Ddod eich ffordd i Abertynau i'n trefynu fynd i fynd i ddod yma a'r oedbeddio'r ddiweddol. Yn oed yn ddifud i'r wych, dwi'n dechrau i ni i'n mynd. Dyna'r llefydd i chi'n bwysig â'r wlad i chi'n mynd i'r Athan hwn. Mae'r hyn oedd ymgyrch yn ei wneud. felly Anyway for many of us and I think we feel this very personally what is happening to the UK and we are trying to work our own ways through where we all feel about it and where we will all end up. I'm still doing the job of being Director of Cells, I'm about to start the fifth of my five year mandate. I want to say very bluntly to Catherine that I think that you're wrong. When you say you feel you've failed I would not have been able to do the job that I have done in the four years that I've been director of sales without all the hard work that you, and every other director who's spoken today has done to make sales the enormous success that it is. And I think it is because of that success yw Brexётся bydd nifer, mae nifer 就是彼a hwyl Sometimes is a challenge that, as you say rightlyny, we need to meet and address. On the other hand, I think that there's a wonderful wisdom calling in the centre the centre for European legal studies. That notion of European legal study is what we need to hold on to. Maen eich hwn wedi'u ei gael a-fawr, y gallwn ynghymru sy'n gallu'n gwasanaeth iawn yards i'ch gael eu cyfrif yma. Mae ein gallu cwrwp llunio gyda'i, ac mae o'r unrhyw gweithlu gwroeddol o'r ein cwrwp llunio. Mae'r unrhyw yna'r gofyniaid ar gyfer y cyfleu rhaid mewn gwahodol, y Llyfrgell Eide 라는 o'r bydd i ymhwypor i weith. Y Llyfrgell Iel-Panol sefydliad mewn gweith, ..y gallwn y llyfr yma'n gwirio'r gwlad yn sefyllfa ar y UK. Mae'r ffordd â'r llyfr, mae'r llyfr o llwyddiad, ysgrifennu, ysgrifennu, ysgrifennu... ..y'r problemau a'r llyfr yn cael ei cyfrifu'r wahanol. I think and I hope and I believe that sales is in a good place to be part of that. Understanding of where the UK is going to fit into that rather European level landscape. And you are absolutely right. That is the challenge for cells. For me enogwne gyda Ciaran, for whoever takes over after me. That is our challenge. But I say again very clearly that we wouldn't be in a position to meet that challenge. We are not for your hard work, and the work for all the centre directors that came before me. And I am very humbled by today's presentations by all of those directors. a'r hollwch yn y syniadol sydd yn gwahanol panfalu y Llywodraeth Ardgol gyda'r Cymru. Yna, wrth gwrs, mae'n dweud eich bod eich bod odi gwneud ei chael o'r parwysau. Mae'n rhai o'r parwysau, ond mae eich parwysau. mae'n troi gyda, yn wych o fynd i bryds ar ddweud o seld a'r mysgach i gael ymddangos. Ond yn cyllidau i'r newydd o'r moddu o'r ffnogau'r grannu bobl, ond mae'r seld yn ganwethaf, yn ganwethaf o'r felch dda, oherwydd mae'r resloedd a ni'n meddwl i ddweud â ddweud o'r pram, oherwydd mae'r llüffydd hefyd, a'r mysgach. Rwy'n iguala'i mewn ei Alfan ar gyrthau i Gweith-Lawr Sgol a mae'r Eurpoedd yma yn Blynedd. Ychydig y bydd ymlaen nhw'n mynd i gyd yn gwneud y cyn Pelodg, gref y cynllun y colon Llywodraeth, nes yw gweithio y teithio y Gweitharatd Gweithnol i gweithio yr Ysgrifennu Llywodraeth i gael. Felly bod wedi'u gweithio yng Nghyrch yn ni'n mynd i ei wneud Roedd gymryd, mae wedi ymlaen i'r Llyfrgell Llegoedd Ysbytyf yn Llyfrgell Llegoedd Ysbytyf yn Llyfrgell. Ond mae i'n�ir o'r fwyllt i ddweud yn etsydd ymddangos i'n olyfrgell, byddwn i'n cyffredinon y merthyn i'r llynnog a'r llเรll o'r law yn cael licain cyllidfa oeth i gael mwyllteidwyr. I would I do want to think though specifically about how dominant European Union Law on particularly the autonomy of European Union Law is in our thinking about Brexit. And I want to think about three dimensions of study. The first is provocatively to what extent is a cause of Brexit? To what extent is this thing that we have all been engaging in and thinking about actually one of the causes? Simply with the demands of the EU legal order too high. Then I want to turn to the process of Brexit and its interaction with the autonomy principle. And finally to say something about future enforcement dispute resolution and where the shadow of autonomy might cast a shadow over the institutional design for the future. So let me say something about the study of European law and its application to Brexit, a kind of sociology if you like of the study of European law. As Catherine highlighted Brexit is generating an enormous demand, almost an unprecedented demand for legal knowledge and legal expertise and particularly about the European Union and its workings. And although some of that knowledge is about how the EU and its legal order works, the core of what we do, it has also forced us to shed a light on legal issues outside of this core. And if we're being very, very honest about it, it is exposed gaps in our knowledge. Not just because the corpus of European Union law is now so big and expansive that none of us have that comprehensive knowledge. But because, and I think as Catherine hinted as well, because the gaps in our knowledge are also about where we've invested our energies and our scholarship. And I agree with her too often that has been too internal. So part of the task is to get better acquainted with EU external law and governance. But it's also an issue about seeing EU law as within this wider framework of international law and also domestic constitutional law. And as I said at the beginning, if European legal study stands for anything, it is a view of a European legal universe where law is generated in multiple sites. It is a plural concept that is highly suitable for thinking about Brexit. So let me then turn to the phenomenon and particularly causes. There is no single cause. It was Dominic Cummings who said that when you have a big event, there's a temptation to find a big cause. And of course there are multiple causes. There's no particular focal point, for example like a failure to ratify a new treaty which might have called membership into question. This was as we all know an optional political referendum. It was a choice made at a particular point in time. The main themes of the successful campaign are of course well known and it was primarily to take back control. And that had a number of different features. Control over borders, control over money, control over trade, control over democracy. But yes, control over law. And I want to think a bit about what that meant. What did it mean to want control over law? I think the anxiety about control over law manifests itself in different ways. There's an instrumental dimension which relates to the density of EU law. There's an institutional dimension, the jurisdiction of the Court of Justice. And there's a constitutional dimension, the conflict with or accommodation of the claims of an autonomous EU legal order. Let me say something about the instrumental dimension. As many of you will recall during the campaign there were repeated and disputed statements about how much of UK law was now derived from EU law. There was a particularly obnoxious encounter between Boris Johnson and Jacob Rees-Mogg in the Treasury Select Committee round about that. But this was all part and parcel of complaints about Brussels's red tape and regulation. Of course, one aspect of this is really a different sort of concern. It's a concern about democratic control over lawmaking and the rise of the regulatory state. The sense that the technocrats and the experts are making the rules. But another is linked, I think, to the autonomy of EU law in the sense of an anxiety about a shift in the centre of gravity away from the nation state towards a new centre of law. But in a sense I'm not so sure this is really to do with the autonomy of EU law itself and simply more an anxiety about the declining relevance or sense of the declining relevance of the domestic political and legal arena. Now listening to John Spence this morning I was reminded then of course that the UK had sought to manage some of this quantum and scope issue through various opt outs. And a sense Brexit is what happens when all the opt outs run out, when that as a strategy just no longer seems to cut it. The institutional dimension I'll come back to in a little bit more detail later on. But clearly ending the jurisdiction of the Court of Justice has been a key mantra of the leave campaign and of the government since the referendum. Now insofar as this is connected to the autonomy of EU law it is a concern about the autonomy of courts to place limits on politics and political choices. But again this seems to return us back more to an issue about democratic control and democratic issues. Importantly however the complaint is often in error and misdirected. Too often the complaint, the institutional complaint is really about the European Court of Human Rights and the European Convention on Human Rights then it is about EU courts. And indeed throughout the campaign you'd be hard pushed to find any example of a single court case to do with the European Court of Justice with which the leave campaigners were taking issue. Where I think though the connection to the autonomy of EU law is clearer perhaps is the constitutional dimension and particularly the issue of the supremacy of EU law. Now when we think about the autonomy of EU law we think not just of the existence of a new legal order but also its claims. Its claims to confer validity on legal norms, autonomy in testing the legality of exercises of political authority and in the event of conflict to give priority to EU law. Now of course in other jurisdictions there has been clear contestation and challenge to these features. Claims not to treat as valid norms outside of EU competence. Conflicts between the use of domestic standards of legality and EU between the fundamental rights domain. And also on the scope of primacy. And what is in fact remarkable is how absent these have been from UK debates. The very flexibility of the UK constitution has accommodated the constitutional demands of membership and the demands of the autonomous legal order. So what's going on? I think there's a paradox and it's the paradoxical success of Euro-ledalism. Thinking about the autonomy of EU law and conflict, constitutional conflict is perhaps the wrong way of seeing the issue. Indeed the paradox may be that it is the very success of the EU legal order and the willingness of litigants, lawyers and quotes to use the resources of EU law that helps explain Brexit. It's part of the story of elites, the sense that some get to play the system to their own advantage. The antipathy towards Gina Miller was not just about gender and race although there's a good heap of that. But also about a sense that a community of self-interested litigants and lawyers were getting something that the people were not. And I think this also ties into the complaints about the EHR and also the Human Rights Act. Pesci prisoners and their skillful lawyers are using the system to get something that the ordinary people are not. So if there is a sense in which the autonomy of the legal order is the cause of Brexit, I think in a complicated way it is to do with the success of what Dan Kellerman refers to as Euro-legalism. What then about the process of withdrawal itself and the autonomy of EU law? We know there were a number of discussions round about whether Article 50 is the sole means of effecting withdrawal. There are issues about Article 50 sufficiently comprehensive to provide exhaustive legal answers to the issues posed by withdrawal. And of course there will be questions about the status of the withdrawal agreement and review of compatibility of that agreement with the EU legal order, possibly by the Court of Justice. But I want to pause at this point to just say something about Article 50. Of course the wording of Article 50 we are now becoming increasingly familiar with sadly. But there was a text. It was a text that was put to the Convention that was drafting the Treaty Establishing of the Constitution for Europe Treaty. And it was submitted by one of the UK government representatives Peter Hayne, I think. And it was the Cambridge text. It was the text that emerged from the activity that Alan Dashwood organised to provide some draft language for this constitutional treaty, including a draft withdrawal clause. It was a very simple clause actually. It was fairly unambitious in its attempt to simply put in place a recognition of a right and international law for a state to withdraw from the treaties. That text, however, didn't survive in that form. It changed through the negotiating process and what became Article 50 now after the Lisbon Treaty is somewhat different. In one sense it did do what Alan and others intended it to do, which was to recognise a right and international law to withdraw from the treaty. On the other hand, once the process was triggered, once the right was exercised, it was a right that was exercised and a decision made in accordance with national constitutional laws. We're engaging national constitutional law in the process. But once the decision is made, it becomes a process governed by EU demands, EU institutional procedural demands. And here again, I think I want to pay tribute to Christoph Hillion, the former deputy director of sales, who's written really elegantly about this point, that at this point the constitutionalisation process, the institutionalisation process, seeks to take over and run how a state can withdraw from the EU. So we have autonomisation, constitutionalisation, institutionalisation. Now of course some argued that the UK was not actually bound to follow this process. It could simply divert back into international law. It was said that the Vienna Convention on the Law of Treaty has provided additional resources or that the UK could simply repeal the European Communities Act and that would be it. So these alternative legal resources, domestic and international, were discussed. What is remarkable however, and perhaps rightly though, is that the government has never contested this. It was taken the view that Article 50 is the process that governs a withdrawal and that is how things will be run. And it is perhaps one of the ironies is that there is this sort of fidelity to European law, even at the very moment of the UK's departure. And that the whole negotiating process revolves around what became a very Europeanised process. There are of course silences in Article 50. So the difficulty might be what happens when EU law is exercising this very strong normative pool to govern the process but then just doesn't answer all the questions you might ask as to what should happen. The candidates for this are obvious. What happens if you want to revoke the notification? No answer. What is the material scope of the Article 50 agreement? Are there any limits on that and could it be a mixed agreement? Would notification automatically apply to your atom? And would triggering Article 50 be sufficient to take the UK outside of the EEA agreement or does Article 127 of the agreement have to be triggered? It becomes difficult then when you have a provision that is exercising such a strong attempt of normative control but then is leaving unanswered some of the central and important questions which then asks us to think about what other resources we might have. The status of the withdrawal agreement itself. On the one hand it is an agreement negotiated with an existing member state so in that sense fuels internal to the EU system. On the other hand the entire process is based on it being an agreement with as if it was a non-member state in the external dimension. And indeed in principle the compatibility of the agreement with the normative demands of the autonomous EU League order could be referred to the court for an opinion which leaves me then to the court and its future role. And I think this Catherine and others have highlighted one of the successes of cells has been its capacity to engage with members of the court. One of the first tasks I had when I took over as director was the year that the court made its annual visits to the UK and we had very many members of the court of justice with us for a seminar. And I suppose thinking about the court has been one of our many preoccupations but it is clear that taking back control does have a clear institutional dimension in terms of ending the jurisdiction of the court of justice. However preserving the autonomy of the EU League order and the role of the court of justice within it is an important aim of the EU's negotiating position with the UK. And of course it has a particular relevance to the issue of citizens rights which are part of this first phase of negotiations. The autonomy of a League order which is more than an agreement between states but creates rights for individuals which form part of their legal heritage. So in terms of enforcement and dispute resolution in the post Brexit world what I think is interesting about the UK's position is that this statement repeated in EU negotiating position papers about the autonomy of the EU League order and the role of the court of justice within it has been contested by the UK by its reference to the autonomy of the UK's multi-jurisdictional legal system and the role of its courts. So the UK is demanding that the EU respect the role of EU courts in the enforcement of post Brexit rights and duties using the same autonomy principle but this time against the EU. As for dispute resolution insistence on preserving the autonomy of EU law may be an impediment to finding solutions. We know from the court's opinions on the original EA agreement, its opinion on accession to the CHR that the court of justice has problems with creating new courts where those courts may have as part of their function the interpretation of EU law which the court says is its remit. So the irony may be that it will push dispute resolution towards more political solutions but of course much depends on the structure of Brexit. The withdrawal agreement itself may require something more by way of a political mechanism in the form of a joint committee possibly with an option for the ECJ to have a role purely in interpreting what EU law concepts mean. Transitional agreement, it depends what that looks like if it's an F to EA thing then we may have the F to court involved otherwise keeping things the same could mean some role for the court of justice. As for future trade agreement, political mechanisms and arbitration may be what is required. So how do we sum up then, how do we conclude on Brexit and the autonomy of the EU legal order and the nature of European legal studies? I think it should be clear that Brexit has been shaped by law beyond EU law. It's a strong candidate for study from the pluralist perspective of European legal studies bringing together domestic, international and European legal sources. Having said that, the autonomy of the EU legal order has a particular relevance in terms of thinking about the relationship between different sources of normativity and their capacity to exert influence. As a factor in the cause of Brexit, concerns about control over law run in a range of directions and again I think it may be more to do with the success of EU law that is part of the problem. More significant I think is the impact of the autonomous EU legal order on the process for withdrawal and the claim to control the process has been accepted. Most significantly, the autonomy principle I think shapes the future architecture of enforcement and dispute resolution. And therefore even at this moment of departure, the moment where the UK is leaving the EU, EU law is shaping and directing the trajectory of Brexit. Thank you very much. I think that a lot of the reason for Brexit is shocking, shocking ignorance from tracks of the public. One of my students on the Humanities programme, when she returned to real life, sent me an article in French about Piliadur students in Cambridge and talked about Lleucocote, the cocoon. During the cocoon in Cambridge, with other intelligent people moving closer to time and informed people, we just don't realise how little other people know. Since I became old, I have a bus past. I now travel on buses. It's illuminating a whole range of people that you just wouldn't otherwise interact with. In the front room of our retirement cottage in Norfolk, we have a front window where we have our breakfast where we see people returning from the newspaper shop with their paper. I don't think I want to be carrying today your mail as delivered as I can see. We didn't see the Brexit vote come because of the way we all thought and because we knew quite a lot. But one of Rosa's friends said, if you respect her, John, you only have to go to Leeds. It wasn't anything to do with Leeds University, just she had relatives in Leeds and they'd be saying, I don't know about Leeds University, but I think that gave me a camera and that we had to go to Leeds. It's not only the general public who read me about it all, but our politicians desperately. I came to realise that over the protocol 36 of that business camera, and it was plain that he let us into that when he had the clone that was actually involved. And then did we fail in our duty to reform? Well, I just wonder what we could do, given the way he is, if people could listen. One of my friends in England UK, the European Criminal Association UK, is one of the UK former presidents of Eurojust. He wanted to try to get something in the newspapers about what Eurojust was doing to try and counter all the things that have been much in the papers about all the traffic problems with the EU and transport of crime. He couldn't get any of our main streampapers to take any interest. He said, one of them actually said to me, we just don't run with these stories about the EU. Sorry. One of the problems is, they are willingness to people to listen. Speed peers who we all know gave evidence to the House of Commerce committee in relation to the protocol 36 of that. Nobody knows more about that than there's in Steve. First question for those who get to deeply. How much money have you been making out in the EU? I mean, plainly, anybody with anything to do with the EU were part of the EU really trade, so they weren't to be disregarded. In the protocol 36 business. Sellers, very kindly, helped us put together a study on what the last two measures were of the detective pulling out, that we tried to launch it. We tried to publicise our launch by three people turned up just about the same day. Dominic Rahm had published his paper with his slum all over the papers. Dominic Rahm felt that I would all be wonderful, all we have to do is to make certain commitments with 97 Member States and so on. David Edwards, who I have various review conversations, talked about the Catholic concept of invincible ignorance. He thought a lot of people involved were just invincibly ignorant. And he thought back part of it to what I read about this morning. Our newspaper, as we heard it, captured what it had been. It became a newspaper from an Italian British correspondent in Madrid at the time of their financial crisis. Somebody, a work for the EU institution, sent me a retrospective view of a Dutch correspondent who'd been in London going back to the Netherlands. He said, my most shocking impression about the UK is the tabloid press. Every day they seem to publish, they seem to be directed to play to the worst of every human of oceans, angry, shard and frauder, voyeurism and sheer hatred. What is it about this public? They seem to want to be extinct every day. And when I go to Europe, I try to look at the popular newspapers in such languages that I can read. And it's true, it just seems to be a terrible standard in our newspapers. Hungarian friends of mine said, we have terrible problems with Christmas repress in Hungary, but I don't read gross distortions about the EU in Hungarian press. But we didn't see it coming, as we should have done. I really wonder what more we could have done to get the message across. And I don't think that we should blame ourselves. Maybe we could just have a little bit of work against such a mountain of ignorance and prejudice that it wasn't practical that we could have done, which could serve us over the years and try to do our best. The future? Well, Deklau, UK is a small organisation that I want to represent in all. One of it, close to the rest, is whether we should just dissolve what we decided. The UK is geographically still only 21 miles or whatever it is away from the continent in Europe. The still data have a large amount of deals in the EU. We're still waiting. It's not going to completely abolish travel to Europe. We're going to be in the future of relationships between the both Brexit, UK and the EU. So there's still a lot to study and a lot to take. Interesting. Maybe in a less optimistic way than across to the future. It's not a whole new one. I just push me and some of you to spread the cultures about the EU a bit more likely. I mean, in terms of what more could we have done prior to referendum? I did a number of town hall events. I think I did 12 of Dini town hall events up and down the country. When we spoke in university towns, it was quite clear there was going to be a remain vote. The moment we spoke outside of Europe University town, the antagonism with which we as non-path sunks, that was part of the ESRC brief, got just extraordinary. Amy very kindly organised one in Spalding and we knew we would be going into the lion's den.  Annand, the director, is British born Asian and he was certainly the only non-white in the room. Although most of it was reasonably good tempered, largely thanks to Amy being the local lass and her dad being the local doctor, so part of perhaps they treated us more kindly than they might otherwise have done, the guy in the front row stood up at the end and said, don't you know God is English? Well this meant that we had nowhere to go to this piece of insight. I had my colleague from UEA who is also non-white British born. We did an event in Alesham Church. Now you might know Alesham Church because it's nowhere you are. It's a massive church of about 500 people in there. And the amount of abuse we got in there, despite the best attempts from the local ladies who'd kind of baked all the cakes in the event, was an indicator just of hostility. So you're right that the BBC were reluctant to take any stories about EU private sector unless they have bendy bananas. And I did smile when I was asked to do 20 minutes on the world service recently about article 218. You can imagine that was a right riveting listen. But the very fact that they even were interested in article 218, which is a procedure for negotiating a trade deal, shows just how partings have come. But the fact is, I mean the problems are deep rooted, that children are not taught anything about the EU schools. They have no sense of the civics at all, the citizenship. They have no clear experience and difference between the Court of Human Rights, the Court of Justice, and I think this was a fundamental in the civil standard. I think that a lot of people need to think about their role in this. I think that collectively I think we all should have tried harder. The other thing I'd say about my experience, maybe partly from the Scottish referendum as well as this one is that, I mean certainly the constant diet of the hate mail and the express has been corrosive. But the new forms of social media, in particular Twitter, has provided an alternative outlets. That can work in a number of different ways. One, it can do what is done through both referendum campaigns and it's done all too well as you can then get the cybernats or the trolls who then decide to try and beat you up on Twitter. But the other thing is though that there has been a very lively debate through blogs on Twitter that actually is very, very good. It's a very good and open source of information if you want to track it. But of course if you want to have your own echo chamber in these environments you can. And we do run the risk of then we have the same problems. If you're on a particular side of this argument, your Twitter readers just tell you all the things that you want to know from your side of it and not the others. It's hard to know where that is going. But I think the dominance of print media is changing somewhat. But I think that the time that we got into this referendum, the corrosiveness of the debate from print media was very strong. So for us and particularly for cells when we think about the activities we do, part of it is these kind of physical meetings. But part of it is still using social media to try and engage outward. So one of the great things that Amy pioneered was to have short videos of us talking some of the issues round about the referendum campaign and since then. And I guess that tells us something about what modern centres have to do in law factories. We have to find a range of ways of engaging. And that they're not just about getting people physically in the room, but also about communicating outwards, communicating externally. And it's certainly something I'm very conscious of that communicating outwards is as important as the kind of communications that we have in talking to ourselves. I think after a nice, a very significant part of the academic enterprise. My inaugural lecture in Leeds in 1991 was on the European lawyer basically in that period of time. And it was really a tent to try and persuade people that the European rule was actually magic. But in the 1990s war, the European law, the European Union law up in Leeds and the academic faculties, the university administration and the fashion was not seen as terribly relevant. It was a marginal thing that's done on the side. So, as it were, the coping strategy post 75 referendum, very much as it were business as usual in the EU doesn't think of 18. What was explained by a number of people this morning about the expansion of the EU activity and how it became central, much more central, was something which didn't get out or didn't get understood. And this is back even though it took a great extent even the legal profession. So there's a question on what our audience is. To some extent we have privileged relationship with the legal professions and those connected. And to some extent we can influence them and they understand the ball. Getting out more generally, I think in a sense Catherine, is the issue of trust. If Catherine's right that probably not much could have been more done during the referendum campaign, it was a question of did people trust the voices? Over the period of the 1990s and 2000s and did they hear those voices? And I think that's where John's question about willingness to listen and how you get willingness to listen in the pre-internet days. Much more difficult. And the unwillingness to listen continues. I've been doing various bits of things slightly different from Catherine on the Brexit bill with Paul Craig and others. The sheer unwillingness of the UK government to listen to the technical criticism that's being made of the bill and Mark and whatever is an indication that, as it were, if you have a political agenda, never mind the detail to get there. So there's a question about willingness to listen, but there's a question of building trust. And in a sense what you were naming and doing going out is it may not have had immediate effect, but at least they knew when both your voices now appear on the common radio or on television, they recognized they're more likely to trust and that builds it. And it's a building over a generation and I think that's where the thoughts about impact, that academic in the area around that is in danger of misunderstanding how things are done. It's a question of building over the long due way, not the short. And to some extent Catherine's questions are about what's the role of the academic community in building that trust as a centre of understanding of what's going on that isn't provided by me. Yes. First of all, I'd like to thank everyone for this great event and particularly Albertina. And I'd like to maybe make a little more of an optimistic comment because I think it would be unfortunate if such a wonderful event ended on a sort of depressing note. And in this respect, I give the perspective of someone who's a friend of cells who doesn't live in the UK, who lives in Brussels, so maybe I have a bit of a different view. And I understand of course the focus here in Brexit and if I were living here I would be very depressed too. But there's something that I think you all need to realize which is the influence that cells has outside of the UK outside of the Brexit context. And Catherine, surely this is something that is valuable too and I will share the chorus of those who understood your comments but would disagree with them because I think you have been a great success and even heroic in what you've been doing. And just to take a very simple example of this, a great resource you have is the weekly seminar series that you put on iTunes that people can listen to all over the world. And there have been a number of occasions when I've been talking to someone in some EU institution in Brussels who said, oh there's this new issue, an EU law or there's some district judgment at the core and I don't understand it. I don't know where to find information and I prefer them. I've given them something that they link to this iTunes and told them you can just listen to it. You can play it on your computer in the background. And I've gotten very good responses for that. And I think, as has been said, this sort of global outreach is crucial maybe also for the future work of cells. And we talk and there's a kind of school of EU scholarship on the global reach of EU law. Maybe we should think of the global reach of cells also as something to build up for the future. Thank you, that's a great question. I mean, I think trying to get off the back foot is going to be really important because it does just feel at the moment that we are constantly just reacting. And I think it does make it hard to get the kind of centre perspective of what we should be about and what we should be doing, particularly when the paradox is that there is such a huge demand for particular forms of input on particular sorts of problems now. But I think it is something that collectively we do need to think about is how do we move on to a more proactive horizon scanning activity. But I think the first point you made, I think there's also a wider point to be made. We are not the only ones in this. This is happening in Los, was up and down this country. We're not the only European law centre in the UK. And the UK has been a huge powerhouse in European legal education and European legal publications. We have our university presses, our relationship with heart publishing. All of these presses have been massive producers of making European law, European legal studies, a defined sphere of influence. And I think what you're saying to us is don't lose sight of that and that that should continue to remain engaged. I think what Catherine's highlighting is a kind of psychological issue that we're all having to face is how we feel about that. What we feel is appropriate. What do we feel we should be doing? You know, one of the editors that became the European legal studies is that I did have this momentary pause of thinking, why are we doing this? Why isn't the UK? But what we do is we engage, we bring other people in, we engage with a wider European audience. And as somebody reminded me from the monitors in Florence this week, the European Union is carrying on. It faces its own challenges. There will be future developments and there will be scope for discussion and commentary on that. And we are every bit as well placed to discuss those now as we were then. The issue is how do we feel about it? What do we feel is our contribution? And I think that is going to take some time for us to simply work through. Three minutes, yes. Final question. Can you make it a snapshot of your comments? Very quick question. How have the media lawyers in this country been going through the same process of self-analysis that EU lawyers? For my part, the problem of full reporting and reporting of untrudes as facts, this has been building up for years and years and years and years. And so I was just wondering if the media lawyers in the UK have been going through the same process of analysis as the EU lawyers. Because for me, rather than the EU lawyers being somewhere thoroughly did not engage more in the ordinary people, it's not a mental problem perhaps of the non-regulation of use in this country. So I was just wondering if the media lawyers have been asking themselves the sorts of questions that Catherine's had asked herself. I'm not aware of any source acting on this. At least hardly it relates to a broader debate about truth in media. There's a lot of discussion here around fake news, actually. And the word Trump has come up before this, but it is actually part of the much wider range of issues. So I think they're certainly more analysis around maybe not specific on the EU, but generally around what goes under fake news, but obviously it's an obstruction. It's often more about the emotions and the values that might be as well. So I think they don't have much discussion specifically on the EU, but definitely fake news and that sort of debate is very likely. So on that side I think we ought to extend our very warm thanks to Catherine and Kenneth for their very thoughtful contribution. Thank you both very much.


The federal government has commenced an investigation into the air crush that killed the chief of arms staff, Lieutenant-General Ibrahim Atahiro, and other officers. Minister of Aviation Hadi Sirika said investigation would be carried out in conjunction with the military. However, Sirika commisrated with President Muhammad Abu Hari and the nation at large.


All right. Hi, everyone. Welcome to today's webinar hosted by Deep Fence. Today's topic is understanding attack pass, the key to alert fatigue reduction and better remediation. I'm Ryan Smith, head of product and solutions at Deep Fence. Today with me I have Shom Krishna Swamy, our Chief Technology Officer. Welcome, Shom. Appreciate you joining us today. Hi, Ryan. Hello, everyone. I wanted to start with, you know, what we think is an unprecedented security challenges that companies face when they go move into hybrid, multi cloud environments or even single cloud environments because the landscape of those environments has changed drastically. Whether it's the types of infrastructure and hosting services available to you, whether it's the differentiation between ISPAS and SAS within the cloud, whether it's the just demands of the different hosting requirements you might have. This new complexity within these cloud environments, whether it comes from infrastructure complexity or application complexity has caused us to need new detection methods for what we're deploying. So this has led to tool proliferation within the cloud environments. All of my security teams have on average 75 security tools that they've bought. I'm sure, you know, you could go through the categories of workload protection, firewalls, CASB, CSPM tools, then you quickly realize how many tools you have within your own security ecosystem and budget. All of these tools are spouting off alerts to the tune of greater than 500 public cloud security alerts daily that are reviewed by stocks. So these tools are proliferating not only these alerts, but, you know, people have to respond to these. They have to either, you know, ensure that they're not false positives. They have to validate the alert they're seeing and because teams have limited resources, limited time, limited money, limited subject matter expertise of those resources. They're missing alerts, right, because they're having to swivel chair between 75 apps. They're having to review those with the limited staff that they have. And 55% of organizations have reported missing key alerts in security incidents, either daily, weekly or hourly. So half of the companies out there are missing critical security incidents daily due to alert fatigue. It doesn't just impact our security posture, though, it impacts our resourcing and our people and our efficiency within our security operations in dealing with different types of alerts. So, 62% of organizations have said that alert fatigue has caused turnover for them within their staff. And we already know that security engineers, sock professionals, analysts are some of the, you know, staff that's hardest to find within today's environments. And so they're losing critical staff that they can't hire back quick enough due to alert fatigue turnover. 30 hours out of a 40 hour week of a security analyst within the sock is spent triaging alerts. That leaves just 10 hours out of your normal 40 hour work week, where they can actually do higher level orders out of activity such as detection response, instant remediation, forensics, threat intelligence analysis, security engineering, all of these other key functions of a sock go underserved because we're just dealing with alerts all day. So not only are we dealing with alerts all day but this causes burnout fatigue turnover. But there's hope here, right. The statistics, the research, the data indicate that with proper risk prioritization and what we mean by that is not just identifying vulnerabilities, but evaluating them according to their exploitability within the environment. So 27% of alerts that we get from our security tooling can be reduced. So that, you know, 30 hours a week turns into one hour a week of alert triaging. And it opens up so much more potential for our security teams to contribute in positive ways to our security risk and compliance posture that we didn't have before. So we're really excited to kind of dive into this topic a little bit today but you know we think cloud security needs a little bit of a reset because as we've seen alert fatigue is off the charts. It's actively hurting your security resources and teams. So definitely adding more tools and more software to the equation doesn't seem to help. It just creates more silos, more fragmentation within our security alerting and our detection and response. And so how do we really break free of this Sisyphian endeavor of, you know, rolling up the hill, right with with all of these things. And that brings us to kind of the topic of today's webinar which is that with attack path identification management, analysis, etc. By adding more context to the security scans and results we're getting in our environment, ultimately leads to better risk reduction, and the ability to remediate those alerts with the proper controls. So you can better situate how your controls are performed in where they're needed within the environment so you're effectively spending your security resources whether those be technology resources or people resources. Defense approaches this issue of how do we identify attack paths by creating what we call to be the threat graph in what the defense threat graph is for us and it's available across our product suite is runtime context or security capability within your environment. And what we mean by that is, we don't just scan your environment for where risk is, even though we identify what vulnerabilities you have where you might have malware within the environment, exposed secrets within your environment, or even misconfiguration issues that could lead to cloud breaches. But we had what we know about the runtime context of the deployment of that application in the cloud, whether that be net flow information and who's talking to you know what that looks like to create for you which of those vulnerabilities malware, exposed secrets, misconfigurations is actually exploitable by a threat actor, and identifying and helping you map the actual attack path they would take to exploit that vulnerability. So the example we always give is, and Sean's going to show this later in the demo is you might have two machines on the network that are both infected with a zero day like log for show and log for Jay, like we were all worried about last last Christmas time. And, you know, when you're thinking about remediating an environment that might have thousands of instances of log for show like our customers, it's important to know which instances are actually attackable. So what deep ends would do in that scenario is evaluate, not only is log for show and memory on that asset, or that endpoint, but could a threat actor actually make the Jan di to LDAP server connection necessary to execute the remote code execution that they would want as the outcome of exploiting that vulnerability. And if we can identify that attack path for you, we can eliminate all of the instances of log for shell for your environment that don't have that particular attack path open. So what this does is when in a zero day scenario when you're scrambling to remediate your environment, find out whether you've been hit already or not. It allows you to prioritize where to put protections where to put remediation efforts where to spend your people resources remediating those assets, and not focus on the 97% of other instances that have that vulnerability, but aren't really exposed or attackable in a way based on how a threat actor would use a particular tactic technique procedure. This also allows you to remediate those attack pass, which brings us full circle to how does this allow better remediation. Well, in those scenarios, we can put appropriate controls and coverage on the assets that have that attack vector available in these choke points, you know, ultimately do that. We're going to come back to that screen, these two screens here, but I wanted to kind of go into, you know, how this reduces alert fatigue and remediation, and then we'll go into a little bit of how we do it on the previous screens. So, when we look at this threat graph, what what this actually does for an environment is it takes, instead of all these instances of unique vulnerabilities that you might have, ie, those, all those instances of log for shell and within the environment, we drop it down to a list of the vulnerabilities that are actually exploitable within your environment, and then rank the exploitable by vulnerabilities by severity, whether they have exploits available CVS score. This gives you your hit list of which vulnerabilities you need to actually remediate based on their accessibility and explutability within your environment and here you can see we have about 60% reduction at this particular environment, particularly in your high and vulnerabilities, which is where a lot of your vulnerability management teams would spend their efforts. And so we've reduced time spent here, we've reduced the effort on attack pass that wouldn't actually do, and we put a focus on what I call the choke points within the environment, which ultimately helps accelerate your security operations. And so if we can deal with and remediate along these top level attack vectors that might have other underlying assets nodes, part the images within those things. We can eliminate those types of attacks. And this is pretty typical almost project management behavior that it allows security operations teams to undertake, right project management teams have different weighting that one of the most common is this shift right smallest effort, greatest impact is what that tries to do. And so if we can evaluate our high value targets within the environment by identifying these attack vectors, then our remediation efforts ultimately become that smallest effort with the biggest impact of security leverage and risk within our environment. And so this ultimately leads to better remediation within the environment, what we call security observability because you get real time visibility of those assets, and a continuous assessment of their security posture based on that runtime real context, which allows you to make better management decisions project management decisions around resource allocation, whether that be where do I put certain security controls, where do I have to spend on security controls that controls come often in a consumption model, where do I need to target my people resources when I do patching efforts when I'm looking at remediation efforts or forensics and response in a zero day scenario where I've already been impacted or exploited. And ultimately it helps us ensure compliance because all of this is continuous, rather than point in time static snapshots of our environment so it allows better upkeep of these things in real time. So, once again, like, what is the key to security observability attack identification. Well, for us, it's these four pillars that really converge and unless you're adding these four contextual pillars to your environment, then you're just getting vulnerabilities ranked by severity and CSPM results rank by severity and you're seeing all of these things in different platforms that you're having to swivel the chair. It's like putting together pieces of a puzzle, but you're missing like four pieces right in the end you're going to have an incomplete picture of the, you know, true coverage of the attack or what happened because these these data points are going to be in different systems, they're not going to have the same context associated with what's happening in the environment. They're going to be at different points of time so for defense, we really need to always think about measuring and contextualizing the attack surface of the environment. With network flow information, cloud metadata, vulnerability CSPM, malware scan results, putting all of this within a singular platform and system, evaluating what comes in and what goes out of an environment so this is true traffic analysis and deep packet inspection, but targeted deep packet inspection because doing deep packet inspection across all North South, all East West, all the time would be not only resource and time and money intensive on your infrastructure systems, but it just wouldn't be effective from, you know, prioritizing how we spend our security resources. So that analysis of what comes in what goes out allows us to identify what's changed within the cloud, the applications themselves the traffic the process behavior and better lead to security decisions so defense ultimately provides you a platform built on context and you know we kind of talked about alert fatigue earlier in the conversation. This is why alert fatigue happens in the first place is because all of these fundamental controls data analysis things, environment coverage, all of that complexity needs to be housed within a singular platform, a singular system that ultimately allows us to provide better security observability attack path identification, and then ultimately remediation and coverage of the digital attack surface within our enterprise environments.  So for your average sock employee, you're saving $1,500 a week of people costs, just on that. This, you know, cost savings, whether it be by consolidating all of those critical cloud alerts and contextual data points into a singular platform, or the people cost associated with managing kind of the alert fatigue that comes from traditional security systems, you know, platforms that approach risk risk reduction with attack path analysis, ultimately can save to earn 45 business days on average, roughly $300,000 a year. And that's significant, particularly in tougher economic times, when we're thinking about ROI of our security decisions. You know, we really think that approaches around attack path analysis are important to cost and time analysis as well. I'm going to dive into a demo but I do think we have one question, which was just around sources for the statistics and yes we can provide the sources there in the notes of the PowerPoint. When we send out the slides so you know that's various research from various studies but each of those are outlined in the notes. So, you know, we kind of wanted to shift today's webinar to a demo around how attack path analysis affects remediation and Sean's going to show kind of two systems within defense and the differences between why attack path analysis is important. Sean, over to you. Thank you Ryan. Hello everyone. Thank you for joining us today. We did hear Ryan talk about what is attack path and why is it important, how does it work. So let's look at this attack path from a different perspective of what do we do next, right, now that we have built an attack path, now that we have looked at various vulnerabilities, secrets, malwares, cloud scans, the search scans within cloud services. What do we do with it next, what do we want to do with it, how does the attack path help us to be have a better security. So what we're going to do now is I'm going to share my screen, and we're going to look at attack path within our platform, and we're going to go ahead, see what would happen if somebody's trying to kind of take advantage of some of the exposed vulnerabilities or somebody trying to exploit those vulnerabilities. How is it that we can protect ourselves when someone tries to exploit those vulnerabilities. Of course, we're all able to see my screen out here. So here is the attack path that exists within a sample demo environment. Now this attack path, as I said, he uses various vulnerabilities, secrets, there's scans within the various cloud services to build up that's an attack path. In a little bit more detail, let's go over and look at some of the other results that feed into this attack path. For example, here is a set of vulnerabilities that are available to us from various vulnerable scans. In particular, we're going to take the vulnerability scans for the container to illustrate this attack path. Let's take vulnerability scans on our WordPress MySQL, a sample of a vulnerable application. When we take the vulnerability scans of this, what we do is as a first step, we look at these vulnerability scans result and then their CV score, their readability, what Brian explained as a previous part of the discussion around. I have a vulnerability. Is it really exploitable? Which would mean that there need to be a multiple set of factors for this vulnerability to be actually exploited. The most obvious one is this vulnerability network reachable. Does this vulnerability have any known exploit? What happens next when this vulnerability exists within my system? DeepFence, by default, provides a way to categorize all these vulnerabilities and answer the question of is this vulnerability indeed exploitable? And to do that, DeepFence adds context. As Ryan explained earlier in his session, adding context to any issues that we find helps us to prioritize the issue. As we can very well see from a lab that our vulnerabilities, just by adding context, just by being able to understand the nature of our vulnerability, we are able to bring it down to a number where we can understand what is it that we need to fix first. Now, this is for vulnerabilities. Similarly, we pick in the secrets. We pick in the reference for various problems to build out this paragraph. Now, just a while ago, we just discussed about the results of various vulnerabilities and those results being fed into this attack. Here's a sample here. As you can see, there is a container here where this is a sample container where we see that there's a bunch of vulnerabilities which have been identified as being exploitable and which have a path to be exploited. Now, the reason why this container features here, but not the other MySQL or the WordPress containers is simply because of the fact that those vulnerabilities are not directly exploitable. Now, in addition to this, this platform, the DeepFence platform, is also able to understand context here, which means that the vulnerabilities that exist within this container can be reached through another container, right? So, which means that the vulnerabilities not only is this platform being able to add run-time context. The run-time context is also meaningful here in a way that how can these vulnerabilities be exploited? What is the path to these vulnerabilities being exploited? And that uses more, and this run-time observation gives us an ability to plot this for all the users of this platform so that they can focus those that really matter. So now, as we saw here, we did have vulnerabilities of few other containers, but the mere fact that those vulnerabilities are not reachable or they belong to a different class of exploitability, we were able to build up this attack graph, right? So now, we have built this attack graph. We have looked at the various risks within our environment. We have added a run-time context into all this to get here. So here comes the next important part, which is, what do we do with this? Now, the most obvious thing here is we have provided a tool for the security operations program to start their remediation process. But then again, over the course of this remediation, as most of us know, remediation is not a one-day on-time effort. It is a continuous process. So during this continuous process, how do we make sure, how do we ensure that the vulnerabilities that do exist in the system are not exploited? And this is where the run-time piece of the platform comes into play. What happens is, follows right. And Ryan spoke about being able to focus and target our efforts of being able to understand what comes in and what goes on within the whole infrastructure, right? So what we can do is, we go back here, and we look at those systems that have the container that's running in, and we start the east-western, north-western traffic analysis on that system. Now at SK, you can always use the various APLs that we provide within this platform to be able to perform the same east-western, north-south deep packet inspection, right? So let's take a quick look at what we mean when we do say, we mean the east-western, north-south deep packet inspection, right? Earlier on, Ryan spoke about being able to target our efforts, right? So what we do is, we look at the various processes within our system. We do those policies that are receiving traffic, and we start the whole east-western, north-south, basically what comes in and what goes on. The two important pillars of the whole security observability on those processes that really matter. As a sample here, we have started traffic inspection on these two projects, which are only two processes within the system. And we have specified it on a various set of advanced framework on the various blockchain applications and categorizations of your various aspects within your system. For example, I am getting a remote payload. Is it a recon attempt on my system, right? I am getting a payload that is purely an SQL injection attack, right? These are the various categories and classification within the whole front-end scenario. Now that we have started this whole east-western north-south packet inspection, that would help us to build and that would help us to understand the various alerts or various events that happen in our system. That, for example, helps us to look at very low-level payloads that come into our system like this that I am showing here, right? So now, what happened was, we built the attack graph, we then started the east-western north-south packet inspection, and we were able to see that low-level information on what's going on and the various attempts to exploit those issues or those vulnerabilities, secrets, malware, or complex misconfigurations within our infrastructure, right? Now, going above and beyond this, we would also like a platform like this to be able to protect ourselves from these kinds of exploitation. To that extent, we help to check on the security policy. Here's an example of a security policy that is set within the system that helps to understand, for example, how we set the traffic security policy, where you say that if malicious payload is available within the network, please go ahead and block the standard of the traffic to this network, right? We are able to set various security policies and I'm going to quickly show an attempt to exploit one such vulnerability. Now, we did see the log4j vulnerability coming up in our attack path. We also saw some previous attempts to be able to exploit the attack path. And here is a security policy that we have set that will stop any such attempt to exploit that vulnerability. Now, let me go ahead and run an exploit and we will see how we are able to block the exploit. Now, I have here a exploit that is prepared. Let me just quickly show the contents of the exploit. It's a standard log4j exploit and I'm going to start the exploit. Now, once I start the exploit, I do see that there's a kind of a response that I get here and you will see that further communication attempts to this server has been completely blocked. For example, if I were to do a curl again to the same IP address, I would see that I'm being blocked here because a protection policy has been set and as you see here, the IP address has been blocked for the next 10 minutes. Here is a log that just came into my system. A protection policy has been set and it has been in full. Right. So this is the whole sequence that we can, we are able to, we are able to prioritize our remediation efforts, and we are also able to prioritize our protection efforts. We are able to set effective policies that help us to block the senders of such malicious attacks. Back to you, Ryan, to continue the discussion. Perfect. Appreciate that, Sean. Thank you for contextualizing for us everything that we talked about previously. It's always, you know, at least from my perspective better to see those things in action, rather than just see a bunch of attacks and slides about it. So I really appreciate the hands on look of how deep fence at least deals with attack path identification and how we use that to better target remediation efforts for our customers within the cloud. It's great to see that live blocking of those zero day scenarios based on that traffic analysis. I'm just going to bring up, you know, one more slide and then we can get into any additional questions people might have but you know we always do want to share with you the ability to try out defense now. Largely loved by our community we have over 5000 stars across our products on GitHub. If you'd like to go into our GitHub and star any of our repos we'd appreciate that love and support from our community if you thought what you saw was cool here today. You can get started with our products if you just go to the get defense link on our homepage. And then if you want to further engage with our community read product documentation get tips and tutorials or check out our slack channel, then click that last link which will take you to our community page for further engagement.


I mean, it's a real simple, no BS approach to real estate. You know, it's like, let's focus on just two or three things that matter.  This is what I believe I'm sharing that with you for nothing.  You, you've built now this reputation around your business, your brand. And what do you think like you can actually attribute to building, you know what the Ricky Crews brand is today? Cause I'll tell you this from what I know. It's like, it was the cold calling. It was the freak, uh, real estate advice. And the, the one thing that I, I really admire about your content is the consistency. So like how, how did you like shift from, okay, we were transactional first, but now it's like, let's deliver value on a continuous basis and build relationships in the meantime. How did that work out for you? Well, I had to, uh, I had to flip that in my real estate business. Right. So when I lost everything, I had to go from transactions to relationships in my real estate business. You know what I mean? I had to, I had to flip my strategy from trying to get deals to just trying to get to know people and see what I could do to help them. Right. Right. So through that process ended up becoming one of the top agents in the nation and now I'm just still crushing it because of the way that I've structured the business and the strategy I had behind not transactions, but relationships. So when I got into the coaching business, you know, like I, I made it, lost it, came back, took six years to get back to the top. Then I sold a hundred properties a year for three years before I tried to write a book. Most coaches are, you know, they've been in real estate for a year and a half. They sold 12 properties and now they're selling $500 courses, you know, and so you got to look at like where you're getting advice from, you know, lost, made it, lost it, made it back, then kept it for three years before it decided, okay, I think I want to share something with people. Yeah. So I wrote the books and I started coaching. I was charging it first. Right. I was charging it first, you know, whatever, 20 bucks a month, a thousand dollar one time fee, 150 a month. Like I tried a bunch of different things and nothing really worked with that.  It was just not working. And at some point it's kind of the same revelation that I had with real estate, like real estate. I had to lose it all to realize, okay, I got to go with relationships over transactions. So in the coaching business, I went through the same cycle. I just figured it out a lot quicker within about a year. It took me about a year, I want to say within about a year I realized I need to go free. And so I again switched my strategy from the money to the relationship because I knew if I was free, it would open up the floodgates and I would get to know every real estate agent on earth. You know, before long I'll know every real estate agent on earth because I'm free. Whereas if I was a pay coach, there's no way I'm going to get to that level because most people are going to see that gate of money and they're going to turn it around and run the other way. So I had like, I had about 200 paying students at the time and I was making about 10,000 a month residual income. And I woke up one morning and I realized that I wasn't running my coaching business the way that I'm coaching my agents to run the real estate business. I'm telling them it's all about the relationship. And here I am charging them 20 bucks, 100 bucks. You know what I mean?   I'm going to actually start giving that to the world for free. And guess what? I'm going to make it even better than it was.  How do you like that? And I thought I'd get a lot of backlash, but they, and not a single one of them asked for money back. That's how much value I've brought them. They didn't even care. They respected it. Yeah, they didn't even care. I explained to them why I was doing it. It was like to change the world and make the industry a better place and reduce the failure rate. And like, this was the only way I was, because I would, I would have a webinar and I would have 300 people sign up, 100 of them show up and one or two people sign up. And I was like, those numbers are, those numbers are horrible. It's like 300 people wanted how a hundred of them really wanted how they were willing to put the time in, but only a hunt, only one or two actually took action. And so that told me something right there. And what I realized was that people that need coaching that need coaching are broke. That's that they need coaching because they're broke. And I can't afford coaching because they're broke because they need coaching. You know what I'm saying? Yeah. The coaching industry is like, let's charge broke agents. You know, I mean, it doesn't make any sense. It's complete bad.  And so that was another, I did everything I looked at. It was like, I got to go free if I really want to make a difference, you know what I mean? So ever since that then, man, it's been insane. You know, I've had 50 to 100 agents a day sign up for the coaching ever since I did that. We're over 32 something thousand right now in the coaching program. Thousands of agents have doubled and tripled their income, you know, through the free program and it just continues to kind of reshape the industry and hopefully make it a better place long term, you know, where agents are valuing people over transactions and putting the hard work they need to behind it. I mean, it's a real simple no BS approach to real estate. You know, it's like, let's focus on just two or three things that matter.