Good morning, everyone, and welcome to this press conference with UNICEF. This is the press conference dedicated to the launch of the report, the Investment Case for Education and Equity. Welcome also to everybody who's watching our live stream in the media center and around the globe. Glad you could join us. Let me introduce the wonderful panel we have today to talk about the Investment Case for Education. To my immediate left is Joachim Brandt, the Deputy Executive Director of UNICEF. On her left, Mr. Gordon Brown, who is the United Nations Special Envoy for Global Education. The business voice joining us on the panel today is Mr. Koos Timmermans. He's a member and Vice Chairman of the Management Board for Banking at ING Group. And all the way to the left, which I'm sure needs no further introduction, I'll do it anyways, is Angelique Kiccio. She is the UNICEF Goodwill Ambassador and also recently has been awarded our Crystal Award here in Davos. So welcome everybody, and without further ado, I'll pass on to Joachim Brandt to fill us in on what the key findings are of this report on the Investment Case for Education and Equity, which will be available for you here after this press conference as well. Thank you. Thanks very much, Joachim, and thanks. Good morning everybody, and thanks for coming and watching and listening. It is a great pleasure to be here and to talk about two issues that I think we don't speak about very often at the World Economic Forum, education and children. And it's special to be here with the others here, Gordon and Koos and Angelique. Because all of us share, and we were just talking about it before this press conference, we really have a belief in the power of education to lift people out of poverty. And we all agree that education is of course a human right, and investing in it is the right thing to do, a moral obligation as you will. But it's also smart economics, because education can put people on a path towards good health, empowerment and employment, and it helps to rebuild more peaceful societies. It gives children in emergencies a future, a place of safety and a sense of normalcy. And we all know that the benefits of girls' education go well beyond their own education, but extend to their children, who have lead more healthier and educated lives because their mothers actually went to school. And yet there is an education crisis, 58 million children and 63 million adolescents are out of school. And worse, we're also facing a learning crisis, because an estimated 130 million children cannot read or write this count despite reaching grade four. And it's these two twin crises that are being addressed in this new UNICEF report to the Investment Case for Education and Equity, which we are very pleased to launch here today. And the report is in effect a call for action, a call for action at a time when initial progress in enrolling children in school has slowed down. And at a time when we quite frankly also do not have the demographics on our side, because the population of school-aged children, especially in the poorest countries, is increasing and it is increasing very, very fast. For instance, in Sub-Saharan Africa, over 440 million children must be enrolled by 2030 to achieve basic education for all, which means that is two and a half times the number that are being enrolled today. And it is these children that will have to offer a perspective, an opportunity to grow into the productive citizens that we all want them to be. And so the report calls for three critical actions to get children in school and learning. The first is to invest more in education. The second is to invest more equitably. And the third is to invest more effectively. First, investing more. Low-income countries actually require an additional $26 billion annually to provide basic education to all their children. And I know that $26 billion sounds like, and obviously also is, a lot of money. But just think about it. It's the equivalent of just about 5% of the annual profits of the world's 15 highest-earning companies. And thinking about it in that way might make it more manageable and also thinking about the risks of not making those investments, the risks of not giving those children the opportunities to grow into the productive citizens, as I said, that we all want them to be. And the effect that that will have on communities, on countries, on economies. And of course, government spending on education should increase. And the report also clearly states that, you know, government budgets that are already limited should obviously increase through increased tax revenue. And that there's, within those limited budgets, there's a lot of, you know, competing priorities. But having said that, even, we feel that even within that context, there's a room for countries to increase their allocation to education. And then externally donors actually have decreased their budgets for education by about 10% in the last five years. So we feel that also donors and the private sector, too, which goes, we'll speak more, should take up this particular investment case. Second is the issue of equity and the imperative to invest more equitably. We tend to think that as long as we invest more than all children, including the most disadvantaged, will somehow automatically benefit. But that is not the case. And the report clearly states that on average in low income countries, about half of all public education resources are allocated to the 10% of students who are the most educated. And the resources going to the wealthiest quintile of children are up to 18 times larger than those to the poorest quintile. And, you know, if we really want to make progress in education, we must turn that practice upside down and target our investments much better. And that means targeting them to the poor. We've got examples that this actually can be done. A couple of examples that are also in the report in Bangladesh. The poorest 20% of areas students now got $27 per head compared to 18% in the wealthiest 20% of areas. And in total, in just over two years, 900 teachers were redeployed and nearly 6,000 new teachers were appointed to the most neediest schools. Thirdly, we need to invest more effectively in the right places, on the right things, which include investment in learning, expanding preschool, of which the benefits are obvious, abolishing school fees, improving learning assessments, and being more accountable to communities for education results. Obviously, there is no size fits all solution, and we must tailor our policies to countries' specific needs. But I think it's important that in this year, in 2015, when we are discussing the new development agenda, we should make sure that children are at the center of this agenda, and we must make sure that every child everywhere gets the education they're entitled to. So that we do not fail this poor girl in a rural area in Malay, a poor boy with a disability in Vietnam, or a Syrian refugee child in Lebanon. Because together we can, and because we can, we must invest in education equitably and effectively for all children everywhere. And I know that's a sentiment that is shared by my three partners here behind the table, so I'll give it to them to further elaborate. Thank you. Thank you for sharing these results of the report, and clearly there's a sense of urgency for more investment and equity in education. Mr. Braun, education has been an issue that's been close to your heart for a while now. Would you share with us your perspective on this important issue? Yeah, I want to thank, first of all, UNICEF Tony Lake and Yoko for this amazing report, because it covers evidence from every continent about the level of inequality in opportunity across the world and the effects on the economy, on health, on society of failing to do enough about it. And I'm very pleased to be with Klaus and with Angelique, and let me say there is no more powerful advocate of children's rights than Angelique, who is revered across the world, not just for her wonderful musical talent, but from putting the case for children wherever she goes. And I want to start with perhaps an illustration, the one that Yoko finished with. If you look around the world, we have a crisis, a children's crisis. It was said once that the only international language that the world understands is the cry of a child. But it seems to me that over the last year, in crisis after crisis, we have neglected children, even in the most difficult, precarious and sad situations. And I want to take an example at Lebanon and Syrian refugees. There are 500,000 children who are exiled from Syria in Lebanon. The Lebanese government agreed that they would provide educational places for all of these children. The teachers were persuaded that these children should be educated in Lebanese schools. The government agreed to double shift system in the schools thanks to the work of UNICEF. 100,000 children are now being educated in that way as a result of money that has been provided. But there are 400,000 children this year who could be educated, who are refugees, who are now on the streets, who are the most vulnerable children, where child labor, child marriage, child trafficking can be forced upon them, because the international community has failed to recognize that for only $1 a day, we could provide in existing schools educational opportunity for 400,000 more children. And this in a crisis is usually a case of us saying that there is a need, but it's difficult to find a way of doing something about it. We have the schools. We have the teachers. We have the agreement of the government. We have the plan. UNICEF has drawn it up. But we have not been able to find the extra $136 million in international funding that is needed. So here we have a crisis for refugees who may be in Lebanon for another 10 years for all we know. Here we have a challenge to the international community where for only $1 a day with school places available, we could actually get children into school tomorrow. And here we have a government, probably the most troubled part of the world, where a government fighting its own battles to try to get its own public on board for this is prepared to risk everything to allow these children to go to school. But we, the international community, have failed to provide the resources. Now I'm convinced now that we need an emergency fund for education where there are humanitarian crises, that countries should put upfront money to make it possible for UNICEF and other organizations to provide help for children when they're in urgent need. We shouldn't have to wait a year or, in this case, more than a year for some help to come when we have a plan and we know we can do something urgently. And the importance of education in a crisis is that, while, yes, every child needs shelter and needs food and nutrition and needs health care, a child also needs hope. And it is education and the chance that you can prepare for the future. You can plan for a job or the prospects of employment as you leave school. It is education that more than anything else provides hope to children in the most difficult conflict situation. Now, half the children out of school in the world are in crisis countries where there are conflicts. And the last year has been a year where we celebrated the 25th anniversary of the Convention of the Rights of the Child, but it is a year that has been more marked by the violation of the rights of millions of children. And unless the world wakes up to the fact that for a small amount of money per child we can make a huge difference, then we are going to stagger from crisis to crisis and with all the best will in the world from UNICEF and other organizations, if the international community will not provide support, we will not be able to deal with these problems. As has just been said, aid generally has gone up over the last five years, although it is under pressure now. But education aid, particularly aid for basic education, has gone down. And we neglect it at our peril. And what this report makes absolutely clear is the consequences of doing nothing about this. In 50 years' time, we will still have girls in the poorest countries in the poorest areas and the poorest families of Africa who will not even be in primary education if current trends continue. In 100 years' time, there will still be girls in particular girls in the most remote parts in the poorest areas because we have not done enough who will be denied the chance of secondary education. We've just heard of 650 million school age children, primary age children. 120 million of these or more, 130 million, I think the figure actually is, will be out of school by grade four. About half these children will not have sufficient learning to enable them to have skills by the time they are out of formal education. And half the children will be out of primary education before they should naturally end it. And the inequalities are such that while 6% of graduates in sub-Saharan Africa are in families where there's poverty, 19% of people with secondary education, 28% with primary education, it's 50% for people with no educational opportunity at all. And so there is a direct relationship between educational neglect, poverty, bad health, and inequality. And unless we recognize at the center of the future of the world is providing opportunity and bridging this gap between the opportunities people have and should have and desire and the opportunities that the capacity of the education system has to deliver them, then we will continue to fail the children of the world. So this is a challenge, I think, from UNICEF to the business leaders at Davos, but also to the rest of the world, that their report shows glaring inequalities, a yawning gap between what should happen and what is happening. And it's time for us as a world to take the action that is necessary. All the research in the world proves that unless we act, the opportunities available to children will be miniscule in many areas in 2050, as they are now. And therefore, this is a call to action that I and others would want to support. Thank you, Mr. Brown, for this very, very powerful call for action. Let it be heard loud and clear. You mentioned the business leaders and their obligation. We have somebody here with us on the panel, Mr. Koos Timmermans, who is actually active already. And he can kindly share with us his perspective on why private sector should be involved from your perspective as from the ING group, please. Sure. I'd like to share from our company, from ING, which is a bank, like how we do it and why we do this. I think for us, it's already a long time ago we started this. If you're working in a bank, then you find in general that you have lots of clients. And those clients, they have from time to time difficult financial decisions to make when you move houses, when you get married, when you get children. And what you find is educating your own client base in what type of decision to make is already a challenge, let alone to think about a lot of non-clients. What can we do in other communities to help? So I think already a long time ago, and I'll come back to it, we said, like, well, what we need to do is to set up community investment program and making sure that we start to do something with particularly children to make them financially more aware. And that starts with education. Why do we focus on young people? In general, we said, like, well, good habits, they start early, so it's better to start programs at an early age. So we wanted to make sure that we set up programs to help people educate and to also help financial awareness. What do we do? I think overall, both Gordon and Yoko, they have explained even better why this is important for children, why this is important for society, and I can only subscribe to that. I think what is more important is what are we doing as a company on this? So what we did is already in 2005, we started in our whole bank a program which is called Chances for Children. And what we said is let's now focus on all the programs which are run locally in each of these countries. And let's try and put a scale behind there. Because in fact, what we already had is once local partnerships in each of the countries and employee involvement. So an example of that would be even in a country like the Netherlands, I mean, developed, we still have schools which are less fortunate than other ones in certain areas. So I myself do some teaching there as well, which is partly a humbling experience. But it's also a good thing to do. So that is the local program. But next to that, we said we need to have the more international program, and that is basically looking at global educational initiatives. And that is what we do with our partnership with UNICEF. Now, why do we do that with UNICEF? I mean, reason for us is very simple. We will have a bigger impact if we do it together with them than if we do it on our own. So that is the reason why we do it. We can accomplish more. So for instance, we right now, through our partnerships, we have programs running in Brazil, India, Ethiopia, and Zambia. And in essence, what we do, the aim of our partnership is to make sure that we give children access to quality education. And what we do with that is we try to help also to work with the United Nations. The ambition we have for 2015, the development goal that every child has access to primary education. Where are we on this ourselves? I think as a company, what we have done is still so far. We have reached basically a million children with education. And it's something within our company, which is easy to explain, because money, although it's a concrete thing and banks work with it, targets like having children giving access to education is a very visual thing. And I must say it inspires our employees as well. So how do we do this? I mean, our employees there are participating, volunteering, doing all kind of work and fundraising activities. And the simple thing what we do as a bank is we basically say we top up. So in other words, every euro you bring in, we add a euro to it. And that combined makes us the program which we have. And it works for our customers that like it, our employees like it. So in that sense, it's an inspiring program. We do it for the long term. We have done that already. We have celebrated a 10-year anniversary with UNICEF. And I think we have just signed an extension for the next three years. So we are moving also to a next phase of collaboration. So what are we trying to focus on right now? And actually, that will be new. And it's something we have to see, like, how will that work? And that is, how can we support adolescents as well? And in essence, there you also try to see, like, yes, there's various groups where there is social exclusion, where there's inequality, and where there's poverty. How to reach them and how to make sure that they have a better future for themselves is something which is interesting and which will be our next part of focus. So if we can reach these people and if we can make them self-reliant, then I think, like, hey, we're getting successful in this part. And that is where we're looking forward to start working with you and make that program work again. So this is basically the motivation, the results, and the things we are doing on this. Thank you very much for sharing this business perspective with us. I think it's very encouraging to see that you're active like that. Anjali Kiccio, you are and have a powerful voice. And we spoke earlier about your own educational experiences. Would you share with us your experiences and also your perspective on this issue? And what do you think education matters? Thank you. I think that my mother and my father were leaders in education.  And you beach about it and you're angry about it. He was on the right side saying that. And my father was seen in my country as a very liberal man and giving us too much education. That was the thing that people say to him in his family and in the country. And my father used to answer people and said, if you don't educate your kid, what kind of future plan you have for them? And as a parent, they both invest in us all, especially the three girls out of 10 children that my parents have. Because the pressure every year on my father to withdraw us from school, to be married early, was there every school year. And I didn't understand why he get angry at people at time and why his answer was like, get out of my house. My daughters are not merchandisers. And I'm not selling them because they have a brain. They're going to decide for their own lives. And I hope that a lot of parents like that today. And we were not rich. My father was the only one with a paycheck. My mom was a housewife. But she was also educated. And therefore, both of them will speak the same language when it comes to education. And today I am who I am because of the sacrifice of my parents. One salary, book, tutoring, uniform, whatever we needed was made available to us to learn. And at that time, the teacher were great. Today, we are having problem with teachers. The education that the kids are getting today, as the UNICEF report said, how many millions, 130 million, or 50 million kids cannot read or write? Which means that we have to scale up also the teacher that are educating our kids. My concern in education is that we people, I mean, I'm not talking about international community as a human family, we have a responsibility toward our kids. I don't believe that any parents being child to this world for the child to suffer. So if we know that education is key for the success of that child, why don't we do it? In the Western country, it's easier to certain extent. But in Africa, it's said, it perceived that when boys go to school, it's more profitable for the family, not girls. And the problem we have in Africa is that the status of a girl when you're born, when you're born a girl in Africa, you don't have an identity. You are the daughter of your father that can marry you at any age into anybody he wanted to.  So school, building up school is a good thing, but also we have to also start vocational education for the parents that cannot go to school anymore. With my foundation, Batonga, secondary education I do, because I understand that in order to transform my continent, we need highly educated girls. Secondary and tertiary education are key to transform completely our society. Primary education is important, and early education too is important to get to that point. But once you educate a girl from secondary education three years through the secondary education, if there's no drop out, that girl is continuing all the way to university. And what it gave us is that those women come back to put their boys and girls in school and they educate them differently. So what we are talking about today is, for me, we have to have a holistic approach of education. As you said before, we cannot carve education, one system of education for everybody. Not every kid learned the same way. I was in Benin with UNICEF two weeks ago and visited a program that we called the Second Chance Program. Because we have kids that drop out of school between 10 and 17, and how do we get them back? Some of those kids are already working their apprentice, and we have a deal with the bosses to give them seven hours in the year for them to have at least the primary education degree. And if they want to continue, they will continue. And while I was visiting that program, a young boy called Ulrich said to me, I'm learning mechanic right now, but it's just to understand how mechanic work to be able to implement that mechanism in politics because I want to become the minister of interior in my country. I said, what? He said, yes, I said, well, I mean, if you become a minister of interior, what are you going to do? And then he said, I want to take off my country as I take off my family and my home. And that boy is just 15 years old. And you see, when you go to the people, the kids that we are trying to educate, and you talk to them, they teach us more and make me all more humble to do what I do to them to be the voice for those people that we won't see. I'm not doing this to be famous. It's not my point. It's not my purpose in life. It's because I believe deeply in the people of my continent. You give them the chance and you empower them. You don't pity them. You don't dehumanize them.  That's where unicef is powerful because we work with local people. We work with the people that we are helping. Therefore you have result. If you sit miles away and pouring money into it, patronizing the people, you leave and they withdraw the kids from school. They say, ah, it's not important. How do we make parents in Africa understand how important education is? By role models, by giving them example. How many mothers have come to me and said to me, I want my daughter to be like you. I want them to go to school. Some will come to me and say, we wanted to see if it was you. If it's legit. Because people come and use your name. But if you tell us that this is important, we will follow up. We will do it. So what I do basically as a unicef Goodwill Ambassador, I am the voice of the one that have no voice that we don't see. Because you can help people by just seeing numbers. Numbers and data are important.  They are not the kids. Yeah, but my parents don't have the money. Okay, come here, come stay home. We put you to school. With one salary, not only my father put 10 children to school, but I will say he spent, he sent at least 100 kids to school. And some of them come back. They have jobs and they come back home and they say, this is what we are doing. I believe in giving back. And we cannot talk about economy. We cannot talk about peace in the world. We cannot talk about capitalism without talking about education. Because you put the message out there and people don't understand it. It doesn't work. I've seen example of solar panel when people go take it and sell it. If they were educated, they understand that that solar panel is making their life easier and the life of the children easier. Education is the core, is the foundation of everything we do. And I know it's hard because it's a long-term investment in education because you don't not have the result right away. But if the CEO of this world will continue being rich, wanna save capitalism from chaos, they have to invest in education. They have to help UNICEF, they have to help every organization and lobby with us, with the government and help the government that want to do something in that regard. The tax revenue of some countries in sub-Saharan Africa, as we were talking about it with Mr. Gordon Brown, is too little for them to invest much in it. So how do the corporation world comes to the rescue of what they can give? What is the budget of a country? Why don't we double that? When we come and say, we're gonna put 4% out of the 8% revenue, we give you 8%, we give the 4% and then we're gonna move forward and putting disabled kids and boys and girls in school is becoming more and more crucial because if we educate the girls and we don't educate the boys and they come back and mind those guys, it's like we've wasted money. If the, I mean, in some of the culture that we have, we have to face it. Some men don't want the girls, the wife to be educated because they see it as a threat. So if we educate both of them, then what we do is that the gap that we're talking about, we reduce it because they're gonna help us put other kids to school. Let's invest in education to live in the world of peace and take the fuel out of the terrorist group. All those angry people out there because they felt left out of the system that we have today. Our young kid in Europe, in developed country to are reaching out to those groups, we failed them because there's no opportunity given to them. Some of them goes to school and they have a lot of degree and they can't work. And I think for the stability of business world, of WEF, we need to give the young kid in the developed country and in the non-developed country, hope, perspective, challenges and opportunities. Thank you. Thank you very much for being such a powerful voice on that important issue. Mindful of the time, we will now open the floor for questions from audience here in the room. For the benefit of our audience online, please, if you could state your name and your organisation. There's a microphone available, thank you. Gentleman in the front, please. Hi, Jim Edwards from Business Insider. I have a question for Mr. Brown. On the 130 million shortfall you said would have been needed to educate the 400,000 kids in the refugees in Lebanon. What about the... It's great that Lebanon has a government that wants to do that and has the ability to put on double shifts inside its schools to do that.  How do you do it in those countries? We've got to look at different ways of dealing with crisis situations where there are humanitarian needs and obviously every country is different. But the point about Lebanon that I think people should understand is the barrier to action here is not the failure of a government, not corruption, not the lack of transparency, not the inability to organize things. The failure is the failure of the international community to provide support. So $100 million has been provided and I want to thank the governments that have put up money. But $163 million, as the figure, is still missing. And therefore, education that could be provided for roughly a dollar a day for these children is now impossible. Now, if we cannot show people that we can take action where the government is willing to do so and where the teachers have supported the scheme and where schools are actually built already, if we cannot prove we can do it in these situations, it's going to be difficult to prove to other countries that the international community will support them in a time of difficulty. And if we wish to expose the failure of other regimes to take action, then we've got to show what can be done in situations where the international community can make a difference overnight. So I've no doubt if we looked at South Sudan today and we have had a plan for South Sudan, which has been a crisis-ridden country for taking action, we would do it in a different way. We would involve the churches, the voluntary organizations, the charities who want to do more in that country. I've no doubt if we looked at the problems of Boko Haram in northern Nigeria, our concept of safe schools is more relevant there. But the truth is that if the international community cannot respond when there is a plan that is viable, that can make a difference overnight, then you're not going to persuade people to make changes in other countries when they need to be changes. You're not going to prove that you could make a difference there if you can't make a difference here in Lebanon now. Thank you. We have a question in the back, please. Ken Choi from Chosun Daily Newspaper, Korea. I fully support what you guys are saying here. No doubt that education is the most important thing in the world. But I'm just wondering if you are aware of the situation back in China, there are about 100,000 North Korean refugees and suddenly children out of these North Korean refugees are, you know, they are not citizens. They are non-Pasana, non-Rata. And for that matter, they are totally deprived of education. And, you know, it's a growing concern for a lot of people in East Asia what to do with these people, how to educate them, and things like that. So I'm just wondering if UNICEF is aware of or if is there any programs like that and if, you know, the government of Korea or media from Korea can do something about it. Well, look, South Korea and China are two countries that have invested in education heavily. They believe in the power of education to change lives. And I think whatever the political difficulties, most people would agree that where there are refugees and where there are children who are vulnerable, it's important for humanitarian reasons to take action. That's true on the borders of Afghanistan and Pakistan where there are stateless citizens where we need to act. It's true in other countries in the Middle East where there are refugees that have come out of Lebanon but also out of Iraq now. And it would be true in the case of any refugee in Asia. So we need to understand there are many kinds of humanitarian situations around the world and that's the argument for having an upfront fund so we could actually take action immediately. And UNICEF and other international organizations are in a position to make a judgment about where help is most needed. And I believe that with the traditions in education, South Koreans and Chinese people would in the end wish to help also. Can I just add, just to emphasize these points, I think that's exactly the point that the report also makes that we need to invest in the most marginalized and the most disadvantaged children. And the second point indeed, that really again also points to the fact that we're just not spending enough money in humanitarian settings. Like every child has a right to education. I mean, it's despite the political or otherwise circumstances that they live in. Thank you. Lady, these are the last two questions we can take. But please, thank you. My name is Isabel Saco, I work for the Spanish news agency. You say that what is more striking for me is that you say that most of the public money for the question in the poorest countries go to the wealthiest family children. So why this is happening? What is this planation for this? And how do you model or what is the methodology of this report? How have you found this inequality? Did you go by neighborhoods? Did you go by schools? How do you find this disparity? Let's take the second question first so we can maybe answer this. Can we have the microphone in the front? The gentleman here in the first row. Thank you. Thank you. I'm David Cerroto with International Business Times. I have a question about funding and structures. In the United States, there's a big debate about public education and what kind of public education should exist, charter schools with teachers unions. The Gates Foundation has been a big proponent of charter schools. My question is, when you're calling for more funding for public education across the globe, does that come contingent on the type of funding for the type of schools? Are there strictures on that? How do you make sure that the funding is for the right kinds of education? Who makes that determination? My question on the modeling also, if you can clearly put apart children going to private schools, because in the pre-releases seems to be like all children in society. But part of the families, the children goes to private schools. So public money is not there. OK, thank you. On the inequity point, I think there's several reasons for that. And as the report also points out, it's very context-specific. But obviously, getting to the more marginalized and more disadvantaged children and getting them into school in a lot of contexts is more complicated, because you're also talking about the poorest. They have less voice. The rural areas are less able to make their points about the importance of getting the education there than urban already educated people know how to make their case. And as I said in my example, it is actually possible to turn it around. So the examples I gave, for instance, of Bangladesh and Togo, and the more in the report, is that it's possible to change that and to get teachers to actually go to these poorer areas, to these rural areas, to those places where they're actually more needed than where they would normally go if you don't provide the right incentives to them. So we can actually make that change, but it doesn't happen automatically. You do have to focus specifically on how to reach the most, well, basically, the kids that are most in need. I think also on the public education front, I mean, the point is that, of course, each country, each government, civil society, people involved in education set their own programs. I mean, it's obvious that what works in the US would not necessarily work even in the UK or leave alone in Africa or in Asia. So I think we really need to be careful not to sort of come up with blueprints of things that would work everywhere. And I think it's up to UNICEF and others to sort of sit with governments concerned and actually make sure that we design the right programs based on an analysis of what the proper bottlenecks, what the exact bottlenecks are. I mean, why are we not getting kids into school? The reasons are obviously not the same in each and every country, but we can do the analysis. And what the report actually says is that there are ways to reverse that trend to reverse that policy that is now preventing them from getting into education. Just to finish that off, I mean, there are two issues here. One is, of course, the right of individual countries to make their own decisions about how they shape their education system according to the needs and their economic policies and their social objectives. But there's a second thing, which I think you're really referring to, which is international best practice and how we can disseminate the best practices that exist in some countries and persuade other countries that they're worth looking at. And I think we are learning that the quality of teachers, which of course is what the Gates Foundation has emphasized matters, the quality of head teachers and leadership in schools matters. The curriculum itself is an issue that has got to be debated at all times because you've got to learn from what works and what doesn't work and how you meet the needs of your own generation. And I think there's an additional element of how you apply technology and use it most effectively to build up success stories, entertainment, and education. And that's not at the expense of the teacher, but it's actually using technology and teaching together to create better outcomes. So I think international best practice is moving us in these directions, which learn from the experience of charter schools but other schools. And while there's a debate about Singapore, China, Korea, and all the successes there as well, I think these four elements are vital in every internationally successful model that we see. And the point of technology and accountability, so linking those two up so that it's much, we should get much earlier and better feedback from actually parents and children themselves about what works and what doesn't work in school. I think we need to work. Thank you very much. I think we have to close your mindful of the time. There will be time for questions bilaterally, I'm sure. And please go to the website of UNICEF and find the report there, the investment case for education and equity. Thank you very much. Thank you.


The City of Richmond and the Richmond Community Foundation are partnering in a program to combat housing blight in the City of Richmond funded with social impact bonds. My name is Joshua Gensler. I am the chair of the board of the Richmond Community Foundation. Richmond, California is across the Bay from San Francisco, a little bit north of Oakland and Berkeley, a city of about 100,000 people. Its main claim to fame is during World War II, it was the site of the Kaiser shipyards, at which thousands of victory and liberty ships were built that transported men, materiel, and ammunition around the world to enable this country to fight that war. That was the effort that gave rise to the legend of Rosie the Riveter. During World War II, the City of Richmond grew from the size of 20,000 to a population of 100,000 as people poured into the city to work in the shipyards. And women worked, of course, that's the Rosie the Riveter. People of color came and worked next to people not of color, not always happily, and gave rise to a lot of tension. But eventually, the war ended. And when the war ended, the City of Richmond was left with a population of underemployed, undereducated people, a substandard housing stock that was built to house all these people that had poured into the city, and an ethnic mix at a time when that was not considered a virtue. And the city was then and thereafter stigmatized as a place that was less attractive to live in than many other places in the San Francisco Bay Area. Fast forward 70 years, and the City of Richmond in many ways has still not recovered from World War II. We have many challenged neighborhoods, and in those neighborhoods are many blighted homes. The City of Richmond Housing Department estimates that at any given time, they have a list of 120 boarded up blighted homes that they are managing. They're evicting the drug dealers from them. They're evicting the squatters from them. They're whacking the weeds. They're boarding them up at a cost of $7,000 per house per year. Now, how can this be? How can they have all these boarded up blighted homes at a time and a place in the San Francisco Bay Area where housing prices are so high and climbing so fast? We believe there are five reasons. One is the foreclosure crisis. Many banks began foreclosure proceedings, and people abandoned their houses, but the banks didn't always complete the foreclosures because the banks didn't want these houses anyway because they were not assets, they were liabilities. And banks were not equipped to manage a blighted house. People die. And people die sometimes without family to take care of their affairs or with family that aren't equipped to take care of their affairs, and their houses and their assets remain in limbo. Taxes. They grow delinquent on their taxes, and the penalties and the interest add up, and the code enforcement fines go on to the tax bill, and the amounts of money simply become too great for people to afford. And the tax assessor won't even put these properties up for sale because they believe that they will not attract sufficient amounts of money to sell to cover the tax bill. Sometimes people just can't afford to maintain their houses. They simply go broke and they allow their houses to deteriorate. And finally, there's the ill-fated neighborhood stabilization program, which was the administration's attempt to address the foreclosure and blighted housing crisis during the financial meltdown. And it was not a successful program, and the city of Richmond has an inventory of houses left over from that program. How are we going to address those problems? We're going to go talk to the banks, and we're going to say to the banks, foreclose. Finish the foreclosing process, and then sell us the house right away. You will never have to own this liability. We'll take care of it. We've asked the public administrator to expedite the administration of these homes owned by deceased owners. The public administrator is, as my friends, the estate lawyers say, the place where properties go to die. But we are encouraging them to make the priority of these things to get them administered so that they can either be bought out of probate or go to tax sale and be bought at tax sales. We are going to buy houses at the tax sales. We don't need to make as much money as a private investor would, and we can take larger risks. So we'll pay more to buy at a tax sale. But more importantly than that, the city of Richmond will rebate to us the amount we pay at a tax sale that is from the code enforcement fines. And so we have a pay for success, a success payment aspect to this that gives us a competitive advantage at the tax sales. A number of people have simply approached us, the Richmond Community Foundation, when they heard about our program and asked us to buy their houses from them. So we expect to buy some of these houses in simply negotiated private transactions. And the city of Richmond is going to sell us their inventory left over from the neighborhood stabilization program. Now, how are we going to pay for this? This is the coolest part. We're paying for it with what are called social impact bonds. The city of Richmond has issued $3 million in revenue bonds, but the city has no obligation to repay those bonds. It is not a guarantor of the bonds. The bonds are payable solely out of the success of the program. That $3 million is going to be given to a limited liability company operated, of which the foundation is the sole member. And that limited liability company is going to use that money to buy houses, to fix them up, and then we're going to sell them. And then we're going to recycle the money. That money is going to be used over and over again for four years. At the end of four years, we're going to stop the recycling because we've got to pay the bonds back at the end of five years, accumulate the money, pay the bonds back, and any profit at the end of that five years gets divided between the bondholders and the foundation. Now, this is the first social impact bond program in the state of California. It is the only social impact bond program in the country that is actually bonds. And I'm very happy to announce that our local bank, Mechanics Bank, is going to buy all $3 million of these bonds with their Community Reinvestment Act money, and we expect the transaction to close any day now. And I said this is a partnership with the city of Richmond. Not only has the city of Richmond cooperated by issuing these bonds, but the city of Richmond is giving us a single point of contact with the building department so that we can expedite our building permits. And we have a number of other partners who are helping us with this. We have pro bono help from bond lawyers, from municipal advisors, from bond underwriters. We have real estate brokers who are working on discounted commissions. We have title companies that are giving us discounts on escrow fees and title insurance company and title insurance policies so that all of this can work together. The Richmond Community Foundation operates a program called SparkPoint. SparkPoint is a collaboration, is a single point of contact for 17 different agencies that help families in financial distress. Families can go to this one place and get the help they need to recover their financial health. Graduates from the SparkPoint program have money in the bank, have a decent credit rating, and qualify as HUD first time home buyers. The SparkPoint program in Contra Costa County, run by the foundation, has graduated over 100 families, but only six have actually been able to buy houses. The problem, of course, is that they can't compete with cash buyers. So what we're going to do is we're going to give SparkPoint graduates a right of first refusal to purchase the houses that we buy and rehabilitate so that we are going to attempt to put owner occupants in these houses. We're gonna do this at fair market value. This is not a low income housing program. This is an anti blight program. But nevertheless, we are going to give the SparkPoint people the right of first refusal. Now if there's no SparkPoint family available or the SparkPoint nobody wants a particular house or it falls through, we are gonna put it on the market and sell it. Richmond also operates a program called Richmond Build. This is a job training program in the building trades. Our contractor is going to be hiring people out of Richmond Build to work on the rehabilitation of these houses. That's me, that's the Richmond Community Foundation. Please stay in touch with us as we progress from this program. Thank you.


ask you something you can comment before. And Rishwin, who's on Hasgeek AB, who will play the talk, will take the cue from Rishu as well. So when he says over to the talk, Rishwin will play the talk. So if you want to, so you can play it free, yeah. We'll take the cue from Rishwin will play the talk. Is there a delay somewhere? Is there a delay? Yeah, there's some weird delayed echo. There you go. Hey, Jan, is it at your end? I had the YouTube window open at the same time. So I just closed that. That was maybe causing some. YouTube is delayed. So yes, that's the problem. No worries. All right, let's wait for folks to come in. Sorry, Jan, go ahead. Yeah. So we are live now. So we can start in two minutes, I think. Which means we are live on YouTube. That's what it means. All right. Let's get started. So welcome everyone. Great to have folks on this live chat. So today is the first talk that we're going to have on privacy as risk assessment and risk mitigation project hosted by root conf in collaboration with privacy mode. Now let's quickly want to touch upon what privacy mode is. So privacy mode is a program at Haskeek over here where we talk about technology and all the policies related to data protection and privacy from consumer and manufacturer standpoint, both. Right. I'm Rishu. I'm your host for today. I am a technology leadership consultant at Boston Consulting Group. And along with me, we have Jan. Jan comes with a distinguished experience of almost two decades across multiple companies such as Yahoo and He's born here. So we're going to hear from him in a while. Before we start, quick word about the project. So as in when user data is becoming more and more common places, getting more and more distributed across various companies and various firms for various technical use cases as we're moving more towards digitization, then you have new and new compliances that are coming up. And a lot of these organizations have to ensure that they are compliant when it comes to sharing user data, given how much of a concern privacy is in the current ecosystem and landscape. Right. If you look at a very simple example, GDPR was something a lot of organizations have to work on based on my own experience as well with companies such as LinkedIn and Visa. We had to ensure that almost decades worth of data had to be made compliant through and through because there's no window on customer data as such when these compliances are being met and they have certain legal ramifications as well. There's an upcoming PDP bill arising as well, which makes it very imperative for organizations to assess their privacy preparedness through the prism of data risk, given the amount of major leaks, data breaches that have become common place in the past half a decade or so. I think we all have a certain element of risk when our data gets exposed primarily as and when sensitive industries such as fintech are now moving towards account aggregators. They're also moving around, let's say, lending a lot of non-financial players who are new into the field are now coming in and more and more of people's personal and financial data is being distributed, which makes some of these compliances and how organizations need to and what all they can do as fast as they can in a very shift-left way possible to meet these compliances so that they don't get left behind in the product spectrum. Now, through this project, let's call it PRAM. Since a word we would love to call it because it's quite a long name without an abbreviation. What we want to do is we want to kind of have participants slowly become aware to design organizations top to bottom, how to manage privacy risk, how to manage data at a scale, how to do more and more shift-left of security validations, giving the consumers maximum amount of trust as in when consumers are going to entrust their data into their hands. Now, with that pretext, I'll quickly give a much more detailed introduction for Yan. Yan Hecking is a chief architect at Borneo. This is where most of the talk is going to be around the work he's been doing at Borneo. Again, he's a distinguished career almost two decades across the industry as an architect with some of the big names such as Aerospy, Yahoo and multiple more. And what he's going to primarily talk about is the shift-left and how to fast-track some of these compliance requirements across organizations. Before we start the talk, how we usually go with most of the Hasgeek and rootconf policies, please leave your questions in the comments, both on the YouTube chat window. And if you're joining us via Zoom in the Zoom window as well. At the same point in time, post the call, Yan will be taking questions. Feel free to raise your hand, feel free to on-air ask questions. We'll be super happy to answer both of them. Before we get started, quick plug-in about rootconf. I believe most of us already here are regular participants. Started in 2012 as a DevOps and an SRE practice rootconf has now spent more than a decade across the industry, bringing practitioners together to talk about not just existing but also emerging trends now. From DevOps, we've come to DevPsychOps. We've started branching out into MLOps, into CloudOps, into DataOps and Privacy. And our editions are usually organized in Hyderabad, Pune, Delhi, pretty much all over the country and our goal is to bring the industry practitioners together so that we all can learn from each other. And with that, over to the talk and looking forward to interacting with everybody post the talk as well. Thank you so much. Hello, my name is Yan. I'm currently the chief architect at Borneo. And here to the right, you can see a picture of myself with my daughter on Borneo a couple of years ago, one of our family vacations. So Borneo is a start-up based in Singapore. But our large part of our engineering team is actually based in India. We have been building what we call the guardrails of the data economy since 2019. And what do we mean by guardrails of the new data economy? So both myself as well as our CEO and founder, Britt B, have been working at large scale start-ups like Yahoo, Facebook and Uber prior to founding or starting Borneo. And at these places we saw firsthand how these companies were amassing large amounts of user data and the inherent value in that data. But also conversely the risk associated with that data. So for example, sensitive data, user data got leaked, we can potentially harm the reputation of the company and the road user trust. These companies were comparatively big and had large security teams and had the resources and the skills to build our custom solutions to protect the data of their users and make sure that it was protected adequately. But really what we have set as our mission at Borneo is to build tools that empower companies of any size to protect their customer data and prove user trust. So while with the move to the cloud, every company nowadays is a data company collecting large rapidly growing sets of data, not all start-ups have the same sets of resources, skills or tools to build their own custom security solutions. And oftentimes this leads to what we call privacy debt where potentially sensitive data is collected, but it's not secured adequately, the right security measures are not often put in place. And this can lead to data breaches, it can lead to other mismanagement of the data which in turn can cause erosion of user trust, especially if some of that data comes public. So the solution that we have built at Borneo basically allow our customers to gain real-time visibility first of all into their data sets. So at the heart of Borneo is basically what we call our inspection engine. Inspection engine is capable of ingesting large amounts of data from various sources through a set of connectors and is able to inspect that data and to detect any kinds of sensitive information. So we call this like sensitive infotypes. So examples would be passport numbers or credit account numbers, bank account numbers, but also just personal names, postal addresses, already any other kind of personally identifiable information, PII, or financial information or also healthcare or medical related data. So gaining visibility is oftentimes the first step to understand where sensitive data is stored and what is the right way to protect such sensitive data. So without Borneo, security teams can moistily meet their customer data privacy obligations even with limited resources. Today I wanted to talk about one example of how Borneo was able to help a customer of ours with a particular data or privacy data challenge. So this customer is a large Indian fintech startup. They have been around for several years and they offer their own prepaid credit cards as well as nowadays digital wallets and because they are handling such sensitive information, they have to comply with what's called the payment card industry data security standards or short, PCI, DSS. So that is a large set of security best practices and security measures that any company that wants to process credit card data needs to comply with. Depending on the volume of your transactions, you may have to undergo annual audits to prove that you are complying with these regulations. But really similar challenges apply to any other kinds of regulation, be it the general data protection regulation in Europe, the GDPR or similar laws in California, CCPA, PDP here in Singapore or the upcoming regulation around sensitive data in India as well. So when it comes to managing compliance with such regulations, we can really break down that process into three kind of high level steps and I like to call them descope, de-risk and document. So the first step in this process really is to identify which systems that make up your data infrastructure really handle the data that falls under this regulation. So in the case of PCI DSS this would be card holder data, so the actual credit card number, the expiry date, as well as the 3-digit or 4-digit verification code and the card holder name. So any system that stores or processes card holder data would need to be considered in scope for PCI DSS and would have to comply with the numerous security requirements. So there are about like 200 plus security controls that are specified as part of the PCI data security standards. So that then is the second step. So in order to mitigate the risk of handling such sensitive data now you have to implement all of these security measures to ensure that this data is stored and processed securely and is not abused. And last but not least it's not enough to just implement the required security measures. You also have to document if and how all of these security measures have been implemented or other compensating controls. So especially these last two steps can be quite resource intensive tasks depending on the size of the card holder data environment. So really this first step of descoping is imperative because any system that you can prove not to contain any card holder data would not fall under the scope of PCI DSS and therefore would not require the same level of security control to be put in place as specified on a PCI DSS. So really descoping is crucial in this process. But once again you have to be able to document to a PCI auditor for example that the systems that you want to take out of scope that they really do not contain any card holder data. So this Indian FinTech company we're working with we're already processing credit card data. So they were already compliant with PCI DSS but they were processing such data in an on-prem system which they had built over the years and in order to solve growing set of new use cases and to make use of all the benefits that the public cloud brings they are rapidly expanding the operations into the cloud and now the challenge they were facing is that they had to be able to prove to their PCI auditors as part of their annual audit requirements that all of that new data infrastructure in the AWS cloud did not contain any credit card data and was therefore out of scope for PCI compliance because otherwise they would have to implement all of the same security measures across all of the cloud infrastructure which would have been a very involved process. So they started by looking at their primary data stores in the cloud which was a leader of RDS MySQL instances and we're using Borneo to inspect the data in these MySQL instances and so basically what happens is Borneo will ingest data from every single table in each of these RDS instances and will inspect the data to determine what sensitive information if any was stored. So basically it will determine for each column what is the info type of that column so that could be an email address could be an IP address or it could be a timestamp or of course it could of course be a credit card number an expiry date or even a validation CVV code so that's exactly what this team wanted to prove that their RDS MySQL instances did not contain such data so after performing the scan which took just a couple of days they had all the metadata about all of the sensitive info types and were able to slice and dice that you know see exactly which of these tables were containing sensitive information and in the end also produce a report detailed report about the kinds of sensitive information contained in these RDS instances and you know these reports actually did show that there was no credit card data for RDS MySQL instances so without they were able to go to the PCI auditors and convince them that these systems were out of scope for PCI DSS compliance but unfortunately not all was good because they had also used Borneo to scan their S3 buckets so they had dozens of S3 buckets and storing hundreds of thousands of terabytes of data in them and unfortunately within a few hours of starting these sample scans Borneo had detected some credit card numbers in one of these buckets so that was the problem because now they had they knew that they had credit card data and at least one of their S3 buckets and they needed to find out why and clean up that data because none of these buckets were supposed to contain any card or data so when Borneo first detected credit card data it immediately raised an alert and also filed a ticket in the customers JIRA and so this ticket contained quite a bit of context already like specifically which file or which set of files had contained the data so it looked like these were some application logs that ended up in S3 but these files were quite large so as you can maybe see in the screenshot just as one example there was a wallet log file which contained more than 4 gigabytes of data so initially the engineering team was struggling a bit to pinpoint exactly where in this file the credit card numbers were found since Borneo had not detected a lot of credit card numbers enough to be a problem but not really a large amount but still so in order to pinpoint the system, the problem the source of the problem what the team did next is they again used Borneo to do a much more detailed full bucket scan so initially they had only run sample scans which just sample a small set of data from each bucket to just get a general idea of what kind of sensitive information might be included in the bucket but now they were running a full bucket scan and these scans generated a very detailed result of a list of findings with every single token that was detected including the line number as well as some other information about the context like some keywords that were found close to the match token that indicated the type of match as well as column names in the case of CSV files for example and these detailed findings helped the engineering team to locate the credit card numbers in the files and then based on the specific log entries to also determine the root cause of what was causing the credit card numbers to to get locked so as you can see here in this screenshot what had happened is that one of the systems was expecting credit card numbers to be passed as an integer number but instead the system was receiving the numbers as a formatted string and that was causing a number format exception and it looks like this was some error message from an ORM system or something like that so the engineering team was able to pinpoint that and suppress these kinds of logs going forward so going forward these logs would no longer contain credit card data so all of this work had actually been done as part of a trial that this company was running with Borneo in total it took about three weeks and the main outcome for our customer was that they were able to fast track their PCI compliance so Borneo was able to generate these reports and detail these findings within days whereas otherwise it might have taken the team weeks to produce the required documentation to convince their PCI auditors to take their AWS cloud infrastructure out of scope for PCI compliance since then the team has started using Borneo's commercial version and regularly using Borneo as kind of a general privacy observability tool to monitor their data environment in the cloud so they have by now established a baseline so they have a good idea of what information is expected in every single data store and whenever Borneo finds any sensitive information that does not match their established baseline Borneo will generate an alert either send them an alert in Slack or raise a ticket in Jira and with very minimal effort the security team can stay on top of their data security even as the application of engineering teams are adding new resources Borneo will automatically detect new resources new data stores as they are being added and automatically start monitoring them going forward what this team is now thinking about is how can they take this privacy observability and kind of apply it to their whole entire application development life cycle so instead of just detecting such issues where sensitive data is ending up in locks only once it hits production why not scan the locks of pre-production systems like a staging or curing environment or even development environments and look for such sensitive data there so that issues can be detected early and remediated before they become a production issue so we like to call this application data privacy management and it's just one of a suite of solutions that Borneo offers so from privacy observability to solutions for data investigations for example once you have detected a breach you know the impact of it as well as PCI, GDPR, CCPA compliance solutions as well as the next gen DLP so in addition to monitoring your cloud infrastructure Borneo also has a set of connectors for enterprise applications like Slack and GDPR sorry Slack or Jira or Google Drive so Borneo can also monitor data being exchanged through these enterprise applications and can look for sensitive data as well as application secrets or passwords for example and alert the either the security team or the compliance officers depending on the specific use case I hope this gave you a good idea of what it takes to kind of achieve PCI compliance at a very high level and how Borneo can help with this as well as with other data security challenges so thanks all for listening and happy to answer any questions you might have about Borneo, about the tech stack also we are hiring for our team in India so if any of you are looking for opportunities to work with large data sets exciting set of technical challenges feel free to reach out thanks, bye alright thanks a lot for that talk Jan and for everyone who is listening in we have the man himself Jan over here to feel any questions that we may have from audience before we quickly get started first up Jan this looks really amazing having worked with multiple clients and having been a part of down in the trenches I can attest to the fact how big a concern data privacy scanning and continuous security scanning a problem this entire thing becomes for most of the industry so this looks amazing amazingly well done something that I think is very plug and play while we are waiting for questions from the audience I probably have certain curious questions of my own being a practitioner so one of them was that as you said that we can go ahead and do sample scanning of some of the data we can run full length scans as well right the question here is that usually when teams try to move fast you know typical DevSecOps model or you know there are new fields that keep on getting added right so teams maintain a separate data catalog sometimes as well teams may keep on adding newer fields so how does Borneo get updated or get wind of these new fields altogether is it that it gets connected to a data catalog that data catalog has to be pushed to Borneo because it has a catalog of its own how is it like a rule based engine how does that work if you could tell us a little more detail sure yeah thanks for the question Rachel and great to be here and talking this forum so yeah as you rightly mentioned like with modern companies having lots of data in the cloud new data sources are being added tables are being extended security teams to be on top of all of that because typically the application development team the product team is much bigger than the security organization you know and product requirements keep changing and due to that also the data environment keeps changing and security teams are used to being very reactive just reacting to problems as they come up so what we are really trying to do is to give them tools to kind of stay on top of that to get a good understanding of the visibility of all the data that the company collects and coming to the technical details so since data size in the cloud are just enormous especially the rate of change if you just look at some transactional tables where companies millions of users are transacting all the time it's kind of impossible to do a full scan continuously on all of the data like you know even keeping the data sizes and S3 in mind so we've focused on kind of providing a good trade-off between gaining enough visibility understanding of the data sets while also being cost efficient and resource efficient so we're doing a lot of intelligent sampling so not scanning every single record that gets updated but talking about structured data especially now like your typical MySQL database or it could be like snowflake table as well or any kind of structured data so we do regular sample scanning on those tables as well and we do get the table schema when that changes we can detect that during the regular sample scanning so we can detect that for example maybe a new column was added to an existing table so then we do the next step the deep data inspection so we're not just looking at the metadata the column name in some cases might already be indicative of what kind of data might be stored in the column but you know increasingly you also have kind of a mix of structured and unstructured data you might have MySQL database but you have a jsonb column in there so you have like a rich data set a single value inside that column so just looking at the column metadata like the column name might not be sufficient it might just say like event data or something like that which doesn't really tell you what kind of data is actually contained within there so we actually look at the data itself we run it throughout inspection engine and we discover what is the actual data like is it just timestamp is it maybe user information email address or something possibly even more sensitive and for each table we kind of keep we keep a schema of each table not just the actual table schema but like the table schema that we have detected in depth based on our inspection engine so when new columns are added and we detect that the new column for example contains sensitive information that's not existing or that was not previously existing in the table it's not part of the table's baseline then we will go ahead and raise an incident and notify the security team either sending them over via Slack or raising a ticket in JIRA or just sending it into their Splunk or other SIEM system so that the security team can then react on that and the second part of the question you were asking about integration with the data catalog so we actually recently launched integration with data hub so that's the open source data catalog originally from LinkedIn but now there's a couple of commercial vendors so what we do there is we sent that same kind of information about the detected info types into the data catalog so for example if in your data catalog you have an entry for a particular table and we detect that one of the columns in the table contains bank account numbers for example Bonnie will then make a suggestion in the data catalog saying this table or this column seems to contain bank account numbers and then it's up to the data custodian so the team that owns that data to confirm whether that's an accurate assessment or whether it's an incorrect assessment, maybe Bonnie or mis-detected something and that information will again flow back to Bonnie so we get the feedback of whether detection that Bonnie has made is correct or not based on the judgment of the data owner Got it, thanks for that another question that just came to mind is that usually what happens is that as you said when structured data it's a slightly different thing as compared to unstructured data on S3 buckets and you also talked about how expensive full table scans can get that definitely is there but is there a way that Bonnie can actually do incremental snapshot scans so usually for example let's say if I have a huge database it could be any let's say MySQL where I'm taking incremental snapshots, can Bonnie go through the incremental snapshots and scan them on let's say a nightly basis when the snapshots are taken and quantify them saying that okay I'm going to gate this because the snapshot is not clean enough to go into the data store, is there any such We don't operate on snapshots at the moments we operate like in the case of MySQL or other relational databases we sample data directly out of the table itself it really depends a bit on the connector for example we do have support for S3 to detect new files or new objects being added into an S3 bucket and to focus on scanning new objects that are being added but even there we see some of our big customers the rate of change like the number of objects being added to S3 buckets can still be so huge that it's infeasible or not cost effective to sample or to scan every single file so even then we still have to apply a sampling on top of that and maybe only look at every 10% of all new objects being added into a bucket that makes sense and coming down to the rate of change usually what has happened is over the years what used to be your security testing penetration testing a lot of security validations that used to happen have been moving more and more left into the entire DevSecOps pipeline right like for example now there are CI CD pipelines that will essentially run sonar cube or check marks or any other code scan and they'll just simply flag the code at the pull request level itself saying that oh wait we are looking at something that could be a potential threat based on certain signatures now that is code which means that that's running on it but how much of this shift left can Borneo introduce as of today that is one question and what is it that the team at Borneo is targeting in terms of data moving forward as well and I understand code versus data are two very different things because code is still a deployable quantity data is not a data is more a dynamic entity because it keeps flowing in but just want to understand how much of that shift left is possible today versus what is it that the Borneo team is targeting. Sure yeah great question so yes we are focused mainly on data so we don't do static code analysis or anything like that at the moment but really we want to help the security team understand where their data privacy risk lies and so in terms of shift left what we currently do or could do is basically look at data flows before those applications reach the production state so one kind of proof of concept we've done in the past is looking at API data since back data that is being exchanged by an API either data sent to the API like it might be a user's browser who uploads some sensor information to a web service API so we can interject or intercept that data and inspect to see what kind of data is being submitted and then detect over time if there were any changes if the API suddenly starts collecting new user data that was not previously being collected and conversely also in the reverse direction like what data is being transmitted by that API back out to the user or in the case it might be between two different systems so there are several ways you could go about doing that inspection you could either have like an SDK running inside the application think of something like New Relic which has like an agent running inside your application and kind of monitors the performance of your application so similarly we can interject intercept API calls inside the application and just monitor the data which would be to have something at the network level to kind of intercept the packets between the client and the application and do the inspection at that level so it kind of depends on how far left you want to go so this could be something that could be running like in an automated CI environment where you can do like automatic capture of the network traffic and analyze that another option would be to look at the log files that are getting to see if there's any sensitive data in those application logs so there's various approaches we're kind of in the evaluation state right now talking to a lot of customers trying to find out where their most pressing needs are and trying to find a solution that would work across our large part of our customer base sounds great thanks for that and to be honest I'll be keeping you on for future releases from the Borneo team I think we don't have a lot of questions from the audience so I think we'll quickly apply the finishing touches here and Yan once again thanks it's been hugely educational hugely informative knowing what the team at Borneo is building and as we talked before it definitely solves a very very real problem something that at least I have seen almost on a daily basis right and yep and for folks who are tuning in or are going to be watching this once this goes live this as we said this is one of the first talks in PRAM right but we have a lot more incoming next one month we're going to have three talks from RazorPay and the details for those are going to be shared on the Hasgit social media platform as well as our website Hasgit.com really soon so if you haven't already just keep an eye on those and we'll be looking forward to catch some of those talks and listen from you as well and with that I think we're going to call it a wrap once again thanks Yan thanks everyone hope everybody has a great weekend moving forward thanks a lot bye