Cutting Edge and today the edge cuts in Bang Prabang, which is what the capital or a big city in Laos, and that's where Marco Mangelsdorf is learning about energy and life in the world and Southeast Asia. Hi Marco. So nice to talk to you at great distance this way Well indeed and sub ID from Luang Prabang, which is a town of about 50,000 remarkably close in population to my hometown of Hilo right along the Mekong River in northern Laos before the Mekong continues its its epic journey all the way down past Saigon and into the Mekong River Delta emptying off into the East Sea. So great pleasure to be with you. Yes, but why? Why are you there? It sounds pretty remote to me Let me say it again one Prabang. I get that right Luang with an L Luang Prabang, which translates from the Lao language into Big Buddha Okay So why? That's a great question and two reasons the biggest one being you know, I was a big fan I am a big fan of one Anthony Bourdain. You've heard of Anthony I'm also a big fan of Anthony Bourdain. Yes, and you know what you remind me of him actually Marco Well, that's pretty mean incredible August company my friend Jay, I really appreciate that and and you know, he was someone who To me was who was living his dream and living very authentically and He did a couple of pieces on Laos one most recently back in 2016 I believe it was and I was so captivated by it and he visited Luang Prabang along with the capital I believe VN 10 and I was so taken by it I just was drawn to come and see here myself. So Bourdain was a big part of that and In Barack Obama's last year in his presidency He visited a number of countries in this region including Vietnam and and Laos He was the first president in fact ever visit Laos and he visited Luang Prabang With his entourage went on a tour met with some locals had a had a fresh coconut Water ready for him by one of the street vendors and I Thought well if it's good enough for Tony Bourdain and good enough for Barack Obama Then I'm sure Luang Prabang would be good enough for me. So those are the immediate reasons that drew me here The reason I've come now again for a longer period is I am researching a new university course that I am Seeking to put together looking at energy security politics and the environment along the Mekong which is Proving to be incredibly rich undertaking and very very Interesting so that's a long answer to your short question. Okay, great But let me let me go a step further and ask what have you learned about the Mekong? What have you learned about energy? Well, what are the profundities that have presented to you that have been presented to you? Oh Gosh, how many hours do we have Jay? I'd say I'm visiting all five all five countries in what's called the sub Mekong or lower Mekong region, which is Laos Cambodia, Myanmar, Vietnam and Thailand. I'll be going to Myanmar in a few days for a handful of days meeting people there What I'm learning so far I'm focusing on Laos first and that is that the importance of the Mekong to the people of this country both in terms of power production because there are many dams in the works that will go either on the Mekong or on tributary rivers feeding into the Mekong and these dams are allowing so far allows to be a producer of surplus power Which sells to its neighbors principally Vietnam and Thailand with some going to China that allows allows to use Exported hydro power to be its principal source of export earnings So they are a landlocked country. They do not have oil. They do not have net gas They do not have they have timber and some minerals, but in terms of Commodities that they're able to sell to to their neighbors. It's the world market. They're rather limited, but hydro is one of those Exportables so to speak exportable value values that they have and the challenge is Building hydro plants and not essentially destroying Communities by having to relocate them, which they're already doing in fact But also the fact that hydro dams. These are not run of the river. These are these are dam dams Hydro dams have a significant impact Can't have a significant impact on those Millions and millions and I'm talking 60 million people who who sustenance and livelihood Depend on the Mekong whether it's fishing the consumption of protein and and their overall Lifestyle for for generations has been built around the Mekong So I'd say the number one takeaway is that this river being one of the great rivers of the world is truly Alive and and yet it is being threatened by drought threatened by dams threatened by politics Between the countries that share the Mekong, you know as it starts this epic journey in the High altitudes of southern China and then continues over 2,000 miles Like I said and emptying into the east sea off of Vietnam Well, let's let's talk about some of those let's drill down on some of that Laos is landlocked you said and my recollections that Laos has probably The lowest population in the area, I mean Vietnam has a substantial population Thailand has a substantial population Maybe Cambodia not so much but Laos is only what what less than 10 million am I right? Good guess my friends about seven seven million seven million That's not a lot of people and and then you wonder, you know with an economy that that came from You know an undeveloped country how they could afford to build dams Along the river and and the answer to me I would guess is that China and the one belt one road program has helped them do that China has financed and engineered those dams. Am I right? You're close. Jay. You're close. It's not just the Chinese. It's also the ties because they use or consume a fair amount of Lao hydropower energy and more and more so the Vietnamese and I just read recently in the local press here that Vietnam is projecting the strong possibility of power shortages this year and You know Vietnam FYI They are population of last year was about 96 million 96 million they have a very robust population growth. They're the largest in the region followed by Thailand which is close to 70 so Again, not just the Chinese but the the ties have I think deals for hydro the Vietnamese have as well, so That's where a lot of the politics corruption play in in terms of who who's getting paid off to approve these projects and what's going to be the the benefit sharing of of these projects that are in in many instances largely financed by countries or companies outside of Laos so You know for decades to come there will be a shared revenue stream between two or more countries for these hydro projects and You know what what kind of leverage does this does Laos have because it is one of the poor countries in the region In fact, I read that More people are under the poverty line here than any other state in the region except except for Myanmar Myanmar is the is the has the highest percentage of people in poverty, but Another unfortunate distinction is Laos is the worst when it comes to child mortality Children dying under the age of five. They are the have the highest child mortality That must lead to health in general then health care must be at a lower standard than their neighbors now Well poverty Alleviation which of course, you know addresses health care, of course Especially for for younger people poverty alleviation is a very high priority of the the the monopoly in control communist party here Which has been a single party in control since the the path that Laos succeeded in Beating the Americans back in 75, which is quite the bad year for us, you know in retrospect in terms of South Vietnam falling to the north and so forth. So Yeah, it's a very high priority here and there's a tremendous amount of money I don't have a gross figure for you But the European nations the Swiss the Swedes the French amongst others the Germans the Japanese To some extent the Americans continue to pump hundreds of millions of dollars of Grant and aid essentially development money into this country there just think their presence is very clear You know one thing that's raised by all this discussion is how well they can negotiate on their own behalf I mean if they have control of the Mekong as it flows through Laos then They they should be able to negotiate good power purchase agreements with Everyone who has the benefit of the the hydro power, but is that so are they are they sophisticated in that regard? Are they do they see their bargaining position? Do they bargain for you know good results economically? Well, I mean one good result is that the electrification of the country is in the high 90s Contrast that with let's say both Cambodia and Myanmar have somewhere Somewhere under between 35 to 40 percent of people in both those countries do not have access to grid electricity So one of the benefits certainly to to the people of Laos has been a high degree of electrification electricity here is not Super cheap nor is it super expensive? But you know you're talking about a per capita GDP here last year of about 2,400 bucks Okay, that comes out of $200 or so per month. I mean you have people working in restaurants here people coming in from the the Outlying provinces and rural area who are making a hundred some of bucks a month So you know to your question to what extent who has the leverage in the relationship here? Is it equal or is it imbalanced and my impression so far is that these Foreign companies Thai Chinese Vietnamese are doing quite well Doing these projects in fact a colleague of mine who I'm in a VN Tien Just this past week noted that from his perspective The the money is made by the developers even prior to throwing the switch and creating power Installing that power. It's made through through financing. It's made through Perhaps less than shady kickbacks along the way So again to your question. I think it is an open question as to what extent Laos has has the same amount of leverage over its negotiating partner than the other party does I mean, you know, it's like Africa If you have the resources there are a number of people who always want to exploit the resources And if you don't have a strong government with you know a strong officials who can you know who negotiate with people Then you wind up being the wrong end of the exploitation. How how is the government doing in Laos? What is what kind of a government is it and how does it function? How well does it function and where is it going? Well, there are five countries in the world Jay that have monopoly control ruling communist parties one people's Republic of China Cuba Democratic Republic of People's Democratic Republic of North Korea DPRK Vietnam that's for and Laos so only five countries in the world are ruled by Dominant control or monopoly control communist parties and Laos is one of them the Communist Party has been in power here since 1975 45 years there is no political competition, you know, my overall vibe is that it's not repressive Obviously repressive per se, but both the people in the media and also folks who are politically inclined Practice a degree a degree of self-censorship, which is not uncommon to this country self-censorship in terms of Lines you don't cross and and things you stay away from there is no discussion in the press about Free and fair elections in this country that is not likely to happen anytime in the foreseeable future but this come the from what I can tell the the Communist Party here is pragmatic and they they do seek to improve the conditions of its people and are focused on poverty alleviation are open to accepting money from from Western developed countries and and the Japanese as well and see see the path ahead as Improving their economic state and bringing more investment money into the country whether it's from hydro projects or You know FYI tourism went up 14% last year 14% which if you do the math And if that continues that's going to lead to a doubling of tourists coming here in five years So there are some who believe that That will be a good thing because tourism will spread money across the economy or so it goes But then again, you and I both know that You know in our beautiful state of Hawaii Being so dependent the economy being so dependent on tourism is not all all passion fruit and pineapples and Papayas in the morning, right? Well, you know that that takes me to a subject We really absolutely need to discuss and that's the coronavirus which is shaking the whole world up right now on a daily basis in fact, you know news news is on a 24-hour cycle and there are places you can find Right now how many people have died how many people are infected what countries how many people in you know in every country in the world global maps if you will and You know, certainly that affects travel it affects the notion of travel. It certainly Supports your your point that you travel Makes you vulnerable to the vagaries of tourism and the like so how how is How is tourism and how is it being affected by? the news about coronavirus As far as I know, there's not a single case yet That's been diagnosed in terms of the coronavirus here in this country that said I Just in the past hours, I think the list of countries that there are effectively Seeking to evacuate their nationals from Wuhan, which is the epicenter there Clues the Americans the Japanese the ties the British the French and you know when other countries see See these countries like us and others who are who are taking their Evacuating their citizens. I gotta believe there's gonna be you know, a larger stampede for the door There there are no shortage of tourists or Chinese tourists here in Laos Here in Luang Prabang, it's been the Chinese Lunar New Year over the past handful of days and and there are plenty of SUVs that have these blue Chinese license plates I'm seeing, you know, no shortage of people walking around in in masks But nothing to the extent of what you see in in other parts of the world or China where virtually everybody's wearing a mask So I think there's a fair amount of trepidation. I mean the the ability for If there were to be probably not if but when there are cases diagnosed to be in general Luang Prabang or Savannah cat or other parts of Laos Will there be folks what were the medical personnel have these hazmat? Biosuits to be able to put on day in day out. I think you know the further out you get from the so-called modern technology the less Less ability that the local health infrastructure has most likely to deal with a type of Threat like this. So yeah, it's kind of scary I'm supposed to be back on my way back in March for a week in Shanghai My beloved Shanghai, but I'm you know for good reason giving that serious Reconsideration depending on how things play out. I mean if I can't go to Shanghai Disney, I mean what's life about, right? Well, it's closed right now. So I've got no trip So but you know the problem is that you travel around you have to go through an airport in different countries will have different reactions to coronavirus and different ways of Isolating it and so who knows what what things will be like in March either well in I guess in Laos you want to think about that but also Turning to the United States and stopping anywhere along the way in Hong Kong or Taiwan or Korea wherever your plane will stop There'll be issues in travel in general. Don't you think Marcus? Well thermal scanners seem to be the rage these days Jay at airports and The airport here in Luang Prabang, which was built and not too long ago by by the Chinese Chinese investment money I would be shocked to pieces if there were Any scanners thermal scanners in that restaurant. I don't even know if they have them at the main airport And being chan the capital so, you know, I don't know you he probably traveled or traveled a fair amount of developing world I mean, it's a different ballgame in terms of Leaving and and entering the country when it comes to scrutiny and and devices like that so Well, of course it's dynamic and it's gonna change me right now There's a shortage of masks and gowns in China and the Chinese government here to tell us Trying to find contractors who can build them and sell them right away In fact, the Chinese government is building a couple of hospitals from the ground up With an expectation of completion in a week or less You know and the Chinese can do that but query can the Chinese Chinese Effectively stop the the contagion. That's that's not clear but if there's a shortage of You know masks and gowns and who knows what else you need to treat a population that's been infected in China There's going to be the same shortage or worse in all the countries in Southeast Asia They don't have the manufacturing capability that China has and and that takes me to well, you know a question about how How close is Laos to China? Is it contiguous? Can you drive your blue license plate car right over the border? Is it is it a shared border? Do you have to go through some of the country to get to Laos? Well, you can indeed Jay. There is the northern boundary of Laos but up against the southern boundary of the People's Republic of China and there is a a Railway that's been under construction for several years. It's supposed to open at the end of next year That would connect Kunming which is the capital of Yunnan province other in Yunnan province With V and Tien and this is a very big deal will be a very big deal because it will allow for both goods finished goods from China to come into Laos as well as people over time. So yeah, they share a border and The these folks in Yunnan more and more of them like to come and And spend time here. They buy villas along the river and there's more and more of a Chinese presence And I mentioned that tourism went up 14% last year overall here and it went up 26% For Chinese nationals. So you do the math for for 26% and that will double in about three years Doubling of Chinese coming into Laos. So You know that this the small country limited resources That is dependent or kind of smushed between bigger countries that have a lot more Resources and a lot more leverage In many of these negotiations. So, you know, they've got their work cut out for them to to not Effectively kind of be carved up or carved out Of their neighbors who who have a lot more in their bank accounts, so to speak than the Party in the government and and businesses have here. Yeah, well, that's likely to have the same effect as it has in Hawaii where you have You know richer people coming down and using your place So maybe abusing it as a sort of getaway place and buying expensive properties and spending money and the like That that may have a, you know a negative effect on the way the way Laos works over time I guess it would be of some concern. Is there any pushback on having all those Chinese come? And especially some some people are probably happy that the China closed the border You know They'd like a rest from all the all the onslaught There is I Want to be careful here, but there is certainly kind of an undercurrent of antipathy amongst many of the locals towards Towards the Chinese for for a number of reasons. I mean, there's kind of a Feeling of resignation that the Chinese do bring money and they do bring investment And that's needed But at the same time there is Like I said, so somewhat of an antipathy towards Towards the the deep pocket of Chinese and It's not just in Laos, but In Vietnam as well You know, they fought a border war in 1979 that killed people on both sides And there's a dispute over the what the Chinese call the South China Sea in the so-called lane dashed line What the Vietnamese call their EC So it was kind of interesting is the different relationships that these ruling communist parties have the relationship between the Laos Communist Party And and Beijing is very close the relationship between the the de facto communist party in Hanoi and and and Beijing is decidedly a lot more tepid and and more kind of fraught the relationship between The nationalist monopoly control party in Cambodia of Hun Sen has been there for decades is also very close So whereas the relationship between the the military back government in Thailand in Beijing is more wary So that's why the the region J is just so fascinating in terms of the the different dynamics that play the different The different ethnicities the different issues. They're challenging that they're that they're Uh negotiating over sometimes fighting over and you know as I've been talking about for decades energy Is is being one of the main drivers of our society of economies around the world more and more energy is E focal point that that has my interest and will continue to have my interest But let me ask you one more geopolitical question. I think we've talked about this before We have a couple of processes working and and uh, you know, one could prevail Maybe the other would prevail one is that China would have more and more influence throughout southeast asia um, you know economically And in terms of development the one belt one road projects and all that and the other the other process is that southeast asia begins to Come together and be a region that's somehow united Geographically and maybe although the cultures are different maybe by some common denominator in the cultures Some wish to come together and be a you know a region that works together And so you have two competing You know directions as I see it anyway, and as we discussed before i'm always interested in knowing whether you think And especially on this trip southeast asia will come together and be more than just a loose confederation It'll become uh, you know like a like an eu But he was a little trouble right now But like an eu type of group which we have special trading arrangements special economic connections special travel Is this possible will it ever become Kind of closer than it is now My friend jay that is a subject for a graduate level seminar discussion that I cannot address adequately and in in a soundbite, but i'll do my best Uh There are both Cross boundary cleavages that push the countries apart and also reasons for them to work together my focus Uh, both kind of symbolically and tangibly is to look at the macong river As a as a way or as a a focus of attention and where the parties the five macong country sub macong countries Have to communicate have to get along have to negotiate in good faith The the the the life and well-being and the fate of this river where you have 60 million People at least 60 million people who do who depend on this river for their sustenance and their livelihood So i'm seeing this play out in real time in terms of how it's a common denominator the river the macong is a common denominator And uh, this is this show is called marco on the macong on the marvelous Majestic macong if you will Um, and I think uh, you you've touched on something in the sense that energy brings people together It brings economies together and maybe somehow uh laos is more important than only seven million people laos At the headwaters of the macong, uh, maybe as time goes by laos will play a role in that Anyway, we're out of time So i have to leave you now, but i look forward to our next discussion two weeks hence right marco Indeed and we will speak uh, when we speak next I will be in the capital of the socialist republic of vietnam aka hanoi I could hardly wait no kidding. Thank you marco. This has really been enlightening as always aloha. Thank you very much. Bye. Take care


Greetings, friends! Welcome to CTUCC Conference Cast for July 5th, 2012, regular podcast of the Connecticut Conference of the United Church of Christ. Whoever you are and wherever you may be on life's journey at this very moment, you are welcome here. We begin this week's conference cast with this meditation from Anne and Tim Hughes, co-directors of Silverlake Conference Center. There's a verse in the letter to the Hebrews that has some resonance in the lives of summer camp directors at this time of year, and it goes like this. Therefore, since we are surrounded by so great a cloud of witnesses, let us also lay aside every weight and the sin that clings so closely, and let us run with perseverance the race that is set before us, looking to Jesus, the pioneer and perfecter of our faith. It's week one of camp, 150 campers, some here for the first time, some homesick, some exuberant to finally be joining in the fabled experience they've sampled while dropping off their older siblings in Sunday's past, and some returning. The emergency phone has rung four nights out of five, but only one fire alarm going off at 1.30 a.m. Thanks to all God's critters, including a really active lunar moth. But here we go, mostly ready, sometimes not quite, but somehow... We are certain we cannot possibly get through seven more weeks of this grueling pace. Yet, and still with God's help, your and our own prayers we can and do. We joyfully proclaim during Secrets of the Kingdom's worship service, it is good, soon and very soon. And Pastor Diane encouraged us to marvel at the sky, thank God, and be still for at least a moment during the day. We watched our counselors in training burst into a flash mob dance during lunch to call me maybe, and we frosted cakes reflecting our diversity of God's creation, and diary of a wimpy camp kid made litter box cakes, and there were so many accessories during the hats, scarves, and capes dinner, it out accessorized our waterfront staff's lost and found fashion show. There was a really amazing race. There were stream hikes. There was a victorious group hike at Bashbish Falls by some who really weren't sure they could do it. We played quidditch on the soccer field, really hot quidditch, and there were wizards on broomsticks spotted flying around the high ropes challenge course in the trees. There were sailboats and cookouts and campfires and lots of singing and night hikes. There were scrapes, a few sprained ankles, staff and campers. And there were moments of courage and moments of despair and just as suddenly in the next moments of friendship and loyalty and support. All this was experienced in community. Big, riotous, awkward, planned and unplanned community. Then it's over. It's Friday and then Saturday. Then parents pick up all those changed kids, kids who have learned the new songs, fortified with new friends, new thresholds and challenges overcome, new skills learned, and hopefully some glimpses of God right in our midst. We emerge from this week, never again the same. And we turn around to welcome a new group of deans, counselors, chaplain, nurse and another big, exuberant, unsure yet hopeful and fearful group of conferees. God, oh God, be with us. Send us your prayers and wherever you are, remind us of your faith in us, your faith in every one of your children you send to be together in this place, in this moment. This group that somehow will pledge once again for at least this week to love God, love our neighbor and love ourselves. Here we go. Give us this day our daily bread, a big dose of stamina and bless us in this ministry you've graced us to do with your children. Amen! In the news this week, this coming Saturday the first two bus loads full of young people from all over New England will begin making their way to West Lafayette, Indiana for the national youth event at Purdue University. These two service buses will stop in Cleveland, Ohio for two days of learning, service and a special visit to Church House, the UCC National Office. United Church News has a great story on the preparation work among the six New England conferences to arrange the transportation and program for this group which includes two more bus loads of young people who will arrive at Purdue on Tuesday. Over 60 people will attend from Connecticut but among the New England states, it's Rhode Island that is sending the most 78 youth and advisors. Next week, conference cast will be on the road coming to you from the national youth event in Indiana. I look forward to reporting for you from the midst of a group of young people who are excited about working together to make God's world a better place. Last Thursday, June 28th, the United States Supreme Court handed down its anxiously awaited decision on the Patient Protection and Affordable Care Act and they upheld the core of the law. Connecticut Universal Health Care advocates celebrated the victory at a press conference at the Legislative Office Building in Hartford. Speaking on behalf of the Interfaith Fellowship for Universal Health Care, Imam Kashif Abdul Karim of the Islamic Center of Greater Hartford had this to say. This fight wasn't just about mandates or insurance. It was about what kind of country you want to be. A deeply divided, unequal one that gives advantage to the very few at the expense of the many or a country that cares for all of its people and treats them all as equals. He was echoed by Rabbi Joseph Ron Fish of Norwalk's Congregation Bethel. Rabbi Fish has a son who is treated for a cleft lip as an infant, a minor surgery that became classified as a pre-existing condition. Thanks to the ACA, his son can no longer be denied insurance coverage. I am a big fan of the idea that we as a nation today have articulated the basic idea that we will not allow our children, our adults, our men, our women. We will not allow our people to be without help and hope. We will heal their broken heart and we will bind up the wounds of those who bleed. Further work for healthcare advocates remains, so they met that same evening for one of a series of regional recruitment events. The goal, say organizers, is to double the number of people who will raise the issues of universal healthcare with state legislatures and Governor Malloy as they work to implement the federal and state reform laws. The Conference Minister Search Committee formally began accepting applications and profiles this week, having released the conference profile online at ctucc.org last Thursday. The printed edition includes many links to outside information sources, particularly to a six-minute video which highlights some conference ministries about which people are particularly excited. Here's what Committee Chair Gordon Rankin has to say about what we seek in a new Conference Minister. Probably the first quality that I would say a new Conference Minister needs is ability and willingness to relate to local congregations. Our congregations want to feel supported and resourced, but also affirmed and appreciated. This is both a challenging time, but also an exciting time because it's a time that we need to be more attentive to listening to who God wants us to be and more responsive to that. The Search Committee will accept applications through September 30th. For more information and to find out how to apply, visit ctucc.org slash cm profile. And you can always find out what's happening around the Connecticut Conference at ctucc.org slash news. The National Youth Event is coming right up soon, July 10th through 13th at Purdue University in Indiana, with service groups leaving this Saturday the 7th. The Craigville Colloquy, featuring William McKinney on The Gospel Unbound in the Mainline Churches, runs July 16th through 20th. United Black Christians hold their 20th Convocation in Hartford, July 25th through 28th. UCC Musicians Association Conference is July 29th through August 2nd in Burlington, Vermont. And Praxis 21, the Center for Progressive Renewals National Church Leadership Institute, is August 8th through 10th Indicator, Georgia. And plans are coming together now for the next General Association with Bishop Yvette Flunder as the primary speaker, September 23rd through 25th at Silver Lake. You can always find out what's coming up in the Connecticut Conference by visiting us at ctucc.org slash events. That brings this Conference Cast to a close. Thanks to Ann and Tim Hughes for their reflection and to GarageBand for our music. Primary funding for Conference Cast comes from your congregation's gifts to our church's wider mission, basic support, changing lives through the United Church of Christ. This is Eric Anderson, the Minister of Communications and Technology for the Connecticut Conference of the United Church of Christ, praying that your days this week may be filled with the presence, the guidance, and the grace of God.


Yeah, we're longtime DEF CON listeners, first time DEF CON talkers. So I like that our slides are cut off because it just says the internet already knows I'm X and you can fill in the blank. In this case it's pregnant, but that's historical. I wasn't drinking while pregnant, just so you know. So I'm Kashmir, I'm a journalist. I've been writing about privacy and security for about ten years and I'm a new mother which is relevant information at this particular time. And I'm Cooper, I'm a technologist and security researcher at EFF. I'm a privacy activist and I also care about privacy and security issues for people that have wombs despite not having one myself. So we paired up for this particular project. I'm an investigative journalist so I'm good at reading documents and talking to people and I'm also an immersion journalist. I like doing the things I'm writing about. So when I wrote about Bitcoin, I lived on Bitcoin for a week. It was hard. In the past DEF CON speakers helped I hacked a smart home. So yeah, I like to do the things I'm writing about, though I did not get pregnant just to do this talk. And I didn't either. So I'm a hacker, so my skill set involves apparently seeing dogs and blondes in the matrix. But so I'm interested in this. Originally I had, when I had advised another journalist on an article about anti-abortion groups using geo targeted advertisements to target anti- abortion ads at women inside of Planned Parenthoods.  And so I met Cashmere and she pitched this idea to me after she had unsuccessfully looked for a real security researcher for many months and we settled on me. So yeah. And beyond being pregnant, I got interested in this. A few years ago I, we're on the wrong side. Next one. Oh, we are missing the slide. Anyways, a few years ago I helped popularize the story of the target story. Is there anyone in here who doesn't know the target data mining pregnancy story? Don't be afraid to raise your hands. Okay, I'll tell it. Almost everybody seems to know this story and I hear it come up at every single security conference, privacy conference I go to. So I'll be the one to raise it this time. But this is a story that came from an article written by Charles Duhigg, who's a New York Times journalist. He did this big article on how companies learn your secrets. And one of the anecdotes in this story was that target did really excellent data mining. It would look at the shopping behavior of women to figure out who early on who was pregnant. And it would be like they bought unscented lotion, they bought a blue carpet, they probably bought prenatal vitamins, which is like the big giveaway. And so there's a story about how target sent ads to this woman for all kinds of baby products. And it turned out this woman was a teenager and her dad saw the ads and got really mad and went to target and was yelling at them saying are you trying to encourage my daughter to get pregnant? And supposedly this dad called target back a couple of weeks later and apologized and said there were things going on in his home that he didn't know about and that his daughter was indeed pregnant. So some people don't want the internet to know about their pregnancy. In particular there's a Princeton professor named Janet Vertesi and she wanted, while she was pregnant, for the internet not to find out about it. So she went to great lengths to hide her baby bump from the world of big data. She looked at baby sites, baby product sites using tour. Her husband went to the drug store, paid cash for gift cards. When they wanted to buy baby products they would do it with these gift cards and have it sent to an Amazon locker. So it wasn't associated with their home address. And she said she successfully hid it as far as she could tell because she never got online ads targeted at her based on her pregnancy. I decided to do the opposite. I just told everybody I was pregnant. I downloaded, while I was trying to get pregnant, downloaded all of these period and fertility tracking apps and then once I got pregnant I entered into the apps I was pregnant and I just used an email address that I don't usually use in order to track what happened because I wanted to find out who was going to sell me out to retailers, who was going to figure out that I was expecting. So this is the list of apps that we looked at. We looked at a little over 20 different apps and they have all of these names. A lot of them are named similar things like my calendar, my time. And here's the first privacy issue. Once you put this on your phone and somebody's shoulder surfing do they know what you're doing with these apps? So there's one set of logos that are very discreet, like letters, numbers, these could all be pretty generic applications, ride sharing or something. There's a next tier though that involves a lot of pink flowers and silhouettes of women. I've never had so much pink on my smart phone. And then there's yet a third tier of weird images of fetuses. At least the last one doesn't give away what the sex is of the baby. And then of course the grand winner is this one. You don't necessarily know what this is. It could be like a porn app. No, but it's called Get Baby. So yeah, a little on the nose for this one. So I think that there's probably a few dudes in the audience who maybe haven't used these apps before. And you may wonder why it is that women would want to tell their smart phone when they're having their period. So these are some of the reasons why women use these apps. The screen shot on the left, you can't quite see it but it gives you options for why you're using the app. It can be that you're trying to avoid a pregnancy. So some women are using this as a contraceptive to avoid, I guess the sperm getting to the egg during their fertile period. Using it to get pregnant. Or if they're getting very expensive IVF treatments, they can use these apps to track what's going on with their body. Once you get pregnant, you can use these apps to track the human science experiment that's inside you. The main thing that the apps tell you about is what size fruit the fetus is in your body. Which is super weird. One of them told us that the baby was the size of a cheesy mango. Which I'm not clear what a cheesy mango is. And it told us it was not our baby. No, no, yeah. We should clarify. And then the other use for these apps is they have these community forums where women talk about all kinds of things. Sometimes it's stuff having to do with pregnancy and fertility. Sometimes it's completely different. There's a lot of discussion about people's sex lives. In the screen shots I have here, it's about, I can't even remember, baby bump selfies, those are really big. Oh, there's somebody that's saying, why is my period greenish black? But she should probably get out of the forums and go to a doctor. And then in terms of the kind of information that you give these apps, you might tell them what your vaginal discharge looks like.  Once you're pregnant, you might tell them the physical symptoms that you're experiencing from headaches to back aches, to not sleeping a lot. And then apps are helpful in terms of getting you to do things that you're supposed to do when you're pregnant, like take prenatal vitamins, do kegels, which if you don't know what that is, you can look it up. And just track your sleep and your weight like the usual kind of health tracking stuff. So I downloaded all these apps. Who figured out I was pregnant? So one of the first, one of the companies that figured out I was pregnant was Twitter. So this is from a Twitter account that is associated with the email address that I used with all these different apps. And I don't know if it's included in the screenshots, but they figured out that this is from, there's like an interest page that you can get to in your Twitter settings and it tells you what advertisers know about you, how they're targeting you. So I have been successfully associated with baby products, child care products, and very specifically it says in my demographic information I have one child, which is true. Also all these people figured out I was pregnant. This is my inbox at six months. And luckily again I was not using my usual email address, but I had ads from pottery barn kids, what to expect, which is one of the apps I signed up for, Huggies, and many, many more. So this is where we get into my specialty of reading documents. So I wanted to figure out, you know, how these people had gotten this information. There was a technical way to find that out and then there was just to read the privacy policy way. So one of the, and I'm only going to give you a few of the privacy policies, but the first one was what to expect. This privacy policy is 4,000 words long, which is eight pages if you print it out. And 2,600 words in, it very explicitly says, you know, we, when you sign up we give you a registration information to select partners. And there's a little link there that you can click and then it gives you a list of the partners. When I first did this it was like eight different companies, but when I went back to the screenshots for our talk it expanded to I think 14. It includes pottery barn kids, Huggies, some of the people that you saw spamming my inbox. And the privacy policy said, if you don't want us to tell these companies about your pregnancy status, don't use the app. You know, this can be worse than just getting spam in your inbox. Sometimes they send real mail. Similac is a baby formula maker and they're one of what to expect select partners. And so they get information from what to expect and other companies that they wouldn't disclose to me.  This can go very wrong because not everyone who gets pregnant stays pregnant. So in one particular example a woman named Amy Pittman from Washington got pregnant, was excited about it, put it into the apps. She didn't like the what to expect app so she deleted it and then she had a miscarriage. And a few months later or I guess like eight months later she did get baby formula in the mail. So there's serious privacy harms here when you misidentify or correctly identify a woman's condition but then don't know what happens later. And it seems like a lot of these apps are not keeping in mind people who might be outside of the majority use case, the average user story or the average threat model so to speak which is a theme that will come up again. Okay so privacy policy number two this was the bump. This privacy policy was 4700 words which is 10 pages printed out. And so for reference this is the same length as the entire report that I wrote about this problem. And so I was reading this privacy policy and I was really surprised to get about halfway through it and I discovered baby's first wire tap. Which I use facetiously I don't know if a lawyer would approve of calling this explicitly a wire tap. But it had a feature.  If you made a call from the app it would record the call. It would record any message that you left. It would collect the phone number, the location where you were when you made the call, etc. Which I just thought was insane. Like I've never seen anything like that before with an app. And so I called up, I reached out to the bump and I said you know WTF. And they informed me oh you know we're not recording phone calls. That's legacy language for a contemplated feature for the not. Which is an app that they do for planning weddings. And the press person was like I'll send that to our legal team right away. And so this proves that no one reads privacy policies, not even a company's own lawyers. And they removed it from the privacy policy a couple of days after I reached out to them. The line of this bad thing you found was just a test. How common was that? Yeah I mean I'm sure many people out here who have reached out to companies about privacy or security issues often gets the response of it was just a test or we were just temporarily doing it. I don't know I hear that all the time. That was a response from about half the companies we contacted I think. Okay this is the last one. So this was Ovia which is an app, a company that makes a fertility app, a pregnancy tracking app and even a child tracking app. There are terms of use on our 6100 words which is 14 pages printed out. I don't know if you can see it in the screenshot but this is an app that gives you a really helpful fertility score. Like your score is high, do it, your score is low, nothing is going to come of it. And when I went through their terms of use they, you know a lot of these apps they sound like they're kind of like giving you the kind of advice that a doctor might give you. But many of the apps warn that they're not really giving you medical advice. And this one explicitly said, you know this app might be, have errors, maybe inaccurate just so you know we're not responsible for that. So I went back to look at their website and oh yeah you can see it good. So in the advertisement for their pregnancy app they said they'll give you real time alerts when your symptoms are dangerous. And right above that is like the little medical symbol. So I don't know it sounds like medical advice to me. Sure seem to be trying to imply that it's medical advice. So these are some of the issues that we ran into. When it comes to inaccuracy the warning that they gave is warranted. I found out that a year ago three doctors looked at a bunch of apps, 33 of the most popular ones on Android and iPhone. And they looked at their predictions for the fertile window. And of those 33 apps only three apps correctly predicted the fertile window. And we've got their results there. No one was completely off but they would just be off by like a few days. And interestingly the month that I got pregnant most of the apps told me I'd missed my fertile window. So my husband and I were excited when we found out that in fact it had worked. So if you're using these to not get pregnant it might not be the best method. Please don't use these apps as a contraceptive. So far I've talked a lot about one person that's involved in this in terms of privacy. There's two people involved. And so that was definitely on my mind as I was doing this project is that basically I was tracking my now in the world daughter online since she was negative eight months old. So I just wanted to say a public apology to Alev. So that's like a lot of what I was able to learn. So this is what I was able to learn just from basically tapping into skills I have as a journalist in terms of reviewing privacy policies, reaching out to companies. I also used an app I guess called Recon from Northeastern University that monitored the kind of connections that my phone was trying to make and that these apps in particular were trying to make. And so it told me essentially that there were a lot of advertisers that were getting information from the apps. But I felt like I needed more help in terms of really digging into the technical side of this. And that's where Cooper came in. Yeah. So I wanted to give sort of a hacker's eye to this and see what we could find out about the network traffic, what was what sort of API calls were being made, whether encryption was being used, whether the APIs were in security and what other companies were getting the data and what sort of data exactly they were getting. So. Cooper's really good at finding memes. So you'll appreciate the next few slides. So one of the first fun things that I discovered about these apps is that they give you some pretty specific advice. This one told me that I had a 2.6% risk for pregnancy, which is large considering I again don't have a womb. So there is no option in these apps to say I'm a dude. Yeah. So I used pretty typical reverse engineering methods, static analysis, dynamic analysis, and some other tools. So for static analysis I used a tool called JADX, which is a decompiler for APK files, produces something close to the original Java source code. It also extracts the resource files. And then I loaded that up in Android Studio where I was able to do some similar things like what you can do in IDA. I was able to rename function calls that were obscured, track flows of functions, see where permissions were called, why they were called. So this gave me a lot of good insights into apps that I wasn't able to get just from network traffic. And this is how I got network traffic. So for dynamic analysis I used a tool called man in the middle proxy or middle proxy. And what middle proxy does is it intercepts SSL traffic. You install a special root certificate on your device and then you connect to the proxy and you can see content, headers and everything else for HTTBS traffic. And it also allows you to replay requests, edit requests and replay them. So it was really good for looking at the APIs, figuring out who was being contacted and what they were being sent. And then the other tool I used is a proprietary tool called crypto wire, which they donated their services to us for this project. So crypto wire, it does a combination of static and dynamic analysis. And it allowed me to quickly do sort of a quick triaging of about 40 different apps in a couple of hours to see sort of a high level overview of which ones might be worth looking into further. And you can see here this is kind of the high level analysis screen of one of the apps where it told me that it was leaking personal information. So yeah, so one of the main things that I found in most of these apps was just lack of HTTPS. So meaning that content, important personal content was sent over plain text HTML. And so you might wonder, like, okay, we're talking about the privacy and security of fertility apps. Who's going to attack these things? Like who wants to hack these? So let's think about what kind of information is going into these apps, women talking about their sex lives, or the kinds of things that they're writing on the community forums where they're talking about issues that they're having with their pregnancy, medical information. Again, a lot of them talking about their sex lives. Strangely, a lot of women talking about their experiences being sexually assaulted. That was like a very common topic of conversation. So this is all being sent in the clear. And you might, it might be intercepted by somebody who shares a network with you, which could be your partner. Could be your restrictive father. Thanks to Congress deciding not to move forward with privacy rules for ISPs. This means your internet service provider could get this information and this would be more, more information used to target you with ads. And then the other thing about this is of course that somebody with man in the middle position could inject and execute JavaScript on a lot of these apps, which use the WebKit framework to render pages. Related to that, we found a number of issues with account hijacking a lot of fire sheep. So four of these apps would have been fire sheepable. So they were, which is to say that they were sending authentication cookies over plain text. So Pinkpad, WebMD, Baby, MyCalendar and the Bump, all were found to send authentication cookies over plain text. So top three have not fixed this. So if you're using these apps and you're using DefCon Wi-Fi, don't do those things at the same time. Probably just don't use the Wi-Fi. Even if you're not using these apps. We also found a lot of personal information links. So for Pinkpad and another, so Pinkpad is made by a company called Alt-12. We tested two of their apps and both of them send your exact GPS coordinates to the Alt-12 server every time you start the app.  And it's in their privacy policy. It's that they can provide you with location based information and ads. Location based ads. So we also found a number of other things like email, name, gender, pregnancy status all being sent. And I don't think that Pinkpad was the only one that was sending location.  But what we found through static analysis was that a lot of them were encrypting the data that was being sent to advertisers and to other people. Pinkpad was just the most obvious about it. And if we had more time maybe we would have found others. And so again, thinking about the threat model here, I actually want you to put on your William Gibson hats. And think about the possibility for what could be done with information about women planning to be pregnant or thinking about pregnancy who are giving up their location details all the time. So I think at the beginning of this talk we made the point that advertisers aren't just creepy because they get a lot of information about you and they're trying to get you to buy something. In the case of knowing a woman's pregnancy status it can be very malicious where we had an anti-abortion group targeting women that are in a planned parenthood waiting room. So just think about some kind of policy group who wants to target a bunch of women who live in a certain neighborhood and tell them that they shouldn't get pregnant, like everything that's bad about it or try to encourage them to get pregnant. And I don't know if Cori doctor is in here but if you write this story we want royalties. So there were other information leaks too like this text file that was dropped on the SD card by one of the apps so this contains a log of the entries into the app every day. January 18th was a really good day. But this file being on the SD card means that any other app could read this file and furthermore it means that anybody who gets a hold of your SD card or the data partition on your phone is going to be able to read this file as well. So it's a pretty big privacy leak. And then of course third party tracking is a super common problem with all of these apps. I think all but one of the apps that we tested contacted several different advertising servers. And it's mostly the same stuff that you see online. The majority of it is Google, Facebook, Amazon and Adobe's various publishing networks. And then there's like a long tail of just random advertisers and data brokers that are you know on one or two of them. So I think it's safe to say that Google, Facebook, Amazon and Adobe know more about who in the country is pregnant than target. So one feature that all these or that a lot of these apps have in common is this pin lock screen. And it's kind of interesting presumably to keep somebody from just picking up your phone and looking at it. But they're not implemented very well. They almost all have a four digit limit. And at the time we looked at this none of them had any sort of protections against brute forcing. So you could guess as many times as you wanted without any sort of slow down. When we notified the companies one of the companies P-Tracker did actually decide to fix that issue and implemented a back off for the number of times that you could enter the pin code. But the other thing about these is that they don't have any sort of, they're not any sort of protection for the data at rest. So they don't encrypt the data in any way. They don't do anything to actually protect it on the drive. They're just a intense that you have that triggers before the app starts.  And one way to get around that is to click this link that says I forgot my code. So for at least one app, the bump, when you click this link it sends you an email with a code with a temporary pin code that will unlock the app. And where does email tend to go? And so email tends to go to your phone. So if you're on the phone trying to get into the app and you can't because there is a pin on it. Just send a reset code and check the email because you already have the phone and there you go. And when I was using these apps I was not using pin codes. I wasn't particularly concerned about somebody getting into the apps. But if somebody does feel the need to use the pin they may have a very legitimate reason. You may be in an abusive relationship. You may be in a restrictive, you know, a religious household or religious society. They're with somebody that they don't want. Somebody who has access to their phone to have access to their sex lives. And so these pins should be stronger. Yeah. And if you're relying on this pin code for security, I don't recommend it. You should take better other steps. The other issue, another issue we found was files not actually being deleted. And so again we only found this in the bump. But this is also largely because we ran out of time to do this research. And this is probably an issue in other apps. So what happened in this case is that the bump encourages you to upload photos of your pregnancy progress.  And so what happens in all of these apps, there's actually some apps that explicitly discourage us and say no posting any personal information in the community forums. But I guess the bump didn't have that prohibition. So a lot of women like to post the ultrasound and share it so you can see the development of the baby. But ultrasound pictures usually have the mother's full name, the hospital where the ultrasound was taken, the date. So a lot of sensitive information. So a woman might post that to a community forum and then realize all that she shared and delete it. But when you delete it, it turns out that it simply unlinks the photo from your account but doesn't actually delete it from the CDN server that the photo was uploaded to. So if you have that original URL, that URL still works to see the photo for the rest of time. And we thought this might be a caching issue at first, but the photo was still up for a week after I had deleted it from my account. So definitely not a caching issue. Just not even considered that a user might want to actually delete things when they say delete. And then the other thing we found was just a crazy amount of permissions being requested. It seems like the Android development philosophy is it's better to ask for all the permissions than for any forgiveness. No, that was bad. All right. So 10 different apps, half of the apps we tested requested the location permission. And again- Everybody wants to know where you are when you're pregnant. So again for advertising, right? But this harkens back to the story that I was working on earlier about women being targeted in Planned Parenthoods through location-based advertising. This is incredibly personal information and there's no reason that any of these apps should have this. Also a quarter of the apps we tested requested your contact list. Just in case I want to inform people about the pregnancy.  Also five or six of the apps requested your device ID, which is like a cookie for your phone. It lets advertisers link your profile between different apps. And then the phone permission lets them do the same thing but using your IMEI which is like a hardware serial number for your phone. And then pregnancy plus requested the SMS permission. And I have no idea why but it also has the contact permission. So maybe that thing I said earlier about it texting everyone. Anyway the other interesting so we found one interesting security feature was that four of these apps Glow, Nurture and Eve were all made by the same company and Clue all implement certificate pinning. So this is where you hard code the hash of the SSL certificate that you want to use for your HTTPS connection into the application. And it's pretty cool. So this prevents somebody from doing a man in the middle attack on HTTPS like what I did with Mitem Proxy. And I mean it's a nice feature to have. My bank doesn't even do this which would be great. But it's kind of extra. We're not security shaming. I'm not security shaming. I'm glad they did it. But TLS men in the middle seems to not really be in the threat model for the use of these apps. And it seems like maybe a better use of their time would be to implement something like two-factor authentication which none of these apps did or securing that pin code thing. So after finding all this we reached out to the vendor separately. So Kashmir reached out to them about the privacy issues and about the things in the terms of service. I reached out to them about the security issues. This is how I felt about their response.  So I contacted nine different vendors. And all these guys and also the bump. And we received a response back from P-Tracker, Glow and the bump which isn't up there because we got a response back from them just after we finished these slides. So P-Tracker and Glow fixed the issues that we found. The bump promised that they would fix the issues. And everyone else just completely ignored us. One company sent us a form letter saying they appreciate that we like their application. I had a different experience. This is where it's different being a security technologist versus being a journalist. I heard back from everybody that I reached out to except for everyday health which makes the what to expect app and all 12. And people, you know, acknowledged the problems with the privacy policy and changed it. I just, I got responses and companies definitely seem to pay attention to journalists. I think it helps that they have like pressed people set up particularly to receive our inquiries. And also I think they better understand what journalists are asking them. And sometimes they just have no idea what a security technologist is setting their way. So maybe the lesson here is that if you want companies to take your security issues seriously, either work with a journalist or tell them that you're a journalist. I definitely endorse this pair up. You should definitely pair up with journalists if you're a technologist and vice versa. Yeah, so on that line, what can hackers do? What can you all do to improve this situation? And one of the best things to do is to pair up with a journalist. I'm gonna do these kind of reverse order. Is to pair up with a journalist. The combination of a hacker and an investigative journalist is a really powerful combination. You can, we can find these problems and then we can tell the world. And we can through shaming these companies and through getting this publicity out there convince them to take these security and privacy uses more seriously. And we're also, hackers are really good at threat modeling and we can think about threat models outside of sort of one standard deviation from the average user.  Right? These should be pretty common threat models for somebody writing one of these apps but they're apparently not. One thing that was obvious to us at the end of this is that people that these companies hadn't necessarily thought about kind of the abusive edge cases. And actually a year ago, Glow had a really big security issue that Consumer Reports discovered where Glow had this feature there where you could invite your partner to kind of monitor your fertility or pregnancy with you. And the way they had set it up was such that the woman would make the invitation to somebody. But after she did that anybody who knew her email address could then monitor what she was doing within the apps. And so it was just this kind of huge security hole and only discovered because Consumer Reports decided to look really closely at the app. But Glow did take that issue seriously and did fix the issue and I think is why they were so responsive to these security issues that we found because they do seem to after that shaming or after that publicity. Oblissing. Not shaming. Not shaming. But after that publicity they decided to take these issues seriously. So this is a great illustration of how publicizing these problems is a effective tactic for change. So Kashmir, what was your take away from all this? Yeah, I mean my first hand, opinion on all this, like I hate to admit it but I really enjoyed using these apps while I was pregnant. It's super weird being pregnant. It's like unlike anything that's ever happened to your body before and you just feel like a science experiment for nine months and so I appreciate the information I was getting from the apps. But if I decide to have more children I don't think I would use the apps again because now I kind of like know my way around it. So any future children I would have the only privacy invasion they'd be subjected to in utero would be the ultrasound which I like to call baby's first privacy invasion. It's always hardest on the first child, isn't it, Kashmir? Always hard. We're both first children. It's the hardest. Anyway and so that's all we have. We want to say some thanks to Crypto Wire for donating their analysis services to us. We really appreciated that and it helped us out. Thanks to Dave and Jingjing at Northeastern for their help with Recon. And thanks to Gizmodo and EFF for continuing to sign Paychex to us. Thanks to Defcon and then thanks to Alev for inspiring our research.


Hi, I'm Pete from SPQR. I've got my lovely SPQR band behind me there. We're just setting up. We're in Gulliver's tonight in Manchester, which is an amazing venue with a lovely ceiling. That's tonight, but today we've been here with Guitar World, we did a little session playing our new single, Just Something. A little bit different with our lovely Blackstar Studio 10s, so enjoy that.


At GitLab, we're innovating together. Partnerships are important to complement our capabilities. I'll be highlighting several technology partners today and tomorrow. The first partner I'd like to showcase is Ancor, and I'd like to thank them for their sponsorship of this year's Commit User Conference. Be sure to check out their demo as well and learn how Ancor complements GitLab capabilities to provide solutions to US federal customers and many others. Hayden Smith and James Peterson with Ancor are going to share DevSecOps lessons learned from working with a large federal agency that can be applied to any organization. Welcome, Ancor. Hi, everyone. Welcome to our session today on how DevSecOps lessons from the DOD can help any organization. We'll be talking to you today. It's me and my friend James. I'm Hayden. I'm a senior DevSecOps engineer with Ancor and handle a lot of projects alongside James and the public sector business. Yeah, and I'm James Peterson. I'm also a senior DevSecOps engineer at Ancor at the last year doing SRE work with Platform One, specifically on the Iron Bank project, supporting Ancor as well as some other facets of their DevSecOps platform. Today on our agenda, we're going to be briefly going over the challenges that the DOD faced moving forward, and I believe a lot of these challenges will be familiar to your organization. If you haven't seen these challenges before, the odds are you will see them in the near future. We'll be talking about the DOD best practices and solutions we have for these challenges, as well as some elements of a strong security foundation that can be adopted by your organization. So just talking about the DOD and DevSecOps, Ancor exists for these three main use cases and they're being used all over the DOD right now. So, you know, sometimes people are going out and building an image marketplace, so they're taking containerized applications and building a secure marketplace and want to validate that these images and containers are up to a certain security and compliance standard. We also exist to secure products and applications, so to continuously protect those internal applications your teams are building from security risk, whether it be external or internal. Also ensuring security and compliance of the software you deliver. So for the, you know, the DOD, this is very, very important because they have such a strong compliance baseline that they have to meet, but you could quickly see how this can correlate to any industry or any vertical here. Today we'll also be introducing Platform One as a case study. Again, a lot of these challenges are very broad, but a lot of them were experienced firsthand by both myself and James as we worked on Platform One. So we'll be referencing Platform One throughout the presentation. Platform One allows users to adopt DevSecOps and it serves as a DevSecOps software factory for the entire Department of Defense. All right, so challenge number one. This is something that's been in the news quite a bit lately, which is software supply chain attacks, whether it's SolarWinds, CodeCov, Kaseya was a recent one, so that one happened just a week or two ago. All these attacks are done by very persistent threat actors that are very committed and very creative in how they execute these attacks. So we're seeing this, these attacks shift further and further to the left, penetrating further down in the software supply chain, where they can then spread quicker into more organizations very easily, right? So this is something that's going to continue to persist. And when we talk about how this relates to the DoD, this is something that is definitely front of mind because the types of actors that are behind these attacks are the same kinds of actors that we have to protect ourselves against, right? Not only private sector, but also public sector as well. And these are actors they're familiar with. So this is definitely a type of attack that is very concerning and something that we had to take on as a challenge when we talk about the DoD and all of our kind of public sector business out there. And our recent report, Anchor went out and published our own report. We found that 64% of enterprises were impacted by a software supply chain attack in the last year, right? And based on some of those logos we saw on the previous slide, right? CodeCov, SolarWinds, Kaseya. CodeCov is an interesting one because it specifically deals with Docker files and images and abusing images and things like that. And then of those, you know, software supply chain attacks in the last 12 months, we determined, you know, of those respondents, 15% said they had a significant impact, 20% said they had a moderate impact, around 30% with a minor impact. So that's really important. And you could go grab that report down from our website and take a deeper dive in that. So our second challenge at the DoD is also that in the public sector in general is that we're dealing a lot with containerized technology, right? So packaging software has become easier than ever with the onset of containers. That's great because you can package up all your application code, everything that application needs to run, right? So your licenses, your code artifacts, anything like that. But there are also a huge security risk because you have so many different files, so many different dependencies, packages, secrets being pulled in. So you need a way to look inside that and detect those security issues and compliance issues that may be present in that containerized component. So when you look at combining challenges one and two and really layering that on top of each other, you get this super oversimplified version, right? So on the right-hand side of your screen, you have your cloud-native application. So each of those boxes represents a container, right? Specifically if we're talking about a modern kind of application, you're typically going to have more than one container that that application needs to run. And each of those kind of containers is sourced and built in a different way, right? So you have your vendors, your public repos, your private repos that are all being pulled from in order to contribute code and pull code in to create that image, right? That will eventually go on and be a running container. But each of those public repos, private repos, or that vendor may have a different standard on what they think security and compliance means for building secure software. But then when we oversimplify it, it gets even crazier, right? So you look at that vendor, where you source from, or that public repo you pulled from. And they may be pulling downstream from somewhere else, right? And they may have a different standard on security and compliance with their software, which can further complicate the issue. So you need to introduce a choke point there where you can then inspect that software, make sure it's up to standard and up to par with your security and compliance baselines, check for different threats and attacks and things like that within your software before you have that final application you see there on your right. Then when we talk about Platform One and the DoD, now our third challenge is really automating this. So we want to protect against software supply chain attacks. We want to adopt and heavily use containerized and other cloud-native technologies. But we want to do this in a fully automated process so that way we could speed up delivery of software updates and new software tooling to the warfighter, right? So when you take a look at kind of the modern CICD process, you have all those different workloads that you're handling and then you have your tool chain below that. So you have all your tools that are a part of handling those workloads, right? So you have your sourcing, develop, build, test, deploy, and run stage. And at each of these stages, there's always a new attack that can occur, right? So we have four listed, but for each of those four, there's probably 10 to 15 that you could easily add to each box. So that's something that's really important to keep in mind is that there's really a ton of attacks that could introduce themselves at any point in this automation process, whether it's an insider attack by someone that is trusted or whether it's a simple typosquadding attack from something that is upstream, right? Say you're pulling in a different package or dependency that is vulnerable. That's something you definitely want to monitor for. And then taking a look at challenge number three, even further, and digging into kind of what we were thinking about at platform one as we started to think about, how do we protect ourselves from software supply chain attacks? How do we automate this whole flow and automate contributing containerized technology and using containerized technology? You have to ask yourself important questions, right? So who do we trust? What components of the software should we trust? How do we go about inspecting the software or things like that? Who owns what? So who's going to own the security model within this? That's part of DevSecOps, right? It's actually re-establishing the collaboration and re-establishing how stakeholders interact with each other from a security standpoint. Where and when and what do we scan is a big portion of it. So do we scan this artifact once, twice? Do we scan it once we see it for the first time and then we scan it once our developer has gone through and added more of their application or custom specific code on top of that? Those are questions that you just constantly have to answer. And then how do we protect a very sensitive things? Secrets is a great example. So how do we prevent secrets from being specified in a Dockerfile? How do we detect that? How do we do secrets from leaking in other places, right? Other places in your CI pipeline. So that's just a good example of protecting sensitive information but this could also be sensitive files or things like that. How do you prevent unauthorized disclosure of sensitive files and that build process, right? And how do we make this flexible? So how do we make a pipeline that can handle all these challenges that can handle, that won't compromise our security baseline that will leverage containerized technology and cloud native tooling? And how do we make it flexible enough to support all the automation that needs to take place? So you have all these different steps that need to take place as a part of our platform one pipeline about 17 or so different jobs that we configured all in GitLab using eight to 10 different security tools. And the best part about this is that it's a plug and play model, right? So we're taking different security tools and responding to specific threats that we see out there. And it's easy because we have a tool like GitLab that makes it easy to take that pipeline and be able to put tools at different parts of that pipeline. So being able to drag and drop and put tools where they need to be very easily makes it very easy for us to go out and create a secure pipeline that kind of answers these three challenges. I'm now going to hand it off to James and he is going to discuss some of the questions you should ask yourself when going about building secure pipelines and answering these three challenges. Thanks, Hayden. So I want to get into some of the core things you need when selecting your tools to build your pipeline when you're actually building your DevSecOps pipeline and some of the best practices that we actually use. We implement every day and we help implement at DoD Platform One. So first, some of the questions to ask yourself when you're actually selecting your tools. The first one being visibility. So what is it that's actually getting built into your container, into your production software? There is an executive order that came out recently mandating an SBOM for any software that the government is going to use. And there's a reason for that. It provides deep insight into the software supply chain that makes up that particular piece of software, that image, that container. It tells you what your dependencies are, where your dependencies are coming from and who's actually making changes to that software that you are using in your production system. The next is inspection. So what is it? So you've collected that information. Everything that goes into this software and now you need to actually inspect it. So checking for things such as what's changed between builds. That's a very important one. What's actually changing inside your software is someone trying to sneak something in there. Finding vulnerabilities or malware that might be hiding in your software. And then also looking for any sort of anomalous activity that's going on inside your software, whether that be one of the two previous topics. And then we go into policy enforcement. So should it be there? So doing things, perhaps some of the vulnerabilities that are there, it's okay because they don't really affect your software. Security has signed off on them. They're okay with that. Those can be allowed through because, like I said, maybe it doesn't affect your software. And then also you need to perhaps adhere to some sort of compliance standard and encoding policy and doing so so that it's repeatable and it's enforceable is very important because humans make mistakes. But if you can actually encode that into an automated process, then it really increases your security because it's done so consistently. And then remediation. So how do I actually fix the issues that are surfaced through visibility, inspection, policy enforcement? So what is your plan of action for fixing that vulnerability or making sure that malware isn't there anymore? Things you need to make decisions like prioritizing which vulnerabilities need to be fixed first. So those are some important questions to ask as you move forward with designing your pipeline, designing your whole security infrastructure as you ship software. And some of the work that we've done at the DOD, we've learned quite a few lessons and we've helped implement, we've learned some best practices and taken some of those lessons. So it's really essential to lay a strong foundation for software security. There's many often overlooked practices that play a key role in creating security posture. So some of those include sanitizing files for sensitive information, using a tool like Truffle Hog, something like that integrated with your GitLab environment to comb for secrets exposed in Git history and purging those secrets, making sure that they're not actually pushed into your Git history, things of that nature. And then implementing defense in depth. So verifying software before building it into the container, building containers in a secure way, enforcing security and best practices for a container post-build, and then enforcing policy and controlling deployment of containers so nothing violates the security of what's deployed. And then enforcing security in the deployment environment, something like network policies surrounding ingress and egress. So have security checks and you have security at each stage of the pipeline from dev to build to publish all the way to actually running software. And then verify input packages for your software builds. So don't just install software from anywhere, make sure it's signed, make sure you can verify where it's coming from, what's in it. This goes back to the visibility that's having an S-bomb of... That's why the government wants S-bombs for software that they're consuming because they want to actually see what's inside of there. And then embed your malware scanning. So make sure that you have malware scanning somewhere inside your DevSecOps pipeline and make sure it scans every software artifact that you're building and putting into your production software. And then encode your security controls through policy. So do as much as possible to codify your security. Don't rely on manual checks for consistent security because as humans we can make mistakes. There are things that can come up that maybe we don't recognize, but enforcing code policy through code, through automation, it really helps to enforce that security consistently. And it also allows security to scale. So it's easy to do a manual review for 10 images or so, but once you scale up to thousands of images, you have to hire more people. You have to get more people involved. One person can't handle all of that. So when you can codify it and build it into an automation system, you can actually apply security at scale. And then develop a plan of action for security findings. So this goes back to the remediation. So architect a process for handling security findings early. So we'll involve mitigating the findings or just reporting the findings. You have to make those decisions on how you're actually going to handle the security, especially once you get into production systems or deploying something like something to a Kubernetes cluster. Are you going to block polls of an image because it has new vulnerabilities in it? Well, you're going to take down production systems. There are trade-offs that you have to discuss and make those decisions inside your own organization. And then when you continuously monitor the software, what is the plan of action? So that goes back to, when you have a vulnerability found in production that wasn't there at build time, maybe it's a new vulnerability, something like that. What are you going to do? What is your plan for handling that? Are you going to ideally fix it in dev, push it all the way to prod as quickly as possible? But what is that process? What does that look like? And then use flexible tool sets. So tools like Anchor and GitLab, they have full API coverage, which as a practitioner, I can tell you, is really awesome. So they're very flexible to integrate into your workflow.  And then it also gives practitioners, someone like myself, somewhere to start without having to build from scratch. And then adhere to industry standards. Industry standards, they're there for a reason. It's a conglomeration of best practices from very knowledgeable people. There are things that are proven to have worked in the industry, there's a reason that they're there.  So next, I really want to talk about our case study. So Platform One, DevSecOps in real life, they're actually doing it. So they have built a pipeline to secure containers and then they publish the Iron Bank Registry One, which is a registry of hardened containers. So how do they do it? What does it look like? Well, for Platform One, they start with untrusted software that is brought in. It's typically rebased on top of a Red Hat Ubi image. They have DistroList, they have Scratch, if your application uses one of those base images. But typically it's built on top of a Red Hat Ubi image because that is the approved base container. So that has gone through the hardening process and it's been approved. And so therefore the security, it's that defense and death. Base containers have been secured. So now you can build things on top of it. And anyways, so everything starts off rebased on top of Red Hat Ubi image. Then you download all the dependencies in the pipeline and you do the verification. So you check the signatures. You scan them for malware. Make sure you don't build anything into your container that you're not expecting to be there. Once they've all been verified, everything is passed into a build job that's actually built on a disconnected build node. So it's a disconnected GitLab runner that we use. We use the Kubernetes executor and have some network policy around our build node or our build pod for our GitLab runner. And so it'll build that software or that container offline so it doesn't do anything like reach out, download something during build time, which is a big no-no. And that's really, that enforces the software that you downloaded previously, all your dependencies are actually what's built into the container and there's nothing that you're not expecting in there. And then once it's been built, it's scanned by multiple security scanners. So it's scanned by OpenScap, Twistlock, and then ourselves, Anchor. The CVE results from all of the scanners and the policy evaluation from Anchor, they're all put into a centralized database where the findings, they go through a review process. So security engineers will actually go in, they'll take a look at the findings, they see whether that CVE or this finding actually affects the container. And then they will go ahead and go mitigate it or what they call justify it. So if it's justified, this vulnerability, maybe like I was saying previously, it doesn't actually affect the software. So it's okay to be there, maybe it's a false positive, something like that. And then after that, after the security investigation is done, it's all collected, all of the information, so the SBOM, all of the findings, all of the justifications, they're all collected together and they're sent up to an approval authority who signs off on each justification and reviews the contents of the container. This is where justifications maybe they're sent back and said, okay, this needs more justification or this actually needs to be mitigated because you are actually vulnerable, things like that. But once all of that has been remediated, the authorizing official actually approves the container, it goes and it lands in the Iron Bank public registry where it's consumable by anyone. So it's public on the internet, so it's consumable by developers, by production systems, anyone who wants to go out and consume a hardened container. So our elements to a strong security foundation, which Platform One really has, it starts off with the culture. So having security training for everyone, I know some people get annoyed by it, but it is actually important, it's very useful. And having ownership, who owns the security for this? Well, everyone owns it, but who is in charge of making sure that there are no holes in this piece, no holes in that piece. And then like I said, really using API first tools. So pick and choose tools that are easy to use, preferably something that has full API coverage and that way integrating with the tool is easy, it's easy for your practitioners, it's easy to use, it's easy to modify your system, you're not stuck in this rigid system that only works one way and you can't change it, you can't evolve it over time. And I like to say, nobody wants to maintain spaghetti infrastructure, so we've heard of spaghetti code. Same can happen with infrastructure, especially as you're connecting tools together. So really having flexible tools that are easy to use, it's very important. And then staying policy centric. So we know fail fast is a thing for dev. So if your build's gonna fail, you want it to fail early in the pipeline or if some check is gonna fail, you want it to fail early, so you're not waiting for 10, 15 minutes before you actually know that your stuff failed and you need to fix it. So same thing goes for security. So start to encode security early in your pipeline and sometimes like runtime checks, you can't do those necessarily early in a pipeline, but there are pieces of those checks that maybe could happen at the build time, at the source code time, just focus on moving security to the left and failing fast when you know that something is in clear violation of security. And then you want to lower your efforts to actually fix those vulnerabilities, remediate containers, things like that. So really take advantage of automation. And then finally, you want to continuously monitor all of your production software. So security, it's not just one and done, it's a continuous process. So you want to monitor your production software for not only breaches, someone trying to hack into your software or your system that you're running, but also monitor it for things like new vulnerabilities and then have a plan of action, like it was talking about, when you do find a new vulnerability in production, what is your plan of action for? Remediating that, is it fix it, build it, push it all the way through to production and deploy it? Is it take down the software, something of that nature? But just discuss it within your own organization. If we do see this, what is our plan of action and come to an agreement with everyone? Thanks for coming to our talk at commit. It was a pleasure speaking with you. Like Hayden said, we have our supply chain security survey. Please check it out. It's some pretty cool data. Also, if you want to try out Anchor, we actually have an integration with GitLab. So if you're current GitLab user, which I'm sure most of you are, it's pretty easy to get up and running with an Anchor scan. You can check it out. You can also check us out on our website. And if you want to check out platform one, I included the website there. It's a pretty cool organization put on by the Air Force. Definitely worth giving it a go. So with that, thank you and everyone. Have a great day.


What's up you guys welcome back welcome back to another reaction video today We're cracking back into the list of the top 100 NFL players of 2021 today. We're focusing on number 77 Quandre digs. He's a cornerback He plays for the Seahawks. I thought it was about time. I got this off the wall and put it on my back and Well, I dare say he's one of Russell Wilson's favorites on the opposite side of the ball, of course But you know that the most exciting thing about playing corner or playing safety Is not tipping passes. It's not even taking an interception. It's what you do after that When you grab that ball you look upfield and you try and break tackle. You might even take it for a pick six So when I think of corners, I think right you're not gonna get too many opportunities If you're wide receiver that you're marking throughout that game is not targeted.  Do they happen often? No. Are they spectacular? Yes. Do I like cornerbacks? Sometimes will Quandre digs sway me as a fan. I'm not sure all that and more will be revealed guys Stay tuned. But first a quick word from our exclusive video sponsor major Keith is X Stop guys. Thank you first and foremost for clicking on this video. Secondly It's brought to you by none other than major Keith is X and I'm wearing some right now Major Keith is X is a New Zealand based bodybuilding and fitness brand They have a complete range covering men's womans and accessories Everything is sized from small to triple XL International shipping is always available. The products have all been designed with both aesthetics and Quality at the forefront with over a thousand happy customers and shipping worldwide There's no reason why you shouldn't check them out head down into the description box below check out the link www.majorkeefsx.com use code Jacob 20 for 20% off And come and join the team. Thanks for listening and enjoy the video Peace out. All right, and would you believe it? The man the myth that the living legend Buddha Baker is on screen. Let's hear what? Cardinals safety Buddha Baker has to say about his fellow defensive back quandre digs I like quandre digs. Seahawks need to stop here. Here comes the blitz quick throw inside Going the other way is digs. Oh, yeah, see Beats one beats two Uses Jamal Adams block beats three See that's what I'm saying. It's not it might not be a pick six, but it is a spectacular play It does it gets you up, you know, we've got wide receivers like Tyler Lockett on the sideline thinking Hey, that's what I'm meant to be doing Have we seen him on the list I do recognize the name or certainly the last name No, we haven't I love this game, man. We've seen this guy throws to the end zone It's intercepted and taking a knee in the end zone is digs.  Mr. Digs. Yeah, there was it's American football a play like that doesn't happen very often You've got to make the most of your five minutes of fame in a particular game. So in that case, I'll let it slide Now don't tell me Stefan and Quandre are related Breaks three once again I Look at like what what digs did just you know in that year with Seattle with you know him and Jamal Adams Very similar like with you know with Earl Thomas when he was with Seattle and Cam, you know, those guys were great Earl was the free-roamer And then you had Cam down low, you know enforcing the run game and Lewis gets hit He tell you what that is not bad company to be compared with blasted If you throw deep it's either gonna get picked or it's a big hit DK's happy. Andre digs had a career high five interceptions Don't they call that a rainbow Literally goes up goes up stalls in the Africa couple of seconds come straight back down But it is that kind of pass that kind of overarching pass That's going to if landed in the right area in that end zone It's gonna give the team it's gonna give the team that the best possibility to get up there and and Snag that that touchdown But what that also does is it gives the defense an equal opportunity to go up and get that ball and it looks as if digs Has done just that With Justin Simmons for most among NFL free-safeties His athleticism is able to get him opportunities getting interceptions and then that same breath like if you can't make the play to get The ball best believe that he's gonna separate the receiver from the football You know without getting a penalty or you know with all the things that used to be legal now are illegal in our game He gets up in a box quick. So you're not afraid to hit One no safety. I don't I like it. I do like his tackling technique. Although this one back here Makes me cringe just slightly not this one. Well that one too this one as well. He's uh, He must favor his right shoulder, which is fine. We all have a favored side But an attack or like that in the game of rugby I mean in the game of rugby, right? No protection. No helmet. There's no way That you'd want your head to be caught underneath the attacking player As you hit the ground when you've got a helmet on I guess it improves things somewhat But as you can see in this particular play as well Not only has he got his head on the wrong side of the ball But there's another seahawks defender coming in on the bottom side of the attacker as well So it's just uh, it's just not the best. It's just not the uh, the best result you could say One no safety there not only it hits you hard, but we plan to post it the way I think it just speaks praises to his game and how he's finding ways to be really effective in that seattle defense. So love his game Well, I know you love his game, mate. You love everyone's game.  Anyways In the next video, we're looking at a fellow seahawk On the opposite side of the ball Tyler Lockett And we're going to hear from none other than DK Metcalf who I'm led to believe is in the top 20 this year Or at least the top 30 and that's exciting before we go I do want to confirm whether these two digs boys are related Quandre digs age 28 five foot nine 90 kgs Pick number six. Sorry pick number 200 in the sixth round of the 2015 draft to the lions stayed there for four years And he's currently at the seahawks He made his first pro bowl last year runs a 456 40 yard dash and we saw all that and more a 20 yard shuttle of 415 three cone drill of 722 A vertical jump of 35 and a half inches nine foot five on the broad jump 17 reps on the bench And if we scroll down here to his personal life digs Is the younger half brother of former longhorns and NFL defensive bat quentin jammer No mention of Stefan digs The name is his own And with that in mind I'm looking forward to the next video where we hear from like I said none other than DK Started with buda baker funnily enough Um, and now in the next video We're we're going to continue with the the arch nemesis of buda baker. You could say the man who chased him down from 10 15 yards back DK Metcalf guys. It's been an absolute pleasure We'll be back very shortly to continue the list at number 76 That's Tyler Lockett. Thanks for watching and peace out