All right, so good afternoon everybody. Thank you very much for coming along This is going to be a controversial topic. All right, so I Want you to keep an open mind with everything I'm about to say some things are going to be provocative And deliberately so but I also want you to remember that there are nuances that there are exceptions that everything that I say is general rather than specific For those of you who don't know me my name is Evan Leibond For those of you who met me last year. I have since joined IBM So I now work for big blue as part of their wider organizational transformation towards agile So big change, but these topics are still my own. I do not speak for IBM when I talk about this. So No projects. What is no projects? Well, let's start at the beginning What is the project? project managers in the room What is a project? Teams joining together to achieve a certain objective. That's a pretty good definition. Who else? Temporary that's actually the key It is a temporary structure in order to achieve a change in the status quo Whatever the status quo happens to be whether it is a product whether it is a bridge. It doesn't matter. So The issue at play here is the word temporary Now those of you who understand concepts like knephen Calling back to Shane what Shane was talking about who understand concepts of complexity and complexity theory know that Temporary is the problem we have a situation in an IT construct in a software construct where a software project is Complex it is chaotic things change all the time. So the ambiguity the potential for change the chaos that exists within a project structure is Quite great and of course project managers no offense are going to put in place all of these controls and rigor and structures All right risk management processors schedule management processors change management processors and agile in a large part has spent a lot of time over the last 15 20 years in order to Make that bureaucracy make that process simpler and easier and more able to handle or manage the Fundamental chaotic nature of software, but I'm gonna go one step further. Let's talk about a few things Why not projects? Not why no projects, but why shouldn't we use projects? So the temporary They are expensive All right, there's costs associated with doing a project Overhead costs. What is an overhead? Well, it's you it's the project managers It's the cost of actually running that project Overruns here is the most important question. I'm gonna ask you all right hands up anybody Who has run a project that has delivered on time? on budget and to scope Anybody Outside of my team. Yeah, yeah, but even to be fair even in even outside IT. It's sometimes very hard nobody Very very very small ones. All right, so Here's the point projects fail So if the definition of insanity is to repeat something and expect a different result Here's my question to you. Why do we keep running projects? If you try something and fail and try it again, and it fails and try it again, and it fails and it keeps failing Time scope budget. Those are the three metrics that all project managers are measured by the iron triangle All right, time cost code if we cannot get any of those we cannot get those right Then is the answer to do better projects? Well, that's what traditionally that's what's been happening There's all these practices and processes PMI and so forth to try and make better projects I'm proposing all right that we change the dynamic all together. Let's get rid of the problem the project Another problem with projects they focus on the wrong thing All right, anyone who's run a project, especially in a larger organization Even many of the smaller ones the project is about the output The deliver this widget in three weeks or six weeks deliver this function this piece of software That's not important What's important is well the business what happens to the business after the fact So for those of you who have actually followed the conversation that's occurring around no project We'll probably understand or think that we're talking about product delivery products not projects And whilst that is legitimate. We can actually go a step further and say outcomes not projects And we mentioned that projects of temporary. I want you to do that. So This is a bit busy. I know and and and I'm breaking the cardinal rule of slides I'm giving you something really really really busy, but I'm giving you this for a reason. This is a I'm gonna get this right this word right phylo memetic view of the history of projects Specifically actually the history of agile Going back into Taylorism going back to 1870s and 1900s all the way up to modern day All right, so I'm showing you that what we call the current project framework Prince to agile These are not new These have built fundamentally on all of this which has come before From 1870 through to really 1970 everything on that board related to engineering Taylorism was fundamentally about manufacturing and yet we apply this Rigger where we can predict an outcome where we can predict I put these five things together and a cake will emerge the car will roll off the production line There might be a failure rate of one and a half per cent, but that's within acceptable bounds We have lean have six sigma have all these multiple methods in order to actually clean up and provide efficiency in the process All right, and in the 80s in the 90s. There was an even to the 2000s. There was a big push in Parallel to agile to try and make Software delivery more like a production line All right, does it does does anyone remember this occur? Yeah Some of you so this push to make agile more like a production line was predicated on the assumption that a Software product Could be predicted All right that function points and all these wonderful things around estimation all came together and gave us a predictable model of Software delivery Who here is a developer? Couple of you. Yeah. Yeah software art or engineering art Combination combination is both, but there's a part art if I'm building a bridge I'm pouring that concrete five if I've got in the structural engineering There is no art in that Maybe from an architect and doing this from draw point a little bit of art But once that concrete starts pouring that's a science That's engineering the ability for chaos or for a chaotic change to occur is quite low so What I'm about to say is my theory all right and and I could be completely wrong because I'm extrapolating but I Think what this is what I think happened in about the 70s or the 80s there was a Movement by the software industry to be taken seriously there was a movement to take it out of the garages and the stereotype of the Guy with the big thick glasses Coding away and whatever else. I'm not looking me. I'm talking when the PCs are coming out and I think at that point in time Software struggled to be taken seriously. They wanted to be and science and engineering science All right, the term software engineer came out this concept of Yeah, we're like we might be an industry. That's only a decade old but take us seriously and That was fine at the time and that was legitimate, but they did that by Pretending to be an engineering science Pretending and going we can do all these things the engineers do predictability all these wonderful things at the same time as IT and software was trying to be taken seriously finance started getting involved All right, how long does a piece of software take to build? That is the question that everyone in this room has probably been asked at one point. How long will that take? Now finance know what finance loves predictability your finance division is built on the fact that you can predict a and b start and end and so when Software engineering started to wrap things up in projects finance went beautiful. We can do that All right, you can now tell me that this piece of software is going to cost one and a half million rupees It's going to take three months and it's going to be delivered this time cost scope beautiful They were always wrong. It never It was never accurate But it didn't matter to finance because they do their predictive forecasts 18 months in advance and then allows them to build their budgets So this is the problem these two things in conjunction as I said, this is my theory my hypothesis came to Create what we currently know as the IT project. All right. It is a finance construct that allows us to with a level of uncertainty predict how long something is going to take and deliver in that structure so Let's now talk about no projects Let's talk about getting rid of the fundamental construct of a project Now obviously we're not going to stop doing work. We still need to deliver a piece of software a piece of change but Here's the point It's Continuous now we no longer have this temporary structure with a team that Goes away when the work is done We now have a dedicated team who is accountable for a particular set of work a particular outcome Who works as a team and this could be big this could be a thousand people working together? All right, but here's the key. They don't stop All right. There is no Project end. There's no project wrap-up. There's no project. There might be initiation when you start something at the beginning And you form a team. All right. There's no handover to operations all right because We're building products. We're building something that has a fundamental value to our business And if we're building something that has value does the value Do we stop delivering values and no more value to deliver when we stop the project and that's the key question You run a project. It ends Can you honestly in your heart of hearts say we have delivered the maximum value possible? No Can anyone say that I don't think so. I I certainly couldn't all I can say is we've run out of budget All right, and the running out of budget is not the same as saying well We've delivered as much value as possible now. Maybe there are things that will deliver more value. Maybe there's other ways of Delivering something else that is better. Okay, so we're not saying that things last forever There is a natural end of life to a product But that natural end of life to a product is not the same as the end of a project and that's the point So what is no projects? Okay, I'm gonna break another card in the rule. I'm gonna read from the slide The alignment of activities or work to outcomes measured by value constrained by principles and Supported by the appropriate technologies to deliver change All right, this is Fundamentally what no projects is continuous delivery of value and I'm not gonna go a step forward and say that's irrelevant that goes beyond the product itself so The rest of this this talk is going to be about how How do you deliver? How do you change an organizational construct that is fundamentally built around delivering a project? into continuous change now I Will also caveat what I'm about to say. All right, this stuff is new Some organizations have been doing working in this way for years All right, other organizations are starting to do it now. I'm not just small organizations All right, I'm working with a bank at the moment a very very like a mid-sized bank and they're moving towards no projects so These are new these are new ideas, but you're also not going to be the first so This is part of what I call the Continuous culture now. I didn't come up with that name. I'm afraid I don't remember who did All right, I saw the word somewhere on the internet It's like that's pretty cool continuous culture and then I completely lost the link where I found that word All right, but that's the but that's actually a really good way of thinking about what we're doing All right, we've moved into this idea this space in the industry where Everything we do is continuous continuous delivery. Well, it started with continuous testing Automated unit testing continuous integration then continuous delivery continuous deployment All right, the the the Amazon models and so forth All right, and now we're starting to move into continuous business continuous legal continuous marketing continuous Well everything so our project construct doesn't operate in a continuous model All right, our project construct does not operate in a continuous culture environment now. Here's the question for you all All right Actually, let's do it slightly different everyone stand up There we go. I've got your attention so Think about your company your organization. All right, I want you to sit down if your company is not Moving towards a continuous culture in some way look around All right, I'm saying if it is sit down if it is not moving if you are staying with a non continuous culture All right, everyone around you All right is in some form going to this continuous culture. You can sit down again. All right now that's interesting All right because There are parts of your organization which aren't going to keep up now the topic of this talk is projects But your finance department needs to become continuous finance Continuous budgeting role that they're called rolling budgets. Okay, so there are other aspects of your organizations Which need to change to keep up with this continuous culture. All right So just keep that in the back of your head is that we're not going to talk about it But it is something that you will need to consider so where to begin I Want you to think about Outcomes not outputs Project deliver this widget in six weeks sure boss. I can do that I want you to reduce this set of reports in this business intelligence system. Here's the requirements beautiful Okay agile. Here's your set of user stories who what why okay? I know why that's good All right, but what they're still stuff to do But is that the right stuff to do I don't I'm just doing what I'm being told whether it's user stories or a BRS It doesn't really matter But we want people to become accountable We want them to own the work that they do So here's an example of what I call an outcome profile very simplistic All right, nothing really special about what's on here, but this shows you the idea of what I mean by an outcome All right, how many active subscribers have logged into our system? All right, so We have zero active subscribers right now Our target is to get 10,000 active subscribers in three months Now am I telling you what features to build? No I'm saying this team here You you are accountable to get this product from zero pre-launch to 10,000 active subscribers To be honest, I don't care how you do it All right, I don't care what features you build in Why because that's not important The business outcome we're trying to achieve is Gross now obviously we need the right people in the team Okay, we need users and we need different people who can actually have that conversation and no and the agile delivery model I'm not saying we don't do agile. I'm saying no project is a replacement for agile Okay, or for that matter any development framework. I'm just saying we get the right people We don't need to tell them what to do But there's and there's a big but there's a very very very big but okay. I cannot give you complete freedom.  All right, but We still have to have constraints now budget is a constraint But we also have what I call operating principles or working principles these guide and constrain how we work Now you've got them already your branding guidelines your security guidelines All right, all right your your work and your code guidelines your coding standards these you've already got nothing special about them So we build them in now. I personally think that guidelines these principles should be prioritized I like the Moscow rating. Okay, Master should could won't Why because here's a list of principles these ones you must comply with these ones you should comply with These ones you could comply with because every time I tell you to comply with something. I increase the cost of what you're doing Agreed So I say these ones are absolutely mandatory. You must absolutely must unit test every single piece of code You must absolutely must comply with these security guidelines. Okay, or gap or Any other legislative guidelines these ones are should the branding guidelines? You should comply with these if you've got a reason not to okay fine And these ones these are nice to haves. These are the guidelines that that good, but not necessarily mandatory make sense All right, so I'm telling you to meet an outcome I'm telling you what constraints you have in order to meet the outcome and then letting you go and Then I'm letting you as a team work out how best to deliver that but let's understand value So first of all everything that you do is meant to produce value now The first point is value is not measured at a micro level value is measured in aggregate each individual activity that you do Will have a probably minuscule impact to value All right because each activity is a day's work All right, but over time everything that you do is going to get those subscribers into your system so Four points to understand about value the first is value degrades You build a feature it is valuable, but the value of that feature will degrade over time All right You don't work in value order all the time All right very often down here. You're gonna work on low value items before your high value items That's your iteration one and two that's where you're doing the foundational work Maybe getting some database structures in place getting some test data some stubs All right, so we may talk about we're focusing on the value, but you got to do your hygiene your groundwork first All right You may reach a point of maximum value where everything that you do Doesn't improve what you're trying to achieve So sometimes you actually have to slow down to speed up Reduce the value. All right, our target is 10,000 subscribers. We've got to 5,000 nothing We do gets us above 5,000. Okay, every new feature we add does not add more subscribers So what do we do? All right, let's delete half the features All right lose a thousand subscribers and take a different path Now we're at 10,000 great So understanding The value of work The other one is the so what everything that you do. I want you to ask so what? What if I don't do it if I do not do this piece of work what happens? There's a very good litmus test for how important how valuable something is now The last point I want to make on this macro level of outcomes is about what I'm calling value delivery teams. These are Cross-functional teams These are teams who deliver They it's a cross-functional team. It's everybody that you need in order to deliver something of value All right, does that make sense? but I Want you to start thinking of them not in the context of a project not in the context of a Product even but in the context of an outcome If I give you an outcome increase subscribers, who do you need in that team? Five people ten people 70 people We can break them down into sub teams of seven plus or minus two All right, but who do you need involved to deliver that outcome? UX BA's devs testers doesn't matter and we keep going It may also be non IT. We need an accountant All right, we need a management accountant on on we need a HR person We need a sales person to actually go. We need ten market people So glad to go out and actually get those subscribers in the first place We'll build the features, but we need marketing to actually sell it So I want to talk briefly then about delivering work So everything is working is at the macro level outcomes, but let's go down now to the micro level activities now activities are interesting because activities give us a Necessary they're the you the discrete units of work that allows to deliver change Right, we don't work all the time So this is an activity candidate and there are different models and there's different ways of doing it I'm really just talking about the concept of an activity. This is the one that I like, but that's just me personally Everything that we do adds value to the outcome. How much value? Oh, there we go. That's that axis Everything we do will take time. How long? Well, that's that axis High value low effort first. Okay, that's pretty standard stuff. That's the order. We should be working in oops, sorry Here's an example. All right need to do a financial plan investment proposal. This is for a startup All right calculate the customer acquisition costs to the dirt. All right TNC's we need to do we need a landing page down here video marketing automation. Yeah, that stuff we can do later All right, it's hard. It's not as valuable as we want All right, this gives us what we need but this is act. This isn't a planning tool This is active management. We have an outcome increase subscribers to ten thousand in three months. That is our outcome We're trying to achieve What do we need to do and what is the order and the value we need to do in order to achieve that outcome? All right, this value delivery team. We should have users in that team All right, we should have if we're a vendor our customers in that team. Absolutely If you're not a vendor if we're building something internally put our users in that team But someone who is actually going to be able to help us determine the value UX HDD Whatever you want to call it All right, and we measure all right. This is lean startup stuff as well This is the concept of we have an idea we pilot we prototype it we prove it and if it doesn't work We change we pivot this is exactly what this is talking about But this isn't a project. There's no end date to this piece of work Even the outcome if I achieve 10,000 users does that mean my team disbands probably not because the outcome of growth Is a continuous outcome whether it's one? That 10,000 now becomes 100,000. What can we do to grow to 100,000? At some point there's an end of life at some point we do stop Why do we stop because well we've finished what we've set out to do and there is no more value to be had We have reached the point of maximum value Beautiful then you can stop Then you can disband that team send them off to another value delivery team All right, and move on to something else of greater value greater value for the organization All right, but this is not the same as a project. This is not a six month piece of work And we stop all right. We don't decide Upfront when to stop based on budget. We decide when to stop when we stop adding value and That value is determined by the outcome that we're trying to achieve All right, so how much time do I have left someone? 15 minutes, okay, so I want to talk briefly about the technology of no projects Okay, so no projects does not exist in a vacuum This is not a concept that Evan dreamed up one night and went hey, this is pretty cool. Let's do this All right, this is and to go back to the concept of this continuous culture. This is a pushback against a Structure that doesn't work because of what has come Because of the concepts of automation continuous delivery continuous integration DevOps even agile. These are concepts which have Formed the foundation of a way of working which the traditional project no longer operates within All right So actually, let me take a step back and actually ask you a question Who here? Fundamentally disagrees with what I've said and I would like anyone who does please say so now because we're gonna have a great conversation No one that is very disappointing. All right, so let me ask you a question What is the role of the project manager in this model?  I had some I saw some hands up over it stand up Who I? Saw hands earlier. No, you're all too shy. All right, so have I just fired you? Have I just fired you? All right, so I fired you. Do I think I fired you? Because you're doing a different role. Excellent. Am I fired you guys? Yeah, okay. No, I haven't you can sit down here. Thank you All right, there's a reason I haven't fired you and that is your skill set is still valuable. All right Have I gotten rid of risk management? No, have I gotten rid of stakeholder engagement? No, have I gotten rid of I've gotten rid of scheduling? Okay, because we don't have a Gantt chart But to be fair, we shouldn't be doing Gantt charts anyway. They're really rotten Actually, do you know sorry? Gantt charts There we go. Hey la 1880 something or rather. All right, we're using a hundred year old techno hundred and twenty year old technology All right in order to manage a an idea that didn't even exist at that point in time All right So anyway, we shouldn't be doing Gantt charts. So this is a laptop. So this is still going but do we have the projector? Not yet It's coming back. It's fine So Let's talk about another topic there. All right, so I haven't fired you because you still have valuable skills in the organization What do you think how how do you sit? How where do you sit in that organization that? Correct, you you are so good until that last statement making sure the requirements are clear And this is one of the problems that we are going to find This concept of projects has been baked so deeply into our psyche that finding alternate words is almost impossible All right, we don't have requirements. Okay, because we're working towards an outcome We're working towards something that we need to do we have activities things that we need to do All right, and there is a you could consider them to be a requirement in some form, but they are different Okay, but in fact that's actually a problem. So I Give you I create a new team I say you guys are gonna do some work. This is the work whatever it happens to be All right, what do I say that you do like the word project is so baked into what we do that even organizations like Amazon or a connects or whatever else out there who like they don't really do projects in the way that we think of projects They're not temporary they still use the word projects because we don't have a different word and I if anyone has an idea for a different word I'd love it Sometimes I use the word engagement if I'm talking about a vendor project. I'll say it's an engagement not a project But if I'm talking about something internally, I actually don't have the right word All right, so initiative. Yeah, but but even that sounds small. It's something you're gonna try it's initiative So it's endeavor There you go. So project. This is this is the idea projects have been with us for a hundred and fifty years in some form All right, that we've lost this idea of communicating about the this idea in any other way All right, so part of the reason I am so controversial in the way I talk about no projects is I'm trying to break through this collective concept of there's no other way of working and I didn't even have the words for half the things I'm trying to describe So the last point I want to talk about is about funding it So I started off by saying that a project. What was it a financial construct? All right, so if we have a project because Well, our finance department wants a project and you want to go back to your organization and go Let's try getting rid of projects. We'll keep the project managers from time being okay But we want to get rid of projects We want to go to this continuous delivery model Maybe we won't go all the way to outcome based teams We'll just go half the way and we'll go to Product-based teams. All right, that's good. That's a good step How do I go to my finance department and Convince them that you no longer have a project budget. You no longer have this line item All right, so who here has had ever to do a budget for finance? couple of you yeah, all right I'll try not to be too boring for the rest of you There are two concepts capitalization and CapEx and OPEX okay capital expenses and operational expenses finance wants those two the great thing about something like the activity canvas is That each activity can be class is an activity a capital activity or an operational activity All right, and that's important because if it's a capital It goes into one class if it's an operational goes into the other We can track that over a short amount of time to give us a ratio How much of our work is spent in capital? How much of our work is spent in operational activities? All right, the other beautiful thing about no projects is it's actually easier for finance Why because there is no variation projects fail Every single time over time over budget or under scope now finance doesn't care about under scope Okay, finance don't care what you deliver all right. They care about budget and they care about time All right, but put that to the side all right If we're gonna fail all the time if we're gonna tell finance it's a million dollars and take six months It's actually 1.3, and it took us a year and a half Well, okay finance is gonna be unhappy with us if we say it's a team of 17 forever Or at least for the foreseeable future because I don't know when it's gonna end That's the point. We have now a linear burn rate Our finance is happy because we are spending money in a very very very consistent way $10,000 every week for 12 months and then for another 12 months And then at some point there might be an end of life and we'll disperse and do something else But that's that's flagged and forecasted well in advance because we can see the value degrading We can see that we're not adding value to whatever it is that we're trying to achieve So from a financial perspective, we're actually in a very very strong perspective Position so you guys can go back to your finance division and say we want to get rid of projects But don't worry because I'm making your life easier And if you can go to finance and say I'm gonna make your life easier You will have a friend for life having friend in the finance department is always a good thing. All right, make sense All right, so That's no projects. All right, very very simply There's a lot to it There's some articles up on infuq if you want to have a read And there it's not just me. I should say all right There are others who are writing about these topics as well All right, so use the hashtag have a look see what people are writing about it's really interesting stuff And there's different ideas different ways of doing it banks are starting to do it And if a bank can who are usually the most traditional of organizations can try and change how they fund work initiatives this I don't have a word to replace projects. What does a What does finance fund if it's not a project? I still don't know the word, but they're funding something Okay, an anti-project and a continuous engagement It's easier for them and if a bank can do it pretty much all of you can as well questions So the question was is it too early? All right, and there's my answer. Okay. It's No Very simply it is not too early. All right Are we some of the first? Yes, absolutely Absolutely, I know because well no one else is doing this or very few organizations are doing this right now All right, but are we too early? No, because it's gonna happen anyway All right, there are organizations out there. They don't call it. No projects But they've already transitioned to this continuous delivery model. All right this continuous culture All right, and I've walked into organizations and Banks I use another bank as an example. They no longer consider their fellow banks to be competitors All right, they don't consider standard chartered to be a competitor or Westpac to be a competitor They consider Apple to be a competitor Amazon to be a competitor now How does how does a bank compete with Google has a bank compete with Apple? And that's this point of the continuous culture. It's not too early. It's just the right time Otherwise you will be left behind and the other organizations who are competing and who do have this continuous culture and the Structures in order to deliver continuously. They're the ones who are going to operate successfully Okay, so yeah question. Why do I think projects don't have outcomes? How many here who's written a project manager and plan most some of you? Yeah, all of you Okay, how many of you have written the benefits of a project? Yeah, how many of you have struggled hard to try and find a way of quantifying those benefits and Writing them in such a way that finance will accept. We know that finance is going to give us the money Finance knows they're going to give us the money. Okay, this project has been put on the Strategic plan, but we have to go through the process of finding benefits that Will justify the business case or the project plan in order for us to get the money to spend that they're going to give us Anyway, no matter what so we spend three to six months Twiddling our thumbs writing documents for money that we're going to get All right, the reason I say that projects don't have outcomes is because we start from an output in most cases We start from the we need to do X How do we get the money to do X and let's find the benefits to justify it? Now what I'm saying is rather than start from the benefits. Don't don't don't start I don't care about the product. I don't care anything about the technology all I care about is we need 10,000 more subscribers We need to increase customer satisfaction reduce staff retention. We need to Maintain operational security on our desktop environment. It doesn't actually matter what I do in order to deliver that That's the outcome. I want to achieve and so that's the difference. All right, we're starting from an outcome not starting from an output and Pushing a benefit into it because outcomes and benefits are sort of like that yes, and in fact the the concepts are cognitively some very very similar and Even if you look at things like the on budgeting or the agile accounting standards Or even if you go back like 30 years in the concept of rolling budgets Which have been around in the accounting standards for quite a long time these models still operate It's just that the de facto like finance departments are lazy, right? They want the IT department to actually Say here's how much it's going to cost and in fact actually that's a good point We're changing the question. The question is no longer. How much does it cost? The question is how much is it worth? What's how much does how much is it worth to you? All right, I'm not going to give you a project and say here's the requirements. How much does it cost? There'll be a million dollars. Can you do for 800,000? Yeah, okay. We can do that. All right, and you will get $800,000 worth of widgets. Okay. No the question changes In order to achieve this outcome How much is it worth to you? We are willing to spend or a million dollars to get that. All right, we will do a million dollars worth of work based on the Based on the principles that are constraining us that's based on the outcome. We're trying to achieve Okay, we will work to our best effort. There will be governance Okay, we'll make sure that no one's defrauding the system But we will do a million dollars worth of work in order to achieve or in order to deliver on that outcome Okay, we may not meet the target Because here's the other thing to remember about we have an outcome which is to increase growth We have a target which is a hundred thousand in three months. The target is a guess Okay, the outcome is growth Everything we do is going to increase growth whether we hit the target is a matter of estimation Okay, estimates can be wrong But yes, you are right. Okay. No estimates. No projects. These are things go in. Am I out of time? One more question. One more question No, because the funding doesn't come in chunks. Okay, the funding is This team of 17 people of 150 people will get x amount to deliver on this outcome All right, there's no smaller chunks of funding. Okay, there's it's a BAU fund Okay, it is effectively a BAU fund. There's not a project fund. So in terms of actually distributing work, right? Standard agile practices apply. Okay, we should be self-selecting. All right, self-organizing If I've got 150 people then I'm gonna have break them up into multiple teams unless you're men low Which apparently can do it with 70 people in one team. So I'm quite impressed about that from that's keynote this morning, but putting all that aside, it's Our team has an outcome. We are accountable for that outcome We're gonna have a combination of highly skilled and less skilled people doesn't matter because they're going to operate as a team All right, KPIs team-based bonuses team-based There is no individual at this point in time. Okay, the individual KPI the individual bonus Completely disappears because are you delivering value against the outcome as a team not as an individual? Unless you're a team of one which would be ridiculous, but that might be the case That's it. All right I'm here for the entire week come and have a chat with me I'm The guy in the three-piece suit there aren't many so I'm pretty easy to spot I also have another talk on Friday for those of you here on Friday to talk about communication skills. Thank you very much


Democracy is key to achieving the goals of the United Nations. Without democracy, it is impossible to realize the fundamental values espoused by the UN. Sustainable development, peace and security, human rights, and gender equality. As the only intergovernmental organization with an exclusive mandate to advance democracy worldwide, International IDEA has been a strategic partner for the UN for many, many years. Our research and underground technical assistance provide comparative knowledge to assist policymakers at all levels, from global to local. We monitor the health of democracy and share best practices on electoral processes, constitutionalism and political participation to support democratic institutions and practices around the world. International IDEA helps pro-democracy actors tackle constitutional reform in the country, develop deliberative local governments in Nepal, deploy domestic election observers in Mozambique and further women's political participation in Paraguay. The Office of the Permanent Observer for International IDEA to the UN links our work advancing democracy to the UN agenda and advocates for democracy within the policies of the UN. We use our convenient power to disseminate our policy-relevant work through events with our member states and other like-minded countries at the UN high-level political forum and the General Assembly. Through knowledge production, consultation or work impacts UN deliberation and decisions, including those linked to the adoption of the 2030 Agenda for Sustainable Development. We lead projects such as the SDG-16 Data Initiative, which tracks progress in the implementation of SDG-16 on peace, justice and strong institutions. Alongside many partners, we promote the use of official and non-official data for monitoring progress on this vital goal, which is instrumental for achieving sustainable development. We also leverage our presence at the heart of the UN system to develop new alliances and strengthen partnerships with research centers and universities, government agencies and foundations, as well as regional and global organizations. In the course of multilateral policy discussion, we bring democratic values closer to the UN and the UN closer to democratic values. All too often, UN debates shy away from the issue of democracy because it is perceived as being too sensitive. Quite to the contrary, democratic values, institutions and practices will only help the UN deliver on its key mandates, protecting peace, advancing human rights and making sure that no one is left behind. Through our status as permanent observers, International Aedia is proud to be one of the key voices for democracy within the UN.


Okay. This is the session on security. My name is Raghu Yaluri and I'm a principal engineer at Intel Corporation and I drive a lot of the security solutions development and path finding. I have one primary job at Intel. I don't want people to tell me that security is the reason why they're not migrating their tier one, tier two applications to the cloud. Okay. As a company, Intel is very heavily focused on making sure that there is foundation of trust as more and more workloads are moving into virtualization and cloud. Okay. When we talk about trust, it is across compute, storage, network and apps. And once the instrumentation is there in the platform, you make sure that it's enabled at the hypervisors, enabled at the cloud operating system level. We are very heavily involved in OpenStack to ensure that number one, OpenStack is secure and number two, OpenStack actually manages workloads and clusters in a trusted and secure and verifiable way. Okay. My partner today, JK, couldn't come here for some personal reasons. He's from our McAfee division and I'm going to try to do justice to a few of his concepts that he was going to cover. Okay. The way I'm going to do this, I'm going to spend maybe one or two slides talking about the challenges in cloud. There are many, many. At least in the context of this session, I'm going to talk about the three or four challenges that we seem to care about a lot and what we are doing at Intel to address those challenges. I'm going to talk about three solutions. Some of you might have heard of trusted pools and trusted compute. I'm going to talk about boundary control in this abstracted cloud environment through hardware-based asset tagging or geo-tagging. And then the third one is about VM protection. You are in a multi-tenant cloud. How can you protect your VMs from the service provider, from insider threats at the service provider? Okay. We're seeing a lot of interest in these solutions. They are in various stages of release soon to be released in development. I'm going to walk through all of that. I'm sure there's nothing new here for anybody who's been looking into cloud. Big challenges as a service provider, how do you meet compliance requirements? Until a service provider does this thing effectively, tier one, tier two applications will not move into a cloud. As a tenant, how do you protect your workloads from insider threats? The easy answer is encryption. But who holds the keys? Enterprise wants to hold the keys. So how does that model work? And how do you ensure that you're releasing keys to the right entity before your data, your workloads get decrypted and executed? Okay. If you look at some more specific questions, how do you trust the servers on which your workloads are going to run? They're all with somebody else. They tell you, hey, trust us. Your workloads are going to be safe. They're running on trusted infrastructure. But how can they prove that to you? How do you know the physical locations of these servers? There are many business segments where boundary control by geological location is very critical. Not just geological, but even by functional boundaries. You know, if you look at the PCI DSS guidelines, an entity that's doing transactions cannot coexist with something that's just doing front-end web pages. You can't put them together on the same physical server in a virtualized environment. How does a cloud provider ensure that happens? And the last one that's very critical for enterprise readiness of any of these cloud environments is your ability to audit the configurations and the policies in a almost near continuous kind of a monitoring model. Intel believes that the concept of trusted compute that we have been trying to derive for the last two, three years starts to address some of these questions. So what's trusted compute? We've been trying very hard to create a new security control in the data center called platform trust. And all the hosts in a cloud that have demonstrated platform trust would be aggregated together logically. And they are segregated from hosts that cannot assert their platform integrity. Once you have the trust, then you can start using policies. Policies that are encoded into orchestrator in OpenStack are policies that are done by a separate policy tool that interfaces with the orchestrator to ensure that your workloads only run on trusted servers. Then on top of that, you can actually get visibility to the integrity of that server. You may not know which server on which your workload is running, but you will be able to query your service provider and say, tell me the integrity of this server and you're going to get a verifiable manifest that shows the integrity of that server. And then you can use that information for audit, security monitoring, all kinds of compliance requirements. The Intel technology that makes platform trust happen is a technology called TXT, Intel Trusted Execution Technology. I'm not going to get into a lot of details of that. If you want, you can go to intel.com slash security and you can find a lot of information about TXT. But it is a very pervasive technology in the platform. There are new instructions in our CPUs, there's new silicon in our chipsets. The biases have been updated to use TXT. All the hypervisors, VMware, all the open source hypervisors have been enabled to use TXT. And a lot of the tools about that now are beginning to use TXT as a security technology to assert the integrity of the platforms. Once you have TXT, it does this thing, then you need an attestation mechanism so that any time you want to know the integrity of that host, you can ask the attestation system, tell me if that server X or server Y is trusted. The answer is yes, the open stack scheduler can then place your workloads on that. So what's the capability roadmap look like? At the bottom of it, we have this capability called trusted boot. That's what uses the very foundational Intel TXT technology to assert that you have launched your operating system on a trusted server. And you can actually prove that to somebody that you launched. Everything in the boot process is what you expected to launch. There is no question of somebody inserting an out of complaint component or some tampering of any kind is avoided in that process. That is there today. It's been there since the Folsom release of open stack. Trusted pools and trusted boot has been there. Now we are building, we are not stopped. We have not stopped there. We are building on top of it now. We are beginning to add a new capability, what we call geotagging or asset tagging, whereby you can now store a piece of descriptor in a secure location on the platform. The descriptor can be latitude, longitude, altitude from a GPS system. It could be logical geographic information like country, state, capital kind of things. Or it could be functional like this is finance versus HR versus something else. The key is that descriptor is secure on the platform through the trusted process of launch that descriptor is made available to the open stack orchestrator. So now the open stack orchestrator can use that to create segregation of workloads, boundary control of workloads. I'll give you one quick example. If you are doing any of the FISMA workloads, the federal government workloads, they cannot cross the continental US. With a descriptor like that, open stack scheduler can now make sure that if it's a FISMA workload, it will not move from the open stack, the federated open stack clouds you may have here and any other places. So you don't have to get involved in the process of controlling that. Once you set the policies, once you have this descriptor, it's made available. I'm going to get into a lot more detail on geotagging as we go along here. Now building up the chain, I have the platform that's trusted. I have the ability to do boundary control. The big request we got from service providers and enterprises is, hey, can you provide the same level of trust to the VMs and the workloads as well? Just like you can assert the integrity of the launch of the host itself, can we measure and attest the VMs themselves so that we know when a service provider is launching our workloads that number one, they are being launched on trusted hardware and number two, they are launching what we want them to launch and they can prove to us that they are launching the same thing. So that's what we call tenant-controlled VM launches or VM encryption decryption. And the idea is everything about the VM is encrypted. You own the keys in the enterprise and you release the keys to the service provider when the service provider can assert that they are launching it on a trusted piece of hardware. I'm going to walk through the architecture for that one as well. And finally, the end goal for us in all this is be able to provide you runtime protection. Just like these things protect you at launch time, you should be able to ask a service provider at any time, my workload that's running on whatever server at your environment, is that still running on a trusted server or not? And the service provider should be able to give you a piece of manifest which says, here is a proof for you as of 15 minutes ago, the server asserted its runtime integrity. If you were at the Mirantis session yesterday, there was a guy from Nebula who was talking about how complicated runtime integrity is and how complicated computer science problem there is. No disagreement, it is. And we still think it's a hard computer science problem. I don't think all of it is going to be solved anytime soon, but we think there are some low hanging fruit that we can touch there. Sorry, question? Good question. TXT as a technology has been available since... The question was what percentage of hardware providers have this service providers? I'll answer that in two ways. The hardware vendors have started supporting this technology since late 2009. The operating system and the hypervisor vendors late 2010 is when they started enabling it. So as of now, everybody has it from a hardware provider side. Service providers are beginning to take on this thing. Again, I can't speak for Amazon or Rackspace specifically, but the interest and the customer demand for this is quite high and every service provider is beginning to think about having this technology as the refresh cycles permit. Is that good for an elusive answer? Any other questions before I get to the next level? Like it says on the bottom, we are actively targeting Juno for at least the bottom three. If we don't make Juno, at least hoping we're going to make it the careless. So I'm going to drill a little bit more into the geo-tagging stuff. So the question that people ask me is what is geo-tagging? The concept is pretty straightforward. One or more tags which are name value pairs that are bound to a unique ID on the host digitally signed by an authority of some kind and a hash of that, either a SHA-1 or a SHA-2 hash is taken and it's stored in a non-volatile index on a TPM on the hardware. And this index is a read-only index and it's a persistent index meaning it doesn't disappear between books. So that is, and if that information happens to be geological information we call that is a geo-tag. But if it is anything else, it is a standard asset. That's the nomenclature we've been using. And there are quite a lot of changes, I shouldn't say quite a lot. There are a few changes in OpenStack that we are doing to make this tag number one visible through the stack and number two, the orchestrator can make use of it for its placements and migration decisions. So the principle of operation is pretty straightforward. Number one, you write that index into the NVRAM. I already mentioned that one. Number two, when the platform is booting up, it uses TXT and does its measured launch or a trusted launch. If the trusted launch didn't happen, we can get a proper attestation of it. That geo-tag is a suspect. You don't need to, you can use that. But if the trusted launch happens and the attestation is good then you have a legitimate geo-tag that's made visible to you. Now the next thing is, yeah, question? It's a standard provisioning tool that we provide or any ISV or maybe an open source also. You do two things. You can create, actually can I defer that question a little bit? I'll actually show you an example of that. How we create the tags. So once the launch process is done, now you have to define policies for your VMs, for your workloads. You need to say where these workloads can reside, cannot reside, where they can migrate. That's what we call in step three here as the policies. The very basic policies could be a trust policy which says this VM only runs on a TXT trusted hardware. That's a simple policy. The second policy could be a location policy which says this VM is a finance VM so it only runs on my finance clusters or my finance availability journals. The policy could also be this is a regulated workload so it can only run within continental US. So that's the example of a policy. You need to create those policies so that the orchestrator can know what to do with those policies. And the next thing is the open stack orchestrator essentially getting an attestation of two things. It's going to get an attestation of the trust. It's going to also get an attestation of the geo tag itself. And when I say attestation of a geo tag, there is a good known geo tag you provision on the server. And you do that as an out of band model. And now the server is presenting its geo tag to you saying hey I have this geo tag in me. Attestation process essentially verifies that what the server is asserting is what you expected the server to have. That is the attestation process. So you get the trust attestation, you get the location attestation and if they both meet your requirements the open stack orchestrator is then going to place the workload on the best server that meets those two requirements. If it cannot find a server, the scheduler is going to log in there for you and say it couldn't find a compliant server and then you can take whatever remediation actions. Yes. Typically it would be a technician, an ops guy in the data center. They would be, at least the model that we are espousing right now they would be given a set of tags and a set of UUIDs of all the servers. By multiple, the multiple ways you can get to that. Either the person who is going to do the rack, you know again can I take that offline for you? It's going to be a much longer answer of the actual provisioning process itself. But again just to be clear there is a well defined process that we are recommending. It doesn't mean that that's going to be the process that every service provider is going to use. There needs to be checks and balances and also there are security implications. The tag is going to be only as good or as secure of how you protect the provisioning processes. So this is an overlap of the changes that we are doing to a open stack environment. The ones in yellow are the extensions of the changes that we are doing. So there's a new filter called the location filter that's added to open stack, at least in our development environment. Again it's not committed up into the community yet. There will be some changes to the horizon dashboard so that you can figure out what the tags are, what the selections are. And then the policies on VMs are currently being implemented as properties on images. So you can have trust property, location property, anything. Using the image store registry we are storing them as properties there. The ones in blue are the things that are required in the back end to make all of this work. So there is an attestation service, there is a tag provisioning service, the thing that we were kind of beginning to talk about. And then on each of the servers within the trusted compute base on the server there is a provisioning agent that would run during the provisioning process so that it can actually write the tag into the TPM. So the process would be the provisioning service communicates with the provisioning agent and writes that into the TPM. These are today components that Intel is providing. There would be open source versions of these components. There's already open source versions of the attestation service. If you go to intel.com slash security, it's called open attestation, OAT. The provisioning service also will have an open source component to it so that you can do all of this thing in open stack using all open source components. It's not just us talking about this thing. NIST has a publication called IR7904. IR stands for interagency report. This is what NIST publishes as a special bulletin or an interagency report that all the federal agencies and typically the community picks up as well. This specifically talks about trusted geolocation in the cloud. It talks about using hardware root of trust for ensuring trust, ensuring geolocation. And it has some proof of concept implementations as well of how you can do geotagging. The one thing about this publication I want to mention is it is all built using the VMware ecosystem initially but NIST is looking to update this thing very soon with an open stack version of it as well. So quick walkthrough of the screenshots here. I was hoping I could do a real demo, but wireless is not that reliable for some reason here. So I'm just going to show you the screenshots here. Here is how you define tags. Like I said, the tags are name value pairs. It can have anything, you know, country, state, city. You can have latitude, longitude, anything.  So we made some changes to the horizon dashboards so that you can actually provision these tags into the servers that are in your cluster. So there's a new button here called provisioning geotags and then you have the list of tags, you pick them and then they're just associated with the server. And the way you know that a given server has geotag or TXT is by these two icons. You know the lock icon shows that it's TXT-enabled and then there's this little indicator thing which shows that there's a geotag that's provisioned for this server. This is where you define policies for VMs. So I have four images here and then I have two policies on each of those. I have a trust policy defined and then I have a geolocation policy defined. And here is the UI to essentially do that in horizon. So you can see a VM policy. I may not care about location at all. All I care about is trust. Then I just pick the trust-only policy. But if I pick a geo-policy, the trust automatically comes with it. Without the trust enforcement, the geo-policy enforcement doesn't make any sense. So I defined the tags for the servers. I created the VM policies. The next thing I would do is let OpenStackDo's thing launch those VMs. The location filter that we added to the OpenStack orchestrate the scheduler looks for the right set of servers that meet the policies and assign the first best server with the least CPU utilization to that specific workload. So now I have instances created here with these two policies. If an instance couldn't be created, it wouldn't show up here and then you can go back and look at either the command line or the horizon interface for what happened. We are able to raise different kinds of syslog alerts when something fails. So you can pick it up in any security monitoring tools so that you can do the necessary remediation at that point. The last screen I want to show you, I can, I guess I didn't put that in. I was going to show you a screen of the trust dashboard itself whereby you can have a bird's-eye view of all your servers, what the trust status is, and when was the last trust information asserted about those servers. I can probably show it to you offline later in that one. So the next thing I want to talk about is this second concept, the capability I talked about, VM protection. The use case is very straightforward here. You want VMs to be encrypted at trust in transit up until execution. Given the limits of technology today, you can't have the VM still in encrypted state while execution. X number of years from now, that might change as well. But up until then, let's say VMs are encrypted at trust in transit up until execution. I'm sorry. Tenant controls the encryption keys. Under no time, the service provider would have access to the key. Excel, there's only one case where they have to decrypt your VM to run it. So in memory, that key exists for a while before it gets flushed out. That's the only time a service provider would see your key. And you have policies where you can determine when you release the keys to the service provider. In the current reference implementation we have, we release the keys to a service provider only if they can assert that the server on which they are running your workload is a trusted server. The service provider actually passes a TPM specific key to the key management system. And the key management system wraps the decryption key with that TPM key. So only that server, that TPM can decrypt that decryption key that you have given nobody else can. And it's great to encrypt and it gets to decrypt, but when you launch it, you want proof that you launched, the service provider launched exactly the image that you wanted to launch. So that's what the last bullet talks about, that we can extend this chain of trust now all the way to be able to the virtual machine, the guest itself. And the fact that it is rooted in TXT, I can trace it back all the way down to the root of trust to our microcode in the CPU. So it becomes a very strong, verifiable, auditable piece of information that's very good from a compliance perspective. So I know I apologize for the picture, it's too small, there's a lot of small font in here, but I wanted to get everything on one slide. So the code name for this thing is Mystery Hill, that's why you see MH every so often here. I tried to do my best to get rid of it, but it's still there. So this is where you encrypt your VMs and you store them in a key management service at your facility. Those keys are packaged up, the VM, the encrypted blobs are uploaded into Glance. And however you launch the VM, either through Horizon or through the API mechanism, when the VM gets is getting ready to launch, that blob of the VM workload gets downloaded from Glance to a server. And we intercept the request and we talk to the key management service saying, here is a key ID that I need the decryption key for. A-I-K, think about it as a TPM key for now. Here is my TPM key and here is the ID of the decryption key that you have. Give me the decryption key. And the key manager says to the attestation system, I got this TPM key. Can you tell me if that server is trusted or not? So that's what this request back here is. This guy knows about the trust of that TPM server. He'll give you an assertion back, hey, this is a trusted server or it's not a trusted server. And then based on that policy, based on the result of that execution, the key manager takes the decryption key, wraps it up in that A-I-K, the TPM key, and sends it back to this DOM zero plugin. And now this plugin uses the TPM to decrypt the wrapping key, get the decryption key out, decrypt the VM itself and then launch it. And if measurement is a requirement, it can measure it, get it attested and then launch it. The whole idea of attestation is that it is totally tied down to a root of trust. The service provider cannot really do anything to the attestation process. It's a standard trusted compute group defined mechanism and it is all tied to a root of trust. So unless the root of trust is compromised, the attestation cannot be compromised. Any other questions? We introduced this concept at the OpenStack Summit in Hong Kong. We have made tremendous progress in actually implementing a lot of the pieces here. We have demonstrated pieces of it at another conference recently. We are hoping that by the November Fall Summit, we're going to have all these pieces in place. We're getting a lot of interest for this use model, for this solution, and we are going to submit a couple of blueprints hoping that we can target the carry list for this. Yes? That's a good question. We decrypted, but then we used the Linux DM crypt on the file system as well before it gets launched. So the actual decryption happens from the decryption key. It gets stored using the file DM crypt process, but before it gets launched, it's still in an encrypted state on the file system. Any other questions? Yes? Yes, it will. Again, I apologize for all these terms here, but open attestation is the open source version of Mountwells. Any other questions? Yes? Yes, so all this is open source. I wish I had a very, very strong answer for you. I don't. We are, we have been talking to folks about it to see what we need to do to ensure that the scheduler extensions that we have done work as they are supposed to, maybe OpenStack itself should run on trusted infrastructure, TXT protected infrastructure. That's a separate discussion altogether. Any other questions? Yeah, you know, I was hoping I would totally skip the VTPM discussion today, but it looks like I can't. This guy here, the Mystery Hill plugin, does what TXT and TPM do for the physical hardware. It has a measuring component and it has a storage component which functions like a VTPM. The reason we are not calling it VTPM today is that it doesn't have the TPM interface to it, the standard, but it still has the same primitives. You can do seal, unseal, attest, all the same primitives. We don't have the VTPM interface implemented on it yet. But without VTPM, we wouldn't be able to measure and attest VMs. It's there. We just don't call it VTPM today. You know, it's running as part of the hypervisor. It's running in case of Zen, it runs in DOM 0 and the DOM 0 itself is part of the trusted compute base for us, meaning that the TXT launch process will measure DOM 0 and it's going to attest DOM 0 before it comes. The hypervisor that's launching the VM image is going to measure the VM and write the measurements into this VTPM, let's say, and then it's going to continue with the launch process. It's an outside-in measurement. It's not inside-out measurement. The guest lawyers would not have to look at it at all in any way. Any attestation of it is done by the hypervisor. The hypervisor is telling you that this VM that's launched is what you wanted me to launch. And here is the proof for it. The guest will never tell you that, hey, I'm launched successfully. And here is the proof. It's the outside-in model. And it's very similar to the way TXT and TPM work. They measure something and the measurements are stored in the TPM and then they launch that one, launch the component. The component, then, if there is a follow-on component to launch, it's going to measure the next component, write the, extend the measurements into the PCRs on the TPM and launch that component. It's always the one that falls. Why do you need a visibility to the measurements of the guest from within the guest? That's the thing that I'm still struggling with. Why do you need those measurements? Why do you as a guest need your measurements? What purpose would that serve you? And what guarantee would the guest have? It's somebody else who wants to know whether the guest that's launched is a trusted guest or not. It's not the guest knowing that it's trusted or not. Can we, do you mind if we take it offline? Alright, yeah. Can you ask, can you say that again one more time, what is untrusted you're saying in the model? At the end of the day, all this chain of trust we are building is to ensure two things. One, the VMs that are going to be launched on the platform are number one, running on a trusted platform. And when we say a platform, it is the hardware, the firmware, the BIOS, the hypervisor, whatever is controlling it. That's number one. As an extension to that, we are saying, can we also measure and attest the VMs themselves so that I know that my VMs are trusted also? There are a lot of other parts that need to be trusted in this for this picture to work. Like, how does the service provider guarantee that this is there? And how do you protect your key management system? You know, security is not one thing. I need to have a bunch of things to work and make sure that they are trusted equally. Our goal is to make sure that what we call the trusted compute base is as small as possible. So we are constantly trying to see which parts of this thing we take away from the trust boundary so that the things that we measure are as small as possible. But the state of technology is that we have to still trust a lot of these things. Can we just hold on that question for a little later? I'm getting the signal that I'm running out of time here. I'm going to do my best on the McAfee stuff. This is supposed to be JK's thing. One of the things McAfee is trying to address is you may have security profiles, security policies in your data center. And as you are going in and out into public clouds, how do you ensure that the same security profiles and postures are applied for your workloads as they burst in and out of these public clouds? So assuming you have McAfee policy orchestrator as your primary mechanism to manage within your data center, they have created some plugins to EPL that can now discover which workloads of yours are actually going into public clouds and what the profiles security policies were internally and to ensure that the same policies are applied when they are externally as well. So that's why they have this concept of discover what your current VMs are in your workloads and what the policies are and then provide some ability to monitor and protect those. From what I understand, these are available. The connectors to all these following public cloud environments are available. There are plugins to the policy orchestrator and then you can manage your policies just like you manage in your enterprise when you burst into one of these public clouds as well. And these are available on McAfee's website and you should be able to at least get a peak of them from there. With that, I want to kind of wrap up a little bit and see if there's time for more questions. You know, our goal is we want to make sure that security is integrated efficiently and across the board so that there is this foundation of trust that we can enable across the domains in the infrastructure. When we talk about trust, we are not talking about the launch time trust. We hope to get to runtime integrity eventually. As an enterprise, as somebody who's hosting in a service provider, our request for you is make sure you demand that visibility and control from your service providers. Ask them that you need to be able to verify the integrity of the infrastructure on which your workloads are running. And if you are a service provider, be transparent. Make sure that you provide the trust and visibility that they need so that the critical audit and compliance requirements that enterprises need can actually be met. I think I am pretty much to the end of my content here. So we got 10 minutes, I think, or maybe 12 minutes for questions. Anything, anybody? I know you had, you were going to ask me a question and then you... Okay. All right, any other questions? All right, then thanks a lot for coming.


Good evening. On behalf of the province of British Columbia, I would like to thank Tides Canada for selecting us as part of a collaborative group to be one of Tides Top 10. I'm really sorry I couldn't be with you in person today, celebrating the great work being done to find creative solutions to social and environmental challenges. These issues affect all of us. On behalf of the province of BC, I'm pleased to be among so many other great recipients this year, all of whom are making their own mark to leave a better planet for future generations. The province of British Columbia is very proud of our partnership with the Tall Tann Nation, Shell Canada, Forest Ethics and the Skeena Watershed Coalition. I would like to acknowledge those in this partnership who have joined with you in Toronto. With their support and the support of other partners, we've worked together to create an agreement to forego coal-bed methane development in the Clepan area of Northwest BC. I'm pleased to say that this agreement respects the interests of the province of BC, Shell Canada and the Tall Tann Central Council, and has created another partnership between the province and Shell to create a water recycling plant reducing both water use and greenhouse gas emissions. Great things can happen when we all work together to find creative solutions to social and environmental challenges. I wish you all a great evening.