implement an ordinance effectiveness review program to initiate nine months from ordinance initiation to track um there's a number of items i'll read them to track increased outreach and connection to services including quantity integration into the county system of care including hmys and coordinated entry results decreased high density large outdoor living groups increased access to safe sleeping sites increased access to high-chain resources decreased encampments and high sensitivity zones and open spaces increased access to parks and other city resources by all constituents decreased reports and instances of fires crime ambulance visits environmental degradation of highly sensitive areas and sub-division areas of the city and a cost analysis comparing cost and encampments cleanup first responders and staffing response to encampments versus implementation of programming and the new ordinance council member colder are you um are these uh amendments friendly amendments okay with you absolutely and as the seconder i accept them to and can i just confirm um these yellow or these crossed out we're crossing out right they're not going to be part of the friendly amendment correct okay and then the yellow was the same but slightly different so um number six um if council member golder and mayor mires are um except that then i that i i would like to see this shifted the language shifted to tier yellow tier or cdc guidelines changed um number seven yeah i'm not really sure what to do with that because i i think i think that council member golder's um language and this language is maybe we combine the two i think it's it's saying the same thing but each of us has something a little different maybe we can combine those two i think it's lower this one yeah yes mayor i think i think there's a little bit more of an explanation within the amendments but these are the identifying accompanying um actions that's how i read it yeah i think so this would replace the other language that doesn't have as much explanation yep mine was just a bunch of like thoughts and so i think this one's better as i said i think council member cummings has has more specific and maybe stronger language also member cummings do you have a friendly amendment week we'll work with once in these over to you and maybe go through them and see where they will to identify the appropriate areas and others i think with you on here that i would need um the exact location but um one of the things in particular if you could maybe show uh council member golders language again or the whatever the most recent document we were working on calentara johnson and i actually think that we could probably delete the two map amendments because i think that what's most critical to the ordinance and as we change the ordinance that'll be reflected in the maps so i think if we really put the emphasis on changing the ordinance then we'll see those changes we made in the maps but in particular because we haven't had a map produced showing where people can camp that in particular i think needs to be called out and we need to explicitly have a map where camping can occur and it might be worth the saying where it could um we have said that the city manager will have authorization to designate where um transitional encampments are managing campus may go and so if there's a map they can be produced to show that along with um in that absence where people can camp i think that would be appropriate though i do have some comments around shaking her head yes so i think she's amenable to that um body maybe i'm just taking notes so basically i think we're favoring council member calentara johnson where a map that would show where camping can be allowed would be would replace maps the current maps that um that and then council member coming you also mentioned um uh you had one other adjustment to the map um just then was that was that it that it's really okay yeah that's the main one is having a map where um i'm kind and i'm also kind of going through the ordinance as well because there's some bit of general comments in some i think that um are um specific to the ordinance one was in uh 030 private property under and this is a private property is unlawful for any person to own private property erection figure construct maintain or store an outdoor living encampment or to use a vehicle for outdoor living except add a license and register vehicle in a residential off-street driveway with the right consent of the owner and occupant of the residence where the driver occupant of such vehicle is in possession of a valid driver's license provided that no more than one vehicle shall be permitted any one location no particular location shall be used for camping under this provision for more than three days during any one calendar month and i was going to as a friendly amendment strike that last sentence quick if i can um i think it might be good to have a visual so i'm going to stop sharing my screen and allow detective butler to show the ordinance and kind of make red line changes as he goes okay that might be better this is uh 6.36030 and a hey that you were referencing yeah it was four it was a four thank you last sentence and it might be good to hear some comment from the concern that i have is and i know some of the individuals who spoke tonight at least one individual who i've known who's lived in a camper in someone's backyard in their driveway and you know them being able to live there provided them with safety security allow them to save money put down payment on the house and so long as there's no you know nuisance behavior or complaints it doesn't seem it seems to me that you know even if it was somebody coming into my town staying in somebody's rv for a month you know while they're visiting um the action of somebody staying in an rv in someone's backyard i don't think that that should be you know that should be against but there should be a law that we're creating that um doesn't allow for that unless the people are creating nuisance behaviors and you know under which circumstances they need to be dealt with regardless so that's one of the changes i'd like to see if it would be considered we is this possible that you possibly make your screen a little bit there you go all right perfect that's great no i just want to make sure that public can see it yeah so let me see if i can get the whole section there yeah it's a private property language would be to the to or is there a revision to that last sentence councilman coming sentence and just looking below to see there's um can you scroll up a little bit lee there we go this way yeah i'm sure that they would need to make it somewhere else but it's it's included so this is uh all of private property then it has uh the allowances and then we have struck your suggestion is to strike the three-day limitation and the second part of that is a is not permitted on private property where it's conducted in a manner to create noise and adequate sanitation trafficking illegal drugs etc private private nuisance and to that point too i was also going to suggest striking noise because we have a number of noise ordinances and there's certain times when people can make noise and when they can't and it doesn't seem fair if somebody's in a backyard and they're it's two o'clock in the afternoon and they might be listening to a radio that could be considered creating noise so unless we can explicitly define you know what that is but i think it is captured when we say also living or camping shall not be permitted on private property where it's conducted in such a manner as to create a public or private nuisance so i feel like you know if the noise that's being made is is considered a public or private nuisance then that could capture it so it could be considered redundant certainly the maker of the motion seconders fine with that so we'll strike as to create noise and just keep the remaining language there okay that's where this should be included but one thing in particular environmentally sensitive habitats near critical infrastructure and i'm not sure exactly where that was including open spaces and then two and sensitive habitats in the city limits and i know that there's a number of members of the public who mentioned that sensitive species have been mentioned but since the habitats haven't and so we're showing to add that within all parks as defined in the parks master plan open spaces and sensitive habitats in city limits does that work as i um i think you mentioned earlier that open spaces weren't included in the park's master plan that's why i was trying to keep those two separate yeah they are um they're just separate from parks they're not considered parks in the park's master plan and that's yes on me too um and then number 10 i would just strike that number but number 10 oh no sorry here's nine the 75 linear feet from either side of a designated trail in open space you can't camp in open space in that wouldn't make sense um 25 feet off the trail you know what comes to mind when we saw the maps earlier for example that would mean technically you could camp you somebody could set a time in the middle of the golf course and they would be 75 feet off the trail in open space um and so i think there's a lot of concern around the distance off a trail and the potential negative impacts that can occur when you're um going off trail to camp i think um for things like this um they're going to in response to the council direction at this point they're going to be a bunch of clean up similar to this where we're going to need to go in and um make modifications and in fact what i was hearing is that um this may want to move to an affirmative um rather than a prohibited so you know a lot of this area is going to going to need to change in fact you know it might uh unlawful it might change to lawful and have the areas that are okay but you know we'll we'll cross that bridge in the next couple of weeks before we uh prepare the next report okay and then um before zero which i had around language was the prohibitions in section nine pun uh zero b one unless and until unchallenged persons in the city because of available access to pre-covid vaccines i think was two um one suggestion would be um dispersing individuals experiencing homelessness and homeless encampments and or when the county or state declaration of a local health emergency has been lifted that's i'm going to put that out there for consideration um but then the other part the other thing that i could see going in this section is prohibitions in section six point three six zero four zero b one and two shall not be enforced against homeless families with children and in cases of a homeless family the city staff shall work with the county and state and or non-profit partners to attempt to find the family temporary shelter or housing well i can send that lee if you want so that makes it easier can you repeat it really quick see right is i've got it on c and d just as a note that it needs to be captured here because i don't know that we've got the specific wording at this point okay and so um zero four zero b one and two cdc the guidance around dispersing individuals experiencing homelessness and homeless encampments the county of emergency has been lifted and purpose behind that is that um the concerns that i've been hearing is that the city because currently the guidelines even if people get vaccinated as to where max continues social distance that's all changing and if this is coming back at first meeting april we might have new guidance then but really trying to be um kind of building the safeguards so that um you know if we're saying orange or yellow that um another lawsuit the cdc still maintains that regardless of status um while the health emergency is in effect that we need to not move homeless people homeless encampments so that's just the rationale and the basis for that the next one was um the prohibitions infections six point three six zero four zero b one and two shall not be enforced against homeless families with children in cases of a homeless family that shall work with the county or nonprofit partners to attempt to find the family temporary shelter or house as fast as you can speak sorry yeah no problem i had one thing to that i mean i i totally is that okay if i add something right now kind of or should i wait with that i would also like um just from having dealt with homeless families for the last 20 years in education that child protective services also be involved because they do every attempt in this county to keep the family unit together and they have a vast network of resources that they can provide and um i just want to make sure that uh the children are cared for and in in both circumstances not sure the best place i think it might be good on their penalties for violation but the enforcement of the camping prohibitions will not occur prior to providing storage which i think is included and identified managed sanctioned sleeping sites what section is this i think i'm not sure exactly the best place for but i think it might go under penalties for violations it's really just trying to get at um conditions when this can be enforced and i think we've expressed that um in order for this ordinance to take effect we'd need to have storage and i wanted to add to that question is that different than what we had included last time which was was the state with 150 safe sleeping sites before the ordinance was that is that different than the language that was in before that is different um so you can see here um that um let's see did i did i find the right one here section so you can see here that it says uh provisions above in these sections shall not be enforced until the storage program is operational uh at the last meeting the council added the safe sleeping but they did not tie the enforcement of the ordinance to the safe sleeping they only the the tie to the enforcement remained solely with the uh storage for this section so i believe that council member Cummings is looking to add something right here yeah for the people on the phone the provisions above in section in subsection 6.36040 b1 and b2 shall not be enforced unless and until the above described unsheltered person storage program and a managed sanctioned sleeping site are operational and reasonably available to unsheltered persons in the city of Santa Cruz really trying to get us to have managed sites and to really try to get away from these um sort of unmanaged encampments that have really negative impacts on our community so did you call me yeah do you this is this amendment okay with you um this is okay the only thing i was just thinking i don't know how much back we went but as far as the cdc guidelines i'm just concerned that the emergency declaration is going to go on for i don't know how long and i would just like to stick with the tears if that's possible and i i don't know that was uh council member Cummings like what are your thoughts about that like and i'm not i'm fine with like the yellow orange or yellow or whatever the next lower one is i'm just concerned that we're going to be in a date of emergency for five more years i mean i just feel like i don't know what it's going to end what are your thoughts council member colin tardy johnson i think you had language that tied it to the tears yeah i i tried to um i i asked that it would change to yellow or um cdc guidelines change i added both because i i share the same concerns as council member golder that um we may be in a state of emergency for years to come so just some more flexibility around that i think i think would be best so that's why i added the yellow tear or cdc guidelines yeah it's the second or i'm i'm more comfortable with that i agree i think the state of emergency could could remain for years i would just um i wonder if they're kind of inquiry around that i think the reason why i'm concerned too is because as um as we're aware of the people south solito case that came before us um where it sounded like in that case the judge asked when the city went to um enforce the movement of a camp in that community and the daytime sleeping ban one of the things that the courts asked was that was whether the city had any other you know document or group that they had you know been in consultation with the suggested he was recommending in terms of how to deal with homeless encampments and when the city couldn't provide any just any justification that might have contradicted the cdc the the courts pretty much said well if you can't show us any other documentation that would suggest that what you're doing is okay then then that's not that we can't uphold your request and so that's the concern that i have is that if we were to move forward and we were asked you know what are we using as a basis for um you know taking down encampments in yellow tier i don't think we'd have anything um legally to back us on that and so that's the big concern i have but that's one additional legal hurdle that we'll be faced with if we leave it in so i'm happy to leave it in for now because this is obviously going to come back to us again in between now and um between now and april 13 i'm adding a lot of things are going to change so if we want to keep it with yellow and cdc guideline changes for now um i'm fine with that and we can see how that changes when it comes back to us on the 13th i have a couple of questions i just have to see a couple of hands up i have martin bernal martin walkins and then count from over brown do you have any comments on this section or martin with respect to the discussion earlier about the conditions for enforcement around having the safe sleeping sites i just want to be clear because there's the manage encampments and safe sleeping sites so be clear whether you're referring to the safe sleeping sites or manage encampments or both uh the distinction being that the safe sleeping sites are places where people stay at night uh manage encampment oh and one night at a time where the manage encampment is a place where people stay for a longer period of time and it's also uh much more intensive it was as far as staffing and as far as cost is concerned so there's a big difference there too so i just want to be clear about what the intent there was it just the manage sanctioned sleeping sites so i read this as a sleeping sites the safe sleeping sites yes and i and i guess the question that i have then is would be managed it would be that yes yes so there would be yes they yes they're not right exactly but uh yes that just distinguishes but it's not it's not the manage encampment model no and that's why this was being explicit we have to have a managed encampment site and so other city manager it would need to be staffing and it would be for the purposes of overnight sleeping yes item was um in the lat when when we when this item came to us previously um i don't think that one of the friendly amendments i made was captured appropriately and so um timing for when people can sleep i was wondering if that could be amended so that for all an hour before sunset to pitch a tent and then tents will be taken down by an hour after sunrise and so we're keeping that too but i was just thinking that you know in terms of providing that flexibility that would be amenable so that's an hour only concern is the same concern i had last time was kids biking to school and i know certain areas are off limit but off limits but kids live in all sorts of neighborhoods and there's schools and down by harpy west and i just don't want kids to have to ride into the street because someone's camping on a sidewalk and so i'm not i'm not sure what time the sun rises in the winter but i do know kids bike to school every month that school is open so i don't know if anyone has any other feedback on that i mean i'm fine with whatever the will of the council is i don't want to be the only decider on this one i'm going to ask and actually i can ask maybe martin as well i'm just curious with the warming center i know that's been operating in the city for a while and i'm just curious what their hours are because that's a program that's seen that's been pretty effective and um it seems like it's operated in neighborhoods it hasn't had very major impacts and they have people coming in at certain times when they're leaving in the morning and so i'm just wondering if we can set hours maybe similar to that of the one center um i think he's 8 a.m. to 8 or 8 p.m. to 8 a.m. i think that would be for non so you would i think we're blending two different things here are we trying to set the period of time you can begin to set up your nighttime sleeping site and take down i'm fine with an hour before sunrise i think it's a seasonal issue so martin you had your hand up which martin are you talking here martin walk into them martin bernal and then council member brown i am i had my hand up earlier just because i wanted to speak to the amendments that council member calentary johnson and i proposed and sort of really explained conceptually where they um i think need a lot of the concerns that i had in that members of the community had brought before us um but i i think what i mean i apologize but i think what i'm hearing um it's really duplicative of what we've already sort of prioritized within our amendments in the end within the main emotion so i'm sort of seeing a lot of unless i don't know how many more like i can i can wait on my comments i don't know how many more changes uh council member coming has but i'm seeing a lot of um overlap between some of these very specific things with what was already previously directed which is great because i think we're i think aligned in that way but um i'm not sure if it's appropriate for me to make my comments now in terms of some of those broader themes if we're if we're gonna go on by lines or some of these changes still all um council member brown do you have a comment on this particular item so that's a good comment i agree maybe we can so so go ahead sandy if you have a council member i actually i don't have a comment on this particular element so i'll just wait until uh we've been made it through this i have another item that i'd like to just throw in the next so we're gonna we're debating um right now a change in the um the time change which would would be would reflect and i believe um we i think maybe this was in some of your slides this morning this today earlier right do you have a recommendation for sure well i mean you know the council could do a number of things right now it's one hour before sunset to 7 a.m. is the allowance um what i heard um was maybe a desire to tie this to um the sunrise in the morning and allow some time after sunrise and then i also heard a concern about um individuals um children going to school and biking to school um i wonder if there is uh something along the lines of you know an hour after sunrise but um no later than 7 45 a.m i'm not sure what time the the earliest school starts um but just thinking of how to get to a compromise there um along those lines and it could be a half hour it could be an hour or you know um but i think that that upper limit could be established to address council member golders concerns and some additional time after sunrise could be allowed to address council member Cummings concerns i just looked it up sunrise and december 21st is 7 18 a.m and next year school is not set to start until before like 8 30 i think because of the new state law so i think an hour after sunrise or 8 a.m would be fine it sounds okay with everybody and by the way uh would be uh the storage program the worming center storage program that's open from 8 to 10 and then from 5 to 7 p.m we would still have the allowances for um safe sleeping you know those uh the safe sleeping could operate outside of those hours to address um you know the potentially incompatible use hours i'm assuming that's the intent maybe one or two that haven't been expressed yet and charges like to get those so one was um i believe that it was expressed in council member count our johnson and walkins motion uh or their language to create clear language and criteria for misdemeanor charges um and including but not limited to having an encampment larger than 12 by 12 feet that's true with litter maintain large number of dismembered bikes inside or outside tents have needles left unattended outside the tent and that's the building off of the language that um that was in our agenda report but really trying to not formalize the condition of being homeless but really focusing on the behaviors and so those are three examples i'm sure there's more um but you know really trying to get that if you're going to be sleeping outside you need to really one keep your area clean and our environment clean and the other um we're not supporting bike chop shops and bikes that period council member walkins is that is your language i think your language captures yeah our language captures that along with some of the specific things that you listed or that council member golder had listed in her original motion so that's already covered it was to create a city sponsored diversion process for misdemeanor violation of the outdoor living ordinance which i know it was mentioned that there's opportunities for community that we could create opportunities for community service if people are in counseling etc and for those um by engaging in those kinds of um services and and giving back to the community that these misdemeanors can get wiped off that record and so i think that that would be something that we could look into and i think it was recommended by staff as well and that was also in them and the amendments along with um looking at a restorative justice approach to it so that we're not further harming an individual who may have experienced um houselessness and then occurred a misdemeanor and then supporting them exactly to kind of be able to clear that so that they can find success so that's already covered as well last one um you know is i know that we've laid out like all the different zones where we can't camp and i'm just curious would it be clear to you know have language that's just you know for example prohibition prohibit unsanctioned camping on all public city property and rights of way that are required but a local state or federal law to be free of obstruction and on city property adjacent to state and federal lands when safe sleeping i know that we've laid out all the different zones but would just kind of you know when there's sites perceived available statement of prohibiting camping in all areas um that have not been um identified for safe sleeping looking at lee let me see if i can capture your you said you want to prohibit and all when there when there are spaces available in safe sleeping zones you want to prohibit camping in um all other areas in all areas of the city that are not the safe sleeping sites is that is that what you're saying so if there are spaces in the safe sleeping and managing camp and then there would be no camping elsewhere you know and we're trying to have indoor shelter and now we're trying to have overnight sleeping and we have managed encampments but we really want to encourage people to go into those services where we can connect them to the county services and where we can you know kind of get people out of some of these sensitive habitats and so it would make sense if we have those available our objective should be to get people into those spaces and not have people camping throughout the city and in places where we have identified we would prefer people aren't camping and so i'm just kind of wondering what people's thoughts are around that or and if that's something we can do i think i i'd like to uh hear tony's interpretation on that well from a from a legal perspective the martin versus voisey decision stands for the the principle that um the city cannot enforce a prohibition on camping on public property uh against a person who is homeless if they don't have a realistic alternative to sleeping on public property and so if we could demonstrate that we have um real realistic alternatives to sleeping on public property then yes a city-wide camping ban is enforceable and the key there is that a court would have to look at it and say that it's a realistic alternative so low barrier um shelter um you know ADA accessible no restrictions on admissions based on you know religious affiliation or instruction or that sort of thing so yes those that that's the key to having an enforceable city-wide camping ban is for homeless individuals who have no alternative access to shelter either because they can't pay for it or because it's not actually reasonably available to them for free um that then it's difficult to enforce but if we have those spaces available then yes we can enforce a city-wide camping ban i guess my my question for staff is i mean i don't know that we're going to ever have those number i mean i guess i'm not sure we'll ever have those number of beds so i'm just a little bit confused about so i guess if you have eight whatever it is four hundred and fifty beds i mean i i just worried that you start to get into the number of beds and are we going to be chasing i i'm just wondering about that martin maybe martin burnall you you look i give a comment yes what i was going to say is i think we don't we don't have the data to really know at this point uh because uh you know the census has approximately what is it the 800 to a thousand uh and shelter in in the city of sienna cruise we've got the uh you know the armory facility um and then we've got the hotels although some of those are not necessarily long-term because some of the funding will run out on on the the hotels of the the uh hotel program um in another county after the some of that is pandemic related funding um and then if we add safe sleeping sites the the ordinance what you've directed is 150 so whether that will be sufficient or not is we really don't know for sure it's certainly it's certainly data that we will we will be able to collect uh more of uh as the safe sleeping sites come up and and if we can direct people there that'd be the first thing to do is uh enforcement that's necessary is to direct people there um but if they're full you know we'll we'll we'll know and if they're full we need to be able to uh give them options um so i just think we just we just don't really know whether that would be ideal i think if we could direct somebody to to the site uh always um but i just don't think we have enough information at this point just following up on martin's comment just given that where we are today versus the point at which we could say that there's a reason you know there's a shelter option for every homeless person in the city of Santa Cruz um i think when and if we get close to that point um it would be perfectly appropriate for the council to consider um you know modifying the language to to make that um clear in the ordinance at that time as well okay i'm just i guess i'm just a little confused then with how like enforcement of this is going to work if i guess is the idea that we're going to create these safe sleeping sites and then if we come across individuals who are camping in unpermitted areas we're really going to just try to warn them so that they find alternative places to go um i guess i'm just kind of confused it seems like if someone is if we have beds available my understanding of what we've been trying to work towards is if there aren't beds available we want people to utilize those beds and we want to try to fill that capacity and um if there is capacity and people are refusing to go then potentially they can i mean my understanding is that they can actually be cited for not going but if we so i guess that's what i'm trying to get at with that language and we affirm that but i'm happy to not include it as well um you know but i think that's right right don't need that yeah if there's shelter of capacity and it's made available to them they can be cited uh uh what i was trying to get to is if they're full then then we have to provide an option and i guess that's that's a question we don't know whether the additional capacity is going to be added by the uh because right now that is the challenge that we have is that the current shelters are essentially full at least there's just really no possible way for example to that's the challenge that we have with the current encampments there's not enough space to offer to those individuals and so uh you know whether they i thought your question was if we added these uh additional safety sites per the ordinance and and perhaps added a manish encampment as as suggested would that put us in that position to be able to enforce uh and in the answers we don't know boulder do you have a thought on that last amendment or are you accepting maybe we just we've got one now for the time being if that's okay since we're all is that okay council member brown i think i just wanted to be able to include direction in the case of misdemeanor uh offenses and uh you know i it occurred to me i i didn't have this thought when we were just talking about the ordinance because i don't know that it's it's probably which would be part of an ordinance come up as additional staff directions i'm just wondering if we could also think about a process to uh situations where people have tickets that have been piled up and may may not be missed to be here but um you know the system for clearing those tickets i know that uh other cities have done it well la did it um oakland has done it and um i know that uh you know it's it has been helpful in uh providing you know a little bit of relief for people who are trying to you know move forward uh it's very difficult for example to you know it affects your work your employment qualifications that affects obviously your ability to um get housing and uh you know when those tickets pile up they just end up going to collections as we know and so there are uh systems that have been set up where uh people can opt to you know to try to do this but it requires that they also have you know meet certain criteria and have you know like a case manager who vouchers for them or you know i i just feel like if we're going to think about the misdemeanor uh piece of this that there's there's also this bigger issue um which i know we've it has been kind of raised from time to time but it just feels like that might be worth also thinking about as part of our restorative justice approach mayor if i if i may i'm having done restorative justice i i completely share your interest in wanting to go in this direction i think we should absolutely explore it i do think that there will be additional partnerships that we'll have to um enroll in that regard because they've already been to the court they're kind of already in the system my understanding is that what we can do at the local level is hold it and then have the restorative justice process occur and then not necessarily file on it and so there's that then there's just that's how we can do it as an intervention at the police level and i could be wrong but that's how i interpreted it but i i do follow your interest and i share your your you know your passion around wanting to go in that direction thank you yeah so i i yes i hear you and but i think there's also and i you know chief mills i don't know if you have any um anything to add here but i know we talked about it at one point um that this this would this could also be applied in cases where the tickets have just been on the books and you know and are never cleared and they are just clogging the system so that wouldn't necessarily be holding it but you know um but i i agree that um you know it needs further exploration to to move forward but i just love to see that in the conversation i share that chief did you have something to add yeah just real quickly mayor and thank you for that councilmember brown and watkins we certainly can do some research to find out um what the city attorney's office how many tickets are currently outstanding uh who they are assigned to and develop a process where we could take a look at those tickets and see what can be done to expunge them or to remove them uh from the from the system um that would take a little bit of research and we could report back to you on that you know our thought process was to make sure this process is pre arrest or pre citation diversion uh because that would actually be a cost savings for both us and the city attorney's office not having process an enormous amount of paperwork that virtually um is less than effective so we could certainly take a look at that and report back to you thank you and i think the benefit of having a program like that would also um i mean if if we were able to get people's into services um in exchange for dismissing or expunging uh citations that would still be a good deal for the city i think so that's certainly worth exploring and is that that that that's that's captured for any intent to the restorative justice language that councilmember Watkins and calentary johnson offered correct we have the language right in front of me but so essentially what we have is actively developing pursue restorative justice programs so i think it you know such as homeless court to incentivize positive behavioral change among those subject to the outer living municipal ordinance citation and or arrest so i guess you could you could potentially expand that particularly covers it as long as we have it on our checklist to follow up on okay so bonnie do you have a version that we can look at should try to take a vote on actually i just have a couple of clarifying questions um i did see a difference between the friendly amendment and councilmember golders was the date that it's supposed to be returned one said april 13th and one said march 23rd and i didn't want to be a um a jerk and put like a lot of work on the staff staff or maybe more team can say what would be doable yeah i think uh and i would also uh defer a little bit here to we since uh he and the team will be through the block of the work i think april 13th this is probably reasonable we can certainly uh kind of shoot for sooner if you prefer um but april 13th this is fine i think maybe change has happened by then is that with uh would you come over walk in everybody and then my other clarifying question was the cdc friendly friendly amendment from councilmember coming that was not accepted right councilmember golder i think you were the one who i would be more comfortable sticking with the peers and i think we changed to the language that councilmember calentary johnson provided so it reflects their their their language um and then uh mayor i had also one clarification also um with respect to uh this is to clarify just expectations on the one uh direction from uh councilmember calentary johnson about the managed encampment the not not the site is specific to the ordinance but the additional directions with respect to the i think it said staff shall uh pursue a managed encampment at 12 20 river street i think it's further up uh there it is set stand up a managed camp at 12 20 river street um again just to clarify expectations uh obviously we can pursue this i'm assuming just to be clear that this is obviously contingent on uh soliciting and finding uh both operators uh or and uh funding to be able to to pursue this yes yes we'll give you progress on the in june this is what you're expecting them exactly thank you okay great thank you did you have a question councilmember walked into anything to add i didn't i just had a few i just had a few comments but i you know i'm happy to reserve this to later before i go through the ordinance or some of the final on this yeah i'm not unless when we go through it no are we are we ready yes there was one other thing the map amendments was maybe yeah okay let me delete those yeah because instead i believe we're going to direct that a map basically well a map will will result because we're now going to define people places where people can be correctly those those provisions i think may have been needed could you pop those back up there funny i'm just curious yeah so those provisions might be need they are needed in order to um identify the affirmative places i think they may actually be redundant but um rather than checking for their redundancy because i think um farther down in the motion it also lists those um but we can um we can adjust that accordingly um when we come back and i do have um but i'll mention since we're talking about the map i do have a map that i um threw together a rough map i will say it shows um what i believe to be the affirmative areas that the council is um looking at right now so i can share that with you if you'd like to see it um yeah let's take a look at that okay bonnie can you stop your screen share for a moment but these are just polygons that i threw together you know at a high level showing um the commercial and industrial areas so these white blocks here are areas that would be under consideration that that removes the open space areas um and focuses just on the industrial and commercial areas you can see some interspersed but mostly along the corridors harry west and the far west side but the no daytime camping um component is in effect at least until until a lot of the other things i mean not immediately but according to covet and other those other things right following either yeah the uh community sometimes when okay hell of tear or um tbc guideline changes tony what the most efficient way for us to go through the motion is it line by line or do we can we adopt it as a meant with the um the intent of the i think is that the council has by consensus framed the motion that's in front of you right here unlike um making these changes to the ordinance as part of a first reading you know we still need to go back through the ordinance and translate this into the text of the ordinance so i don't think you need to go line by line through this because we're going to have to work with this to bring back a red line for you when we bring it back okay so are we adopting we there are these amendments to the original ordinance so we are adopting the ordinance tonight and then um and then directing staff to come back with these amendments as the first as the first reading that's that's how i read the language okay i just want to make sure sorry what can you repeat so we're adopting the ordinance that was introduced last time and directing amendments to come forward yeah that's okay do you want me to scroll through these or tony do we need to go to reach in every one or i think bonnie just scrolls down through it okay um and anyone can say stop if you need to catch up saw something that said orange and then something that said yellow for the tears sorry to interrupt and think it says yellow down here and it said orange up higher i don't know if i'm wrong this is a copy and paste so i don't go up a little bit further i think i might have seen the same thing right there here is yeah and then it says yellow down there at number five maybe just erase that thing i think this was from calentary johnson and what kind of friendly amendment so i'm sure what i don't know which one is it orange or the yellow erase the orange right i believe yeah exactly did you say erase the orange erase the orange i make it yellow i think it says here yeah um number five right there so it's a yellow and cdc guidelines whichever occurs first so that's the language yeah the one above um bonnie i think goes away all together this one all of it all of it and i don't know that language comes back later but i know that it was mentioned at the top and so language around the maps was included top so i just wanted to read ours we're going through this what what's the language the language was to oh i did have that somewhere yeah i think it was part of what um counselor walkins and i might have proposed i think it's like number one under what we proposed there's one date that says march night i wonder if we could that was acknowledging that that the county had taken action on march night got it okay okay i forgot did we decide to erase the 25 or 75 feet from the trail yeah we did down below bonnie i think she actually wrote strike above it above it oh yeah the whole thing right yeah sorry bonnie i didn't she didn't said strike last try i read that this is this is my note taking duplicates did you put that other part there about contacting like social workers or and cps if there's kids can see right there now you know yeah maybe we want to i don't know if we need to but just acknowledging that the county had already really set forth priority for families for their sheltering and rapid rehousing so i don't know how that fits i mean maybe it fits into the continuum of care but i just want to acknowledge that that's a priority if i could speak to that i think part of that would stop showing so working with the county and the state and so state agencies i think that includes all the above child protective services you know whatever is necessary to have in those conversations but so just to confirm that would mean i don't need to specify cps is that what you mean by that well the county cps is actually a county function so yeah well the only thing i think is that i have concern that let's say in sheltered and the parents don't want to go to the managed encampment or don't want the shelter but the child through no fault of their arm is now homeless and they're the outreach workers the social workers are offering it and they don't want to take it and let's say these kids are not in school or not if cps isn't involved then there's no one there to specifically advocate for the children and their welfare and so i really i think we can yeah no i follow you i think we can add it and i just i think that also those guys those folks are generally mandated reporters so if they're observing what you're describing then they're required by the law to actually report it to cps to at least open an investigation yeah because it's like as a mandated reporter sometimes i have to report it's not my place to judge it's not my place to just report and they really do an excellent job of educating for what's best for kids absolutely so i'm happy to say and yeah i think we can definitely can i get some language so work with the county including you know child protective services generically covers it can you please email the current language it is the end but um i didn't know what we landed on here but in the winter the sunrise is at 7 19 and since schools aren't coming back till 8 30 that was um that was okay so long as it was i think before 8 a.m is what she mentioned or before 8 a.m but no later than 8 a.m okay thank you bonnie lower my hand can i just make a few brief comments with one suggestion and then i'll lower my hand yeah no go ahead i just wanted to do i wanted to make sure we got through this before i did but um i'll just say it sort of in general i don't want to keep everybody any later than we need to be here but i just want to say thank you for all of your work and attention to the details of this and really expand our gratitude to the city staff but also the community members who spoke up and shared their concerns with the specific aspects of the ordinance and as you can see that um the issue is complicated and the ordinance is complicated as well and i feel really i feel really good in the direction that we're going in and the clarifications that we've made this evening is particularly around the misdemeanor the families um around identifying the locations the sensitive areas in our community around some of the accountability metrics um but also having just really observed a lot of conversations this is really big for our community this is actually this is a big step in a direction to provide a lot more um services and resources and that's a really big deal for a lot of unhoused individuals here in our community um and those impacted and i wonder and then i'll leave with just the brief suggestion and i wonder if when we're thinking about communication strategies if we can have some sort of quick kind of like fact sheet of what what this looks like so that the community is really aware of um some of these nuances and um it just it just you know um adequately communicated to the community all that this entails and i know it can be forthcoming and iterative but um some sort of you know clarifying document i think would be beneficial to the community because i heard a lot of misinformation this evening as well thank you uh council member brown and then council member Cummings and then i'd like to if we can take a vote comment i've already given my uh comments on multiple occasions about uh the kind of the ethics and efficacy concerns that i have uh with moving in this direction i just want to say you know um council member Watkins you said earlier that um and others kind of alluded that um we have we need to be in action and i totally agree i um you know i've been hoping for some action for a long time now on this issue um but you know i also think that there you know there are other actions that we can and should be taking i'm glad to see that uh safe sleeping programs and managed encampment uh you know possibilities are now on the table and i totally support that um you know i i i would have loved to see that happen uh sooner and um you know and and now i think you know we just are where we are uh i you know i think that investment in those kinds of programs is going to be a much more effective way to provide relief for uh you know our community both housed and unhoused um then you know investing money in uh defending uh the lawsuits that i believe are are coming and so i'll just you know and i think that that in partnership with community and faith-based organizations this could actually be a much more affordable than the cost that we've seen um you know the projections so um i guess i'll just i'll leave it there um you know i'm i'm pleased about some of the changes that are being made and and yet i cannot support uh moving forward in in this direction at this time help the member coming thank you i have um one comment to make i think that the second to last the probability of camping in all areas and say they're not safe sleeping sites i don't think that was accepted and so i think that should be stricken and then um glonnie if you could scroll back the top ones you've removed that i did have to see if we can separate i didn't see that part of the motion tonight was to adopt what's currently before um and so i would like to see if we can separate the motion because i'm supportive of the changes that we've provided and the direction to move back to bring us back um on april 13th however i'm not i'm not supportive of adopting what's before us and i also have a question for the city attorney um regarding um that action so at the last meeting i think even before the meeting started there were uh changes that had been suggested to by staff um were not included in the packet and then the council went and made so significant changes to the language that was before us at the last meeting and having had discussions with other members um of the public uh one of i think a lot of people would see what's before us tonight is a first reading rather than the second reading and it wasn't published as a second reading and so i'm wondering legally can the uh council adopt um the ordinance was before us tonight since it wasn't publicly advertised as a second reading and given the substantial amount of changes that we made the last meeting it was my my understanding and obviously we've only been doing this for two and a half years now but my understanding is that it should come to us as a first reading and so i'm wondering if you can speak to the the uh recommended action is consider adoption of a mint of ordinance 21-03 amending chapter 636 of the code and consider potential modifications as part of the current ordinance as drafted or as part of subsequent amendments so i do see this as uh teed up for adoption tonight if that's the direction of the council and i'm familiar with arguments that were made that um somehow staff recommending that the council consider additional changes before it was introduced at the last meeting and then the council making additional changes before it was introduced somehow um was improper or was even a brown act violation and i just don't buy that um the council has the ability to make changes to an ordinance before its introduction then it's published in and um in and the charter says that you can't finally adopt it until at least five days after it's introduced for publication so i i don't see any procedural impediment to the council taking final action tonight i would like to make a comment about one thing that i i guess i missed during the discussion of the amendments um incorporating the recommendations from council members Watkins and callant sorry johnson um and if this is not the appropriate time i can i can defer that but um yeah i don't see a problem with the council taking action tonight as a second reading tony just for clarity okay tony you want to go ahead and just if and then i'll go back to council member coming if there's something that we need to clean up is uh yeah so yeah if i could just very briefly the original language that was proposed by the the initial maker of the motion council member golder was that the city staff shall not implement enforcement until amendments are made and the cdc covid tier is orange and the council by consensus changed the orange to uh yellow i got that but what i did not realize is that the amended language only refers to the daytime restrictions and there are a lot of new prohibitions in the ordinance i think it just makes more sense if it just if the language stays as initially proposed by council member golder to say that implementation will not occur until uh the cdc guidance changes or we enter the yellow tier so just throw that out there this one right here right yeah that makes sense tony to um take out the daytime restriction and and have implementation thank you for pointing that out thank you all right and so just just to be clear the language that was proposed is that implementation shall not occur until amendments are made and the cdc covid tier is yellow so also the amendments are part of that did you say yellow yellow yes that's what that's what i understand this should be yellow okay yeah i really appreciate i'm sorry mayor i it's okay i just really appreciate you clarifying that because they are really in tandem right in terms of the adoption really is contingent on us also moving forward these amendments before actual implementation occurs so by adopting tonight is also acknowledging that these amendments have to occur before it's ultimately implemented but keeps us moving in a direction of action i guess yeah well i have to admit at this late hour um i probably would have overlooked that if kassie hadn't been giving me a nudge uh text messages thank you kassie that's coming this language will all come back to the k a new ordinance that makes these amendments to the ordinance that the council would be adopting tonight sorry i should have been clear with that statement the language that was just used will be no implementation until the amendments until its amendment amended right are we're in the yellow tier right is that language a part of the ordinance or is that language separately from the ordinance and applying to um the kind of first motion and the reason why i ask this is because if that language is incorporated into the um the language that's supposed to come back to us that means it's not going to be included in the language that will be adopted should the ordinance so it should just be considered second reading and adopted that language my understanding would not be included the language you're right the language will not be in the ordinance itself it will be in the motion however the says and you know this is the order in which it's it's presented which is you know it's complicated but essentially says pass the ordinance for adoption tonight direct the staff as follows return with an amendment to the ordinance with all of these changes and among other things defer it implementation of the ordinance until the amendments are made and the covid restrictions are lifted or we enter the yellow team so it's additional direction on top of the adoption of the ordinance just as it is direction to come back with an amendment to the ordinance at a future meeting with the language on the 13th and then it wouldn't be included in terms of the um second reading yeah essentially saying that there will be no rollout until the council makes amendments as per the direction that you're giving tonight okay all just my my final comments which would be that everybody's time and hard work on all this and all the changes that were made um i'm not comfortable supporting the um the make the amendments i feel like and then i guess this is a question they'll come back to us again for a second reading we'll then have to wait 30 days again correct before it will take nothing's gonna probably so well late may right thank you everyone for all your comments lee i see you have your hand up yes if you can go back bonnie to number five um that we were just working on city staff shall not implement enforcement until amendments are made and um either cdc guidelines change or covet here is yellow i think that was the intent correct or i caught that behind the scenes thanks laura yes whichever is dinner yes bonnie all um for a roll call vote second reading now we're voting on the adoption of the ordinance introduced last meeting and there will be a second vote for the amendment yes right tony can you one more time explain the time the timing of this either option i'm not quite sure i understand your question what's there the adoption of the second reading the adoption of the second reading would would take effect 30 days from from final adoption tonight however the direction that would be given should the council adopt the second part of the motion which is next would be to defer its implementation until the council has amended the ordinance uh consistent with the follow-up direction with all of these elements that we've been discussing and and uh or until cdc guidance has changed or we enter the yellow tier it sounds like so that makes it that the 30 days is kind of out the window well that's yeah i won't be in effect in 30 days but i will just say that um you know um i won't say that city city council legislative time is like geologic time but it's it's a lot slower than uh regular time and so if we had something in place in 45 or 60 days i still think that would be a big step forward for the council i'm sorry no please go ahead place mayor and then the other um scenario is that this goes back as a first reading you were you were saying and then that process starts over again yeah you can't you couldn't even do a first reading on this tonight because we would we would spend the next four hours trying to figure out how to how to to convert this motion language into the actual text of the ordinance so at a very minimum um we would have to bring back the ordinance for introduction at a subsequent meeting or unless you wanted to stay here all night and hammer out the all of you thank you so my vote is i and mayor meyer my vote is i so that motion passes with five let me grab my i got this right all right everybody give me the language that i need to so the motion passes with five yeah with five to two councilmember brown no to vote on the next that's right as the amendments yeah i think the second part of the motion is to um the phone the direction set forth in the in the text okay okay the motion is direct staff to return by april 13 2021 with an amended ordinance to include the following and we've reviewed all of those right the additional staff direction that's contained in the written motion okay do folks have questions on this like lots of hands up there was just one bit that was missing whichever comes sooner for phrase number five but i think bonnie you just added that yes that'd be perfect okay lee did you have a comment on this no i think everything was captured okay and councilmember coming i actually have a pretty major concern so if you can scroll down to that language to number five the i interpret this is that if because looking at the calendar it looks like april 13th is more than i mean we continue at the rate that we're at we could end up in yellow before like they said they did not want to see how we're living in so not implement enforcement until amendments are made and either cdc guidelines change or the covid tier is yellow so the guidelines can change the covid tier can can turn to yellow but the amendments are made in addition to that so one does not preclude the other adopting what we did tonight we're sort of acknowledging that we're not going to go into the details of it but we're not going to enforce it or have it be applied until these amendments are made so we're you know essentially process life saving time okay thanks for my clarification um councilmember coming as if it is helpful it says when they're made and yeah yeah instead yeah and not or i want to just make sure that was clear but i'm not having it before me i'm concerned so glad we were able to earlier did you have a question i had another clarifying question i think um it would be helpful to maybe state what when this comes back these amendments will there be an opportunity for public comment input and that prop what does that process look like so that everybody's clear it's a complete do over so yes there will be opportunities for public comment both uh assuming that it's introduced on the 13th and then when it comes back for final adoption just as just as we've gone through over the past to me so that's great i think there's a lot that happened tonight and so i think um that that's great to clarify thank you okay so bonnie i will um uh ask you for a roll call vote welcome for what can i voting yes and um one voting no uh councilmember brown voting no and i believe we almost beat our record from last two weeks ago but not quite anything else um let me look at our i believe we are officially adjourned just want to thank everybody for hanging in there and um vice mayor bruner did you have another comment no okay well we are officially adjourned and thank you everyone and we'll see you soon good night everyone thank you


Hello all. Welcome. Good afternoon. I'm Krishna Rajesh. I'm a senior architect with IBM, along with Brandon Kelly. Today, we're going to talk about our proposal to fight back against cyber risk in software supply chain with a secure and compliant DevSecOps pipeline for regulated environments. Here's the Roger and Duffer today. What is cyber risk? And how does it affect the software supply chain? What is the current regulated environment landscape and what are the regulatory requirements? What is DevSecOps and how can it combat cyber risk? We'll talk about continuous integration, continuous delivery, deployment, and something new, continuous compliance. And we'll do a case study on buying where we implemented our DevSecOps practices. Let's get started. Cyber risks. Cyber risks can bring down the infrastructure of an organization and can damage its reputation and can cause financial loss. Software supply chain security is often neglected. We always talk about observability, monitoring, alerting, et cetera. But remember, prevention is far better than cure. Identified potential risk before it even reached production. Government predicts that by 2025, 45% of organizations worldwide will have experienced attacks on their software supply chain. That is a third-fold increase from 2021. 4.35 million is the global average cost of data breach. How can we make sure our software supply chains, software suppliers, and IOSVs, independent software vendors we work with, demonstrate the best security practices to minimize these security risks? Regulator environments face unprecedented risk from multiple vectors. Software supply chain attacks like Okta, SolarWinds, which everybody know. Open source security vulnerabilities. Compromise dependencies. Need for rapid development, potential to bypass critical CI-CD systems. Increasing complexity in IT security and automation tools like CI-CD systems. Compliance and audit readiness is really hard to maintain. Auditable change lock. Our goal here is to build an automated system that's secure against these risks with less complexity. We have to prevent new vulnerabilities from reaching production. Ensure frequent updates to production with quality and control. At the same time, collect evidence for handling security audits, still tracking issues and documenting changes and even reporting. So what are supply chain risks? Here is an illustration which stores different stages in a deployment. You can see there are different stages like development, source code management, build step, packaging, and deploying onto dev and production itself. So let's get started with development. What are the risks here? Developer can push vulnerable code into your SCM. Now SCM, source code management tools like GitHub itself can be compromised. If you remember the case with Octa, their GitHub repository was hacked and malicious code were inserted. In the build step, the build container platform can be compromised. What if hackers can get into the API keys of your DevOps tools? Probably a cloud DevOps tools and can access your source code. Now the next step is package repo. Package repos like container registries can be compromised. This is especially the case if your container registry is a public registry. And eventually this container compromised images can get onto your development environment and onto your production itself. So any stage of this delivery pipeline can be compromised. Now what if you also, for example, you tested everything, deployed onto your development and then onto production and then eventually new wall levelities are identified? How will you know that? How will you continuously scan your code for continuous security and compliance? So these are the questions we are trying to solve. Let me now invite Brandon Kelly to talk about our DevSecor pipelines in detail. Brandon? Thank you very much Krishna. So you have described the problem and now let me describe, I suppose the solution that we have devised to combat the risk in the software supply chain. So our pipeline or tool chain consists of three separate pipelines, continuous integration, continuous deployment and continuous compliance. So I'm just going to talk about the principles of this pipeline before talking about the specific elements of it. So first off, absolutely everything is defined as code. The infrastructure the application runs on is code. The pipeline itself is defined as code. Even the deployment is code and the new components to the system that makes it so special, the compliance, the continuous compliance is based on code as well. This is to make it as manageable and reusable as possible. We aim to make this as broad as possible so we support multiple development languages. We ourselves have tested Java, Node.js, Python and Terraform infrastructure as code on this pipeline. Somebody else in our team has also tested Golang but to be honest, it's a custom framework that's extremely extensible so it can actually provide for any language whatsoever. We define a consistent approach for any application. So for example, you have Java and you have Node.js, they both have their own unit testing frameworks, they have both have their own vulnerability scanners and they are both implemented in that way but we intend for this to be a consistent approach. They all go through the same types of tests even if they're defined differently. And we also have shared pipeline templates to allow for this. Now let me explain DevSecOps a little bit for those that aren't familiar with it. So DevOps is a combination of development and operations to make a more consistent, more efficient, more fast system for developing and deploying applications. DevSecOps introduces security into the mix. What we do is we shift the security left by finding security problems as soon as possible before they reach production environments. Ideally, and you'll see this in some of our pipelines, before it even enters the main branch of a code base. So in the pull request stage we might be able to find some problems. Now security in application development is usually found to be an impediment to developers. They find that it slows them down, that there's some rigorous requirements that is very painful. We aim to make this DevSecOps process as painless as possible while maintaining the rapid application development processes you all know and love at this point. Security, I'm not going to short-record this, it is a challenge. There is a lack of knowledge in application teams about the deep security problems that are in infrastructure at the moment. The cloud has made things quite difficult in that sense. We also need to be able, especially as our presentation here is about regulated environments such as banking and finance. Auditing is a massive, massive problem. I've gone through this a couple of times. I'm sure some of you have as well. It's a massive manual. I first huge expense to it and it's extremely painful. As you'll see in the coming slides, we have developed some solutions to mitigate the auditing problem. And also, I've discussed this already, the continuous compliance pipelines. We aim to detect new vulnerabilities, zero-day bugs, as soon as they're reported to databases such as SNCC and the CVE database. And we also aim to look for potentially troublesome configuration changes or malicious code additions directly to infrastructure. This is built upon open-source tooling. We'll be happy to hear in the Linux Foundation. It is built upon Tecton as the pipeline runner itself and plenty of our tools, processes, and formats are open-source too, including SonarCube, the Wasp's app, the CIS benchmarks and our software build materials, the key component of our pipeline is based on the open-source Wasp Cyclone DX formats. So naturally, I'm going to start with the continuous integration stage. For those unfamiliar with the concept, is the application build stage where you build your code, maybe run some unit tests on it, package it into a container and store it in a registry for use later on. So the general flow of our pipeline is quite similar to most continuous integration systems. We unit test, we build, do some dynamic scans. So I'm going to focus more on the specific features of our pipeline system that make it so special and make it what it is. It has robust code review and branch protection checks. So your code must be reviewed by another member of your team or maybe higher up, depending on what you want. And you are also not allowed to push your code directly to a main branch without going through our CI pipeline. The pipeline itself can detect if your branch protection is enabled. We have a series of vulnerability scans, such as static code scans through SonarCube. Dynamic codes and application scans through OASP's app to determine if there's any application vulnerabilities while it is running. We have dependency checks to see if your open source packages or even your private packages have any problems reported to them. We have base image and built image scanners as well. And as mentioned, I also use the CIS benchmarks on our code, on our application. Secret detection is to determine if someone has accidentally or deliberately put in credentials or passwords into their code where it could be easily found by anyone and we don't allow that. But the more interesting part's coming out. In our continuous integration pipeline, we have signed built artifacts. This is enforced in the continuous deployment stage, which I will show in a few minutes to verify the provenance and origin of components and microservices of an application. This provenance includes the signed hash based on a GPG key. We have scopio integration for containers and we also provide for third-party sign-in services. This signed build artifact also links back to the very ID of the specific pipeline one that created the artifact. So that further verifies the provenance of where this artifact came from for auditing purposes and just for general security as well. I've mentioned the software build materials. This is extremely important for securing a software supply chain. What it is, is it's just a document that lists all of your application packages, all of your dependencies, and also all of your, for say a container, it will be all of your operating system packages as well that have to be installed for your application to run. The software build materials also includes open source licenses too, and the regulated environments can be quite strict on which licenses you can use, such as Apache. So the scanner can be configured to check for those if necessary. Now, I'm going to stress audit readiness again, because it's very, very important to how this pipeline works. It's one of the most powerful part of the tool chains. So in order to make audits as easy and painless as possible, we constantly gather evidence in the pipeline run that certain tasks have been run, all of the tasks, in fact, all of the unit tests, all of the vulnerability scans, all of the vulnerabilities that may be detected. This evidence will link straight back to the artifact and the pipeline run, and any gate issues that may be automatically created by the pipeline in the course of this, in case any vulnerabilities are detected. We then store that evidence in both gates for developer reasons, so that they can read us and use it, but because that's not very secure and we want to maintain the security of this evidence, we also store it in the mutable cloud object storage buckets. And finally, we build the release inventory. I'm going to explain this in detail in just one minute, but for now, just think of it as a list of components of an application, such as all of the microservices that make an application, deployment files for Kubernetes, Helm-Jaritz, any configuration for an application, et cetera. This is all referenced in the inventory. We think it's back to the signatures, back to where the artifact is stored, et cetera. And now we're going to move on to the continuous delivery or deployment stage. Again, I'm just going to do a brief explanation of what that is. This is where we deploy the application onto, for example, Kubernetes cluster. So back to that release inventory. It's got all the list of the applications, all of the microservices and the problems of each of those services to be deployed. But it's actually quite a bit more than that. First off, it can detect if there are changes in this. So if those applications are already deployed, it will not go any further. There's no need. It's also our implementation of a full GitOps-based release system. GitOps is that it's the management of both infrastructure and application configuration that using Git repos as a source of truth. So Git branches in that inventory represent each environment you may be using, such as QA, such as stage and finally production. By using this inventory, we can quite easily track which application versions are deployed in each environment and all of the configuration that it does. So we use some, sometimes we use deployment files. Sometimes we use Helm charts, which is referenced from that inventory back to a Helm chart registry. Regulatory environments almost always require a powerful change management system to be in use when you're making any changes to a production environment in a banking or financial system. So what we have done is we have implemented this using Git issues. It is either completely automated in continuous deployment or it could require manual oversight that would be continuous delivery. And that depends on your application, depends on your system, it's completely configurable. So for this area, we're gonna focus on an automated deployment. What happens is the change management system will perform a deployment readiness calculation based on the evidence gathered up by this continuous integration and the continuous deployment pipeline. If there has been a vulnerability in your dependencies or in your code itself, it hasn't been exempted by the security team or by your manager. However, you want to decide to configure that or if the scan failed to complete or maybe if the evidence doesn't match expected values that would be evidence of tampering. We actually secure our evidence using SHA-256 hashes. So if that were to change the hash wouldn't match in the deployment pipeline and it will fail. The readiness would then be deemed to be false and manual approval is required through an emergency deployment mechanism if you really do want to deploy the application with a vulnerability intact. Otherwise it's deployed automatically and completed. What our change management system also includes is an aggregate of all the evidence gathered so far and also the software bill of materials. And as mentioned, it's designed to build artifacts from the continuous integration pipeline. We also have the GPT key in the deployment pipeline so it's able to determine the veracity of that signature and further ensures the provenance on the artifact itself. This is a very flexible continuous deployment system. We ourselves have deployed to Kubernetes to Red Hat OpenShift to satellite locations and it is capable of deploying to mainframes, virtual server instances and has integration with stuff like other CI tools like Ergo CD. So this is just a diagram of the process so far. So typically a developer will create a pull request with their code changes and this is where shift depth comes into us. Before it even enters the main branch of code, we do some of our tests. We do secret detection. We do unit tests and we do vulnerability scans on your dependencies and your packages. If all of that goes well, it enters the build stage of the pipeline in the main branch where we do some of the same tests just to make sure and we expand upon that with the software build materials generation. Dependency vulnerability scans, static code scans, license checks, branch protections and then we'd actually in the CI stage we would actually deploy the application to a development cluster. It might just be your own microservice. It probably isn't going to be your entire application at this point and we will perform scans like OSP's app to see if there's any port vulnerabilities, network problems or stuff that's very powerful in doing that. All going well, all of that will go into the inventory at which point the continuous deployment automatically picks up a change on that and starts deploying. What we do is we then check those artifact signatures. We go into the change management system that I mentioned in the last slide. Assuming all of well, we deploy the artifacts, we run some acceptance tests to ensure everything is running properly and we then update the change request to say that everything is deployed successfully and the change request is enclosed. As you can see, both the CI pipeline and the CI CD pipeline are constantly feeding evidence into that evidence locker, both gist and cloud object storage for audit use. Now this diagram is a little bit different. I've replaced the CD pipeline with a continuous compliance pipeline. This is the piece in my opinion that delivers the most value in our system and is the most unique part of our system. So I'll show it on the diagram. We have very, very similar stages to the CI pipeline. We don't need to do absolutely everything again because it doesn't have access to source code. But it does recompute the bill and materials to ensure that it is exactly the same as expected in case any packages or code would have been surreptuously added to a system, maliciously potentially. We do the vulnerability scans again. Why again? Because you may have entered your code, you may have deployed your code, your application to a system, and there were no vulnerabilities, but zero day bugs exist. New SNCC and CPE vulnerabilities are added every day. So when we run the continuous compliance pipeline, it will actually detect those vulnerabilities and report them back as soon as they are known to the wider community. This is to ensure that no new vulnerability is detected since deployment. And this is for all dependencies, for packages, for native code that you have written. We also have a solid vulnerability exemption system. So maintaining compliance with various regulations and rules in the financial sector, means staying on top of these exemptions. I know it's not feasible to always fix vulnerabilities as soon as they are detected. This finance system does not work that fast and the applications are far too complicated for that. So we do allow for exemptions, assuming it goes through the proper chain of command, but a security team has looked at it. And we have designed this pipeline in order to not allow developers to add their own exemptions if you desired because they don't always know. And it's probably best in a financial environment, but the security team would look over these vulnerabilities and determine the risk of those vulnerabilities entering the system or not. So this guarantees that all artifacts and their dependencies are periodically scanned for vulnerabilities and failures and it can be set up to run typically daily, but you can run this as often as you want. And just going back to this bit here, this is a work in progress, but we have some small work in this. It works a little bit. We have an automated remediation system. So for certain vulnerabilities, if the system can fix them, it will actually create an automated pull request back to the call base, fixing those vulnerabilities. And by, for example, looking at a CVE, there's generally a recommended fix for a package. So it will update that package and any required packages in, for example, an npm package.json and push that back as a pull request. The developer will then test that code and it will go through the same system again, just like that. So at this point, I'm actually gonna hand it back to Krishna and he's going to explain a case study on how we actually applied this tool chain. Thank you, Brandon. So as Brandon mentioned, this is not just another DevSecOps tool chain, either key differentiator being immutable evidence locker. And we have central inventory repository. On the main thing, we have continuous compliance which continuously scans you to your code and your deployments on a regular basis and reports if new risks are identified. Security's top priority for us and while designing this DevSecOps new process. Now let's talk about the case study on Byne where we implemented this DevSecOps process. Let me introduce Byne, if you do not know about Byne. Byne is a banking industry architectural network. You can go to Byne.org to know more about it. Byne is a collaborative not-for-profit ecosystem formed by leading banks, technology providers, consultants, and academics from all over the globe. It was created to establish, promote, and provide a common framework for banking interoperability. And Byne-Colas initiative is to solve the challenges presented by legacy core infrastructure, hence the name Colas, initially by developing API-based microservices, covering consumer payments, customer offers, and consumer loans. The project in this case study is Colas V2 scenario. We are also working on V3 at the moment. So in this V2 scenario, a consumer procures a loan tailored for her needs through a safe and secure online channel offered by a bank. The bank application employs an ecosystem of partner applications interoperating on the Byne architecture to deliver this service. Here's the Byne architectural diagram. You can see that there are multiple SDs, service domains, where multiple ISPs, independent software vendors interoperating. The different service domain, for example, are consumer loan, customer credit rating, customer offer process, each developed by an independent software vendor. And sometimes even running on, in this case, SAPN is running on Azure, thought machine is running on AWS, but still integrated with IBM Cloud. And here's the Byne pipeline flow using our CI-CD process. Byne V2 was deployed in IBM Cloud for Financial Services using this DevOps pipeline. Application codes are kept on a central git repository, as you can see on the left-hand side of the screen. And the CI-CD and CC tool chains will pull and deploy them accordingly. Each application has its own CI pipeline and will be triggered by a code change in the report. Now all these pipelines update the central inventory report, which record details of artifacts that are built by the CI tool chain. A single CD tool chain, you can see in the center, will be triggered for the production deployments after successful promotion pipeline pull request. This promotion pull request merges the inventory main branch into specific branch, for example, dev branch, production branch, et cetera. This can be entirely automated or for production environments in particular can allow for manual intervention. Continuous compliance, you can see on the right-hand side, ensures that the deployed artifacts and their source repository always secure and compliant and can be scheduled to run on any time frame. So what are the lessons learned in Byne? Leverage continuous compliance to assess your compliance level, detect vulnerabilities and track them. Look to eliminate vulnerabilities as much as you can. You can of course add exemptions for non-critical issues if you have to. Combine deployment tool chains. Use inventory to deploy each microservices. The most important thing is you have to execute your software vendors, ISPs, to use some kind of continuous compliance. So we have to make sure every package getting deployed onto our production environment is vulnerable free. Reusability, you shared libraries if possible. Combine CI to chains of similar applications. In our case, we have multiple Java applications and each of these Java application will refer to one central config inventory. So we have all our scripts kept in our central config inventory. One for Java, one for Python, et cetera. Our DevSecOps CLI is Coco CLI is used by our pipelines to create inventory change requests, evidence, et cetera. We can also use the same core Coco CLI with other systems like Jenkins, GitLab, et cetera. This allows incremental adoption of DevSecOps pipelines for legacy applications. So you can reduce your cyber risk by improving your pipelines with DevSecOps capabilities like having a reliable and reputable automation. Everything as code. Shift left, mitigate security risks as early as possible in your pipeline. Start with continuous compliance, that is very important. Maintain compliance throughout by continually scanning your code and your deployments. Make sure to gather and store your evidence in an evidence locker. Improve your tool chain further, add new functionalities, learn more about DevSecOps capabilities and tools such as Coco, scanning tools like open source, OVAS, vulnerability detection, rehabilitation, compliance mechanisms, et cetera. Join us for a detailed session at IBM Boot tomorrow where you can get more details about our CICD process. Thank you very much everyone. Yeah, thank you everyone. I don't know if you have time for questions. I think that's up to, yeah. So yeah, sure.  You guys are talking a lot about vulnerabilities, yeah, about code, but compliance is not also about code, it's also about following regulation and following rules that you have to comply. And you have also gathered some evidence that you follow the rules. And you have to provide it to the governments or other companies. How do you guys achieve that also in continuous compliance? Okay, I can answer that. So we are currently developing policies, code integrations with this, such as Pulumi and HashiCorp Sentinel. But it's more, we have other options as well. So you mentioned governance and we need to maintain compliance with some of those policies, for example. What we would do in that case is you can do a custom piece of evidence to if you have a tool to determine, such as again Pulumi or HashiCorp Sentinel for your infrastructure, there are other systems for application code as well that they are following governance policies and stuff. You can write a custom piece of evidence to write into your evidence locker and when the government comes around to audit your system, audit your code, that will be in your evidence locker ready for them to see. I hope that answers your question. Thank you. Sorry, let me have my microphone first. Is this an official project that we can use? Well, our specific implementation is based on IBM Cloud, but I do believe that the co-co-collects, the air command line tool is open source and you can use that to start gathering your evidence in your own CI systems and also building your inventory. So all of the building blocks are available in that. I do believe the actual IBM booth, you can see actually a demo, very interesting. Oh, sorry, I think this guy was first, yeah. Yeah, for the... Ah, okay, we actually do have a system for this, is unfortunately not open source. It's called the IBM Security and Compliance Center. What we do with that is we have profiles set up to check the pipelines themselves. I think it's called IBM Cloud Security Best Practices. And what it does is it checks the pipelines themselves for evidence of if they can run unit tests or if they do run unit tests, if they are locked down for open access so that they are property access controlled that I've mentioned the unit tests that all the scans are completed that branch protection is enabled in all your Git repos. So that would manage the pipelines themselves in that case. And the product he's talking about, we can't save the product name. Obviously it has a dashboard where you can view all the vulnerabilities of all the pipelines in that, in one single dashboard. I already mentioned it. Any more? Or I think we can wrap this up. Any more questions? Okay, I think we'll wrap this up. Thank you very much. Thanks everyone. Thank you very much. Thank you.