Alright everybody we're kicking off. Thanks for being here at Crypto and Privacy Village. We've got some amazing speakers here and I saw a video at Black Hat for how they were introducing their keynote and stuff. Is anybody interested in a Black Hat style intro for our next speaker? Oh yeah, okay we're on this. Alright. Un-sa, un-sa, un-sa, un-sa. People over! Ladies and gentlemen, welcome to the Crypto and Privacy Village. Thank you for being here. Our next amazing topic, un-sa, un-sa. Lasers, lasers, lasers, lasers. Is cryptanalysis in the time of ransomware. Un-sa, un-sa, un-sa. Lasers, lasers, lasers. Laser fingers everybody! And now it is my great pleasure to introduce the amazing Mark Magans! Un-sa, un-sa, un-sa, un-sa, un-sa. Thank you very much. That was great. I will never have another intro quite like that. That was really, really good. Alright, so a little bit about me. My name is Mark Magier. I'm a senior malware researcher at Endgame. I do reverse engineering and software development. Please do note I am not a cryptographer so if I get up here and start babbling about something that's very, very wrong about crypto, please point it out or take me off to the side and embarrass me in private. You can follow me on Twitter. My Twitter handle is Magurbomb, just like Yeagerbomb. So just go over the agenda really quick here. We're going to discuss very briefly typical ransomware execution flow. Then I'm going to discuss a kind of a high-level methodology for working through cryptanalysis of encryption schemes within ransomware. Then I'll do walkthroughs through four unique pieces of ransomware from four different families. I'll briefly discuss current research that's out in the field. Then I'll wrap things up with conclusion and hopefully have time for questions. So in a typical ransomware variant, what you're going to see are a few different things. So typically a payload is going to be written to disk and executed. There's going to be some sort of key generation or retrieval routine. Optionally there's a key exchange with the C2 but that's more in asymmetric encryption implementations. So we don't always see that sometimes with symmetric encryption. We're going to have hard-coded keys or some sort of key generation that's done on the fly. Then in terms of actually encrypting the files there has to be enumeration and directory traversal of the contents on the disk. So as the ransomware goes through the file system it digitally encrypts the files and sometimes it leaves very nicely written ransom notes in each directory just to remind you that you're completely hosed and all your files are gone. So in order to do crypt analysis on ransomware you kind of have to attack it kind of like a typical sort of malware versus engineering or malware analysis scenario. So typically in that sort of scenario you want to start off with a dynamic analysis approach. You're basically just detonating the ransomware in a virtualized environment, something that's sandboxed and isn't going to reach out and actually touch any sort of sensitive files that you have compromise your actual host. And the goal here is to just passively analyze what the ransomware is doing to your environment. So you want to observe any sort of network communications that are inbound or outbound. You want to look for any sort of forensic artifacts that are going to be left on disk, registry keys being modified, files are being dropped, any sort of effect on event logs. And then finally you'll want to actually look at the results of the encryption. So you want to analyze the encrypted files. And what we're looking for when I say we want to analyze the files is right. Okay, so if these are encrypted files you're going to look in there and say, well it's crypto, it doesn't make any sense. What we're looking for are commonalities kind of across the board between files that are encrypted from multiple different file types. So you want to look for magic byte sequences or water marks that are either in the header or the footer of the files. And you also want to try to determine if the ransomware is trying to encrypt the entire contents of the file or just some sort of partial encryption. Because if their goal is to try to essentially encrypt all files on your system that meet certain file extension restrictions then that's definitely going to be a lot of throughput and in order to make it easier for them sometimes the ransomware authors will only encrypt maybe the first 2 kilobytes, 2 megabytes something along those lines. And when you're doing dynamic analysis it's definitely okay to repeat your test multiple times. You have your virtualized environment you can do reverts as much as you needed. So you're going to want to adjust your environment and control variables as needed in order to gain a little bit better understanding of the ransomware. And when it comes to that when we're initially deployed within this virtualized environment and we initially detonate the ransomware we're essentially doing a known plaintext attack because just by launching the ransomware we'll see the ciphertext that are produced. When we revert back to the clean state before we launch the ransomware we have our plaintext back. So knowing that we can compare the original plaintext to the ciphertext that we've generated. Now in more of a chosen plaintext scenario we're going to try to feed specifically crafted files to the ransomware in order to try to get it to leak a little bit more of maybe it's key stream or key data something that will give us a little better idea maybe of what's going on under the hood without having to fully reverse engineer the ransomware. So after initial dynamic analysis and maybe we've learned a little bit about the ransomware we'll want to do more static reverse engineering. And so the goal of this is to one identify any sort of crypto algorithms that are going to be used if it's something standard like AES, DDS, whatever or if it's something more custom just like a simple XOR. And when we're trying to identify the crypto algorithm once we find the code section that contains what appears to be the crypto algorithm we can then look into identifying implementation mistakes that are going to weaken the overall crypto and potentially provide us an avenue that we can attack and either leak the key or provide us with a decryption capability. And then the second part of the reverse engineering that we'll want to look into is how the keys are generated, stored, and transmitted. So in that sort of scenario we're just trying to see if the key's going to be lying either in memory hard coded within the binary or transmitted in the clear where we can obtain it and kind of replay it. So going through dynamic analysis and reverse engineering as we've noted everything with the ransomware we're going to apply those lessons and eventually to development of our crypto. So for these walkthroughs what we're going to focus on is walking through ransomware encryption schemes that have already been defeated and have been publicized. So I didn't want to spend time working on any brand new ransomware that's out there and publicizing exactly what's wrong with it. Because actually when I originally submitted this talk to the crypto village I had the idea that I was going to get a lot more background on what some of these ransomware variants were doing and how their encryption was implemented and how it was defeated. But in a lot of those descriptions it was really described in an abstract manner and I think there's a couple of reasons for that. I think that for certain AV companies or security companies they're trying to just get you to download their software in order to do the decryption. It's free whatever. But on the other side it's more of an offset concern where they don't want to point out exactly what's wrong with the crypto implementations that the ransomware authors screwed up. So they're just trying to say we have that capability, we can decrypt it for you, but we're not going to point out exactly what's going on. So kind of going through that research phase for this talk, I then kind of turn around and say okay well I know that these encryption schemes are defeatable so how can I actually build more of a how to or walk through guide for doing this. So that's more of the focus of the talk now. As I mentioned these are older variants no longer in circulation. These are all mostly from like 2016-2015. We're going to be doing some high level reverse engineering and we're going to focus on detailing the crypto implementations and noting any differences between the ransom note and reality because as we'll see the ransom notes are definitely a little detached from reality sometimes and they're trying to really just scare people into paying the ransom by just using a lot of technical sounding jargon. And we'll focus on devising proof of concepts for carrying out our decryption. Okay so we'll start off with powerware. So powerware is a PowerShell based ransomware, one of the first if not the first ransomware family that's based in PowerShell and so here's a ransom note that we can see here and so this says that it's not only using RSA 2048 but it's using AES128. So it's doubly encrypting your files so that sounds pretty bad and they even provide links to Wikipedia because they're so nice. And of course they provide instructions for accessing Tor in order to get to their site so you can pay off the ransom payment. So they're very nice guys. So now the advantage of PowerShell is that as a scripting language we get access directly to the source code that's deployed with powerware. But the flip side of that is that of course they can run it through an obfuscator and this might be pretty hard to see from this kind of mile high view. This is all of the source code for this variant of powerware. But the very real names are kind of screwed up. They're not very easy to read. It's a mix of alphanumeric characters, helper and lowercase alphabet characters. So one thing we'll end up doing is de-obfuscating it a little bit just to help us make sense. But as you can follow the arrows and the red text here it can be chopped up into a few different pieces. There's the initial preamble that can include the crypto setup. There's the actual file and directory enumeration where we're looking for specific file types like as you might be able to see like docx, xls it's essentially walking through the file system and trying to match the file path with one of the extensions that's in that list and if it matches that then it runs it through the encryption routine and pointing out the file right and in the bottom there's a file cleanup routine as well that's going to delete the script afterwards. So looking more at the crypto setup portion, as I said before the variable names are a mix of lowercase and numeric characters. So going through this we can actually provide a little more context in terms of what those variables mean. So if we just walk through and relabel things it'll help provide a clear picture and so things look a lot better after going through doing a little bit of de-obfuscation. We can kind of see how certain variables are being used here. So what can we find out here? Well, we're utilizing symmetric encryption, utilizing the Rindal Manage class which is basically AES using a 256 bit or 32 byte key. We have an initialization vector that we're specifying. We're padding with zeros and we're using Cypher block chaining. Now if we move on to the portion of the code that's contained within the file and directory enumeration one thing that sticks out right away is the use of this integer value 2048 or 2 kilobytes. And what that basically is saying right here is that only the first 2 kilobytes of the file are going to be read in and decrypted. And for any files that are less than 2048 bytes it's just going to completely skip. And looking on the code section directly below that we're not making any further modifications to the crypto object that we'd previously initialized and configured before. So just something to keep in mind. Okay, so now going back to the crypto setup do we see anything in here that's bad with their implementation? So there's a few things here. They're utilizing symmetric encryption. They're using basically AES. So in itself that's not bad. As long as they're doing key management right and handling the IVs right. But as we can see yes it's utilizing a 256 bit key but it's completely hard coded. They're not doing any sort of unique key generation. It's going to utilize the same key for every single file encryption that this script runs no matter what system it's on, no matter what time of the day, anything. Same key everywhere. And the same thing for the initialization factor vector. They utilize the same value everywhere all the time. So with a hard coded key and a hard coded IV they're utilizing CBC mode. And those four things combined that's not good. That's basically a very very huge vulnerability. And the CWE if you're familiar with the CVE database actually provides a little bit of background to prove that I'm not just making things up here but non-random IVs and hard coded crypto keys are bad news. Okay. So taking what we know let's try to build our own decryptor. Okay. So I simplified things a little bit here in this version of the power script. I just cleaned up the file enumeration just to target a specific text file that's going to be on my desktop. And so I'll click over here.  And I'll run my modified version of the PowerShell script. And it looks like that data's been encrypted. I have no idea what it says now. And so let's see. So we're looking through the code here. What can we do knowing that all the characteristics we saw earlier, how can we decrypt this? Wait could it really be that easy though we change two characters in the PowerShell script and we're going to decrypt everything? Yes it is. I wish it were that easy every single time but you know. Okay so moving on to NEMU God. Here's our ransom note. And here they're touting that they're using strong RSA 1024 algorithm with a unique key. Okay all right we'll see. We jumped ahead a little bit in this case here. What you're seeing here is a pseudocode representation of what is essentially the enumeration and the encryption function. And for this specific binary this wasn't going to take a big level of reverse engineering. This was literally the first function that's called by the binary. So you know popped it into iDepro went to the first function that's called and then utilized X-rays to decompile it so I don't have to show a bunch of ugly looking disassembly up there just to give you a high level view of what's going on here. But as we can see it's only going to encrypt the first 2048 bytes again. So two kilobyte file size limit or at least buffer limitation for the encryption. Then it's XORing by a static key which I've highlighted there. So there's no sign of using anything even close to RSA 1024 AES whatever. So yeah that is their you know that is their encryption scheme. So let's go over what we know. We're not using asymmetric crypto. There is no RSA code in here. It is utilizing XOR. And there is no unique key generation. It's utilizing a hard coded 255 byte key. It's the same for every file. And it's only going to cover the first 2048 bytes. And on top of that this is a simple encryptor binary. Okay so knowing all that what can we do to decrypt our files? Okay so here's my very sensitive data again. And so we run through, hold on I'll pause it real quick. So the way the encryptor binary works is you just have to pass it on the command line the path to the specific file that you want to encrypt. So knowing that we pass in the path to our test.txt. Looks like it goes through and encrypts the first two kilobytes. And then hey well maybe I'll just try running this again. Let's see what happens. And our files our files back. The plain text is back. That was pretty miraculous. You know so hopefully I'm not blowing any of your guys' minds but if you XOR plain text with the same value twice you're going to end up with the plain text. Okay so moving on to Torrent Locker. And so while the first two cases were pretty easy the last two ones are a little more complicated and there's a little more work that goes into developing decryptors so bear with me here. So here's another nicely worded ransom note this one actually takes advantage of the Windows API for drawing a nice window for us instead of just a plain text file. So it's using AES 256 it claims to be. And then they're also saying the encryption key is encrypted on top of that with RSA 2048. So now jumping ahead a little bit with this example if we go in through a debugger like we're using all the debug in this instance and we're just kind of stepping through and looking around the encryption function to see well not even the encryption function itself literally just going through and we found calls to write file the Windows API and then we kind of backtracked a little bit to see if there was any sort of crypto setup before that. And what we see are hard coded references or hard coded strings that seem to reference this library named Tomcrypt and specific file paths for C files that seem to be named CTR and crypts and AES.C so looking at that okay AES counter mode to do a little bit of a sanity check we can decompile the function that contains the reference of CTR and crypts so we can see that all nicely written out there and since LibTomCrypt's an open source library we can go through and compare that to the exact source code that's available out there. And so you can see some sort of similarities there but mostly we're just kind of seeing if we're within the same ballpark generally what we're seeing and we don't really need to get too deep into that we don't really need to use source code analysis here. So from very limited reverse engineering we know that it appears to be using AES in counter mode and their implementations based off of LibTomCrypt we don't know if they've actually modified anything but you know ransomware authors tend to be pretty lazy so they probably just copied it. So could this potentially be vulnerable? And you know as with a lot of other encryption algorithms, symmetric encryption algorithms yes they can be subject to implementation flaws and I provided a little bit of an excerpt from very nicely written paper about counter mode security and basically ways to properly implement AES counter mode along with ways not to and so this gives us a little bit of a hint to say okay well if they're reusing the key then that'll give us a little bit of a window into what's going on. So we'll keep that in mind and we'll try to prove that. Okay so how can we test for a flawed AES counter implementation? Well alright so here's a little bit of math here so hopefully this goes over okay so we're going to want two plain text files. We're going to want one large plain text file that's going to consist solely of null bytes and our goal here is that if there's a file size limitation we want to exhaust a key stream and we want to find that out. As we saw with the previously the two previous examples there were file size limitations so we're going to take a stab at that. For B our second plain text it's going to be a non-null plain text just something that's a arbitrary size that's less than A that we can hopefully use our key stream that we devise to decrypt the cipher text and generate the plain text. So what we're going to do is have the ransomware encrypt file A resulting in A prime or the cipher text and then if we take that result A prime and we XOR with A that should yield the key stream and since A in this case is null bytes if we XOR A or I mean if we XOR anything by null or zero it's redundant. So what we have in this case we're supposing is A prime will be our key stream. And then we go through and we encrypt the second file B resulting in B prime and then we take that and we XOR it by the key stream that we generated from A and that should result in our plain text for B. So that's what we're proposing so let's see if this actually holds true. So as you can see A dot text is just a null bytes not going to go through there. Let me pause this real quick.  So all we're trying to do is see if that's going to yield the plain text for B. And for B B is actually the decryptor. Then in a separate tab you'll see that I actually saved a separate copy of the decryptor. It's called decryptor.exe and because it's all just a python script but I just changed the file extension so when I launch the ransomware it's not going to overwrite that file too so I can just preserve that copy and go from there. So going back a little bit there's our B dot py again.  So we'll go through and launch locker dot exe and we'll see pretty quickly that the files get encrypted and it dropped the ransom note that we already saw earlier. So we'll pop these two files into a hex editor and what do we see? We see that so this is the cipher text that just generated from A so we kind of scroll down and at a certain point all we see are null bytes so either they just start XORing by null or we actually have a limitation to the decryption. Now if we go over to the cipher text for B we can see that it looks like everything in there has been encrypted so nothing too crazy. So now we go back and we take our decryptor dot exe and we rename it to decryptor dot py. So we've successfully evaded the ransomware. Takes a while for the rename for some reason. Then we launch our decryptor and everything looks fine right? You know we have pretty much every line but what we can see at the bottom is that instead of saying print output it says print out P and then there's two characters that look garbled. So what do we think happened? So we revisit the cipher text and we actually see that the two last characters UNT for output are still within the cipher text. So what do we think happened? Well what they probably did in this case and you know this is without reverse engineering the encryption algorithm or anything, what we're supposing is that the actually that view helps a little better. What we're supposing is that the encryption operates on specific block sizes and if they're using a block size that's like four kilobytes or eight bytes that's something that's going to be left out and that's going to be an extraneous chunk that's not part of the want to be part of the last block that's encrypted. So it's just going to be left unencrypted within the cipher text that's generated. So that's an edge case that you'd have to take into account with a lot of the decryptors that you're writing. You want to be able to test a lot of different file sizes so you can make sure that if you write one decryptor and it works for this one test case that's great but you want to test it across multiple file sizes, multiple file types in order to cover all your edge cases so if you write something and you release it to the public you want to be able to make sure it's actually going to reach the audience that you want it to. Okay. Alright so moving on our last example is apocalypse. This one sounds pretty cryptic. They're saying all your files are encrypted. Everything. The world's coming to an end. And just by doing some dynamic analysis we launched the ransomware and we pulled multiple cipher text in order to compare them a little bit. And what we can see right here is that we have what appears to be a watermark a magic byte sequence that consists of the first four bytes there. So that's something to go off of for us. Now if we use the same plain text that consists solely of null bytes that we used for our previous example let's see if this actually generates a little bit more for us. And actually looking through the file just through these first few hundred bytes we can see that there does appear to be some sort of repetition in the cipher text. You know it still doesn't exactly reveal everything to us but it's something to go off of. It's something to note. So what do we know so far? We have what appears to be a magic byte sequence. Repetition in the cipher text when we provide a null plain text. The ransom note if we actually go back to that it doesn't seem to mention encryption type. That's kind of odd because all the other ones what we've seen so far mention some sort of industrial grade RSA 4096 and AES 256 whatever. So it's kind of curious they don't mention that they're using some sort of high grade encryption. So let's proceed with reverse engineering from here. So for this case we're actually going to utilize Ida Pro. And one thing that you can do right away this is definitely a little bit more of a cheat and it's not always going to work. But you can do a simple string search against a binary literally for like instructions in the x86 instruction set. So you can do a text string search for XOR and that'll result in finding the XOR operations. So if we look through the table of the results on the right we can see that multiple XORs are just clearing out certain registers so nothing big there but the two results at the top those are the ones that we're going to be interested in and they both seem to be included in the same function. So a pretty easy way to look into a binary not always going to work but it's a good place to start and it's worth a shot. So if we actually get into the disassembly of the function that contains those XORs we can see that those two XORs are included within that block towards the top and as denoted by the green line that's going back and forth those two XORs are going to be looped over. So that sounds or I mean that sounds like it's probably going to be our crypto algorithm. So moving on from there there's two right file calls. The first right file includes the previously ASCII representation of the previously identified byte sequence for the magic byte sequence. The second right file appears to write out the transform buffer that's affected by the XORs that we saw from earlier. And here's a decompiled view of that same code section. We extrapolated out to cover more code within that function and this gives us a little bit more of a sanity check to determine okay this really does look like we're reading in file contents and we're just transforming them and there's one specific line within the decompilation that we're going to focus on. So as we can see on the right I've narrowed down to just the nuts and bolts of the encryption and in this case it's using a hard coded key which we've identified there and all it really looks like it's doing is it's utilizing those two XORs but there's a little bit more math involved here but it's just looping over that until it's exhausted all the contents within the buffer. Now if we look on the left there's a python script that I wrote to essentially mimic everything that we see here. There's nothing too special about it. I first read in the first four bytes I saved that off to the header and we could do a little bit more of a sanity check to make sure it matches up with the previously identified magic byte sequence in order to confirm that we're working with an encrypted file but as I said earlier proof is this concept you know this doesn't have work for every single file. Then from there we're just individually reading in bytes and transforming them according to the set of operations that we specified there and we're writing it out to a separate file. Okay so let's test out this script. Okay so we started out with our script on the left on the right I just have the output file already created and it's just set to null data so just to show you that there's nothing in there already. So the readme.txt the original plain text that we're using is just a readme file for ollie debug that was our crypt text or cypher text to the left and we run it through our script and it looks like everything is good so we've generated our plain text again. So research in the field despite the overall proliferation of ransomware within the last few years researchers have managed to keep pace and it's pretty impressive considering how much money is going around and is involved within ransomware. I think there's been estimates that in 2016 over a billion dollars was successfully solicited from victims of ransomware. So new variants and new families are popping up day by day but there are researchers that are out there that we're really working hard towards and analyzing all these samples and more importantly developing and releasing decryptors to the public for free in order for victims to get access back to their data. The bleeping computer forums are a really good source to start with if you're trying to research decryptors Blood Dolly is one of the very active members there Maurer Hunter team, Maurer Tech, Demon Slay those guys are all very intricately involved in developing decryptors and reverse engineering ransomware. Maurer Tech is pretty famous for his WannaCry kill switch that saved people quite a bit of time in pain and there's definitely several others and there's a lot of companies also involved in developing and releasing these decryptors to the public and it's something that definitely should be noted because as I said last year over a billion dollars was collected from people but people are releasing these decryptors for free to the public and it really is a nice service that they're providing not only to the community but to users in general of the internet. So to wrap things up crypto implementations are very prevalent in ransomware crypto is hard ransom notes are definitely not the most trustworthy source for crypto implementation technical specs so don't believe the hype if you see a really bad ransom note it's not always going to be truthful and as with just normal Maurer analysis the reverse engineering and crypto analysis of ransomware and decryptor development they're not linear processes it's going to be a lot of trial and error you'll want to utilize chosen plain text attacks when you can in order to try to leak out more information about the encryption algorithm without having to fully reverse engineer it and you'll want to focus on sections within the code whether it's the disassembly or running through debugger whatever where modifications are going to occur then from there you can use that as a base to dig deeper for more clues in order to help get a better idea of what's going on with the encryption and you know initially focus on building out a proof of concept you know do a lot of stress testing so you can cover all the edge cases like we saw with Torrent Locker and you know so you stress test you harden and you cover all the edge cases and hopefully you have yourself a fully working decryptor that's going to work across the board and that's all I've got to say thank you time for questions wait the mic isn't working thanks for taking my question so after sort of analyzing all this crypto ransomware and sort of clustering together I guess the mistakes that all these all things make can you sort of you know associate them with like a group like skitties or like professional criminals or like software engineers like who is writing this shit so that kind of varies like from case to case because there's definitely a lot of cases where you can tell by reverse engineering the code that it really doesn't reach that you know level of complexity that's like typically seen in more like an APT sort of scenario so what we're seeing a lot lately is the rise of ransomware as a service and ransomware kits that are developed by more more seasoned developers and they offer it up to like budding cyber criminals who want to launch their own ransomware attacks and get some of that you know sweet bitcoin so I see that being as more of a cottage industry that's going to develop a little bit more but mostly the cyber criminals that are developing their own ransomware I would say right now the complexity isn't you know where you would kind of expect it to be with the profits that have been generated so far. I do have plenty of examples but then I wouldn't be able to decrypt them so I wouldn't think it's good but with a lot of the ransomware that does the encryption right they're utilizing asymmetric encryption so they're doing some sort of key exchange with a C2 so they have a little bit more network infrastructure involved but right as long as they're doing the key exchange correctly that seems to cover most of their bases and that in that case then you're kind of left with just hoping for some sort of like side channel attack or some artifacts being left on disk for finding and recovering a key so. Any other questions? Alright, thanks for your time.


Hi everyone. This is Dr. Cheryl Stenstrom. You were just listening to Dr. Susan Allman. She and I co-chair the Library and Management Advisory Committee PAC for the School of Information at San Jose State University. I see we're recording. Sue, let me know if there's any technical issues I need to be aware of, but otherwise we will get started just with a brief introduction to what we're doing here today. And then I have the great pleasure of introducing Dr. Melissa Fraser Arnett today, who is our speaker. So very quickly for those of you who are joining our series for the first time, the School of Information's Leadership and Management PAC for some time now, over the past year or so, has talked a lot about how new MLIS holders are often reluctant or don't quite understand how quickly they'll find themselves in management and leadership positions. And so we talked a bit about the skills needed for that, what the job looks like when you're in those positions, and how we could best get some of that messaging across to students, potential students, and some, even our recent grads and other new grads with the MLIS degree. So out of that, the four-part series of guest speakers who are out in the field was born. Today, as I said, I have the great pleasure of introducing Dr. Melissa Fraser Arnett, who is on the Leadership and Management PAC. She very generously gives us her time and advice during those committee meetings and other working sessions that we have, as well as she is a fellow graduate of the Queensland University of Technology's PhD program, which is held in conjunction with the San Jose State University School of Information. So quickly though, before I give you a full introduction of Dr. Fraser Arnett, I do want to say that Dr. Allman and I are very grateful to Jill Cleese and Kim Doherty at the University's Career Center, who played a part in helping us develop this series, coming up with some of the ways that we might best promote and convey the skills that we're talking about, as well as the entire library and management PAC. They've been instrumental in getting this going too. And of course, in particular, Dr. Fraser Arnett and without further ado, I would like to let you know a bit more about her background. So she has worked experience in a wide variety of libraries. I've known Melissa for, oh gosh, must be 10 years or so, and I have known her through a number of jobs, but I didn't really understand the extent of her experience, very broad. Right now, she's the Chief of Integrated Library Services at the Library of Parliament in Ottawa, Canada. She has a team of 14 embedded librarians who provide in-depth reference services to different parliamentarians within government. She's worked in other government departments. She's worked in non-profit organizations and in public libraries as well too, including the Oakville Public Library and Ottawa Public Library. Some of her other government experience includes the Office of the Privacy Commissioner of Canada, the Department of Foreign Affairs and International Trade, and the Centre for International Governments and Innovation in Ottawa as well. She also has taught, and I believe on a regular basis, in the Algonquin College Library Technician Program, where she's taught management and reference collection management, technology training and instruction. And as I mentioned, she completed her PhD through the San Jose Gateway PhD program, which is in partnership with the Queensland University of Technology and her MLIS at Western Ontario University in London, Ontario, Canada. She has research interests in competencies, how fitting for us today, professional identity and knowledge management. So, without further ado, Melissa, I think I'd like to hand it over to you and we'll get started. Thank you. Thanks for that introduction, and I want to thank Dr. Stensher and Dr. Allman for inviting me to speak today. It's always my pleasure to participate in SJSU events. I'm a proud alumnus myself, so I'm always happy to participate. And the timing for this presentation for me was wonderful. I've just made a transition myself in my career. I spent eight years at the Office of the Privacy Commissioner of Canada in a very small library. I was the head librarian there of a team with one person, and I was doing, like many people in small libraries, in small special libraries, I was doing a little bit of everything. And then I moved into, from that would have been considered a supervisory level role. I moved into a middle management role with a team that was 14 when I started. It's grown to 17 people in the past couple of months. And so it's been a time where I've been reflecting on what leadership means to me, what management means, how roles change when you make those transitions. You'll find through your careers, and many of you have already probably experienced this, is that you have a major transition first when you first graduate and enter libraries. And you may be doing, and whether you're working immediately in a supervisory role or you're working in a frontline role without direct supervision. You have another transition when you move to middle management, and then there's another transition if you move into senior management. We've heard some of the speakers in the series talk about that, that moving to senior, that the senior executive roles. And so I'm sort of focusing on the move to the middle management role, which I think might be one that, that there might be some of you who are considering that right now. And so I'm going to give you kind of a general introduction of my understanding of leadership, responsibilities, focusing on competencies, how they can be developed, what they look like. I'm going to give you an idea of my view of leadership, and then I'm going to open it up for your questions. So I'm doing this in a little bit of a different format than the other speakers. But I welcome all the questions that you have. I'll give my presentation first. I'll try and be as brief as I can so that I have time for as many questions as you'd like to ask. So I wanted to start here with what I called my understanding of leadership, and I know this is a text heavy slide. But I really wanted to kind of frame this presentation by stating that leadership is different for everyone. There's no one best way to be a leader. I'm not here to tell you that I'm the best leader out there. My leadership style is the best. You should emulate the style if you want to succeed. Because what will make you successful as a leader and a manager is following a style that fits you and following an approach to leadership that fits you and matches your values and matches the way that you feel comfortable working. And that means sometimes you'll find that your style is a great fit with where you are. Sometimes you'll find that your style is not a great fit with where you are. But you need to learn that and know that. And you develop your style over time. You're not going to wake up one day and be a fully fledged leader. Nobody is completed their leadership journey. We're all in the process of learning and developing and growing. And it starts from the time you're very young. It starts with your early observations of leadership in the world around you. I know a lot of my values in leadership and a lot of the things that I do as a leader and manager are based on things that I learned from watching my parents. My father was one of my first leadership coaches. So everything that I'm presenting about responsibilities and competencies I'll grab my values, my observations, and then what I've learned. So we'll move on to the next slide and start getting into those responsibilities. So when I was thinking about my role and what I do every day as this is the day in the life of a leader series, I thought, well, a lot of what I do I can probably group into a couple of categories and describe how those work for you. Because we hear a lot about the glamorous aspects of leadership and there are some very exciting, stimulating parts of leadership and there are also 14 parts of leadership in management that it's good to remember because you might find that you might feel like some of the aspects of leadership are a little bit intimidating but you might also discover that some of them you've already been doing throughout your career, throughout your learning, throughout your studies and you might actually already have a good foundation in some of these areas. So it's not a big leap to make it to get the full skill set. So the first of these that I want to talk about is obtaining resources. When I look at my usual day at work, getting resources, getting people what they need to get the job done probably takes up most of my time and that couldn't mean anything from making sure that you're fully staffed. I mentioned my team has grown in the time that I started. I started in September.  It's making sure people have the physical equipment they need. Do they have the right ergonomic setup? Do they have the right software? Do they have the right hardware? Is everything working? Are things breaking down? Do they have procedures in place in order to be able to do what they need to do? There's a lot of things that people need on a day-to-day basis and if they don't have that, that's your basic foundation. If they don't have what they need to do the job, they're not going to be able to do the job. So it's not glamorous but as a leader sometimes your job is to work with the different functions at your office to figure out how you can get people what they need. And the second most important aspect of the job is building relationships with people. As building relationships with the members of your team, building relationships with the other managers in your organization, building relationships with functional specialists like BHR, that could be finance, that could be material management. If you're in a public library, building relationships with any of the stakeholders and decision makers, your town councils, municipal councils, anyone who's on your library board within universities, you're looking at relationships with deans, with provosts, with other university executives and with your library users.  The third leadership responsibility that I found is advocating for your team while supporting the organization. You'll find that there's a balancing act involved in leading and managing. Your team has certain needs, your team has certain constraints on what they can do, and the organization has goals and objectives and your job is to support your organization's goals and objectives, but to do that while supporting your team. You don't want to take on so much work that your team is overwhelmed and stressed out and they're all getting sick and they're all banking lots of overtime and aren't happy. You need to know what your team is capable of and it could be knowing where they can stretch and learn and grow and take on new tasks, but you really have to know that balance and know that you're working through the organization but you're supporting your team. Assigning tasks and setting objectives is another bread and butter activity of leadership where you've got to know what needs to be done in order to meet your organization's objectives. You've got another right balance too in terms of how much guidance that you provide people and this is going to vary from person to person. It's going to vary from task to task and it is a challenge to learn how to assign tasks instead of objectives properly. You might have taken tasks from delegation. Delegation is one of the things that people find very challenging when they're first becoming supervisors, first becoming leaders. It's something that we all work on is figuring out what to task people with and how to help them to complete those tasks. Sometimes it's not just delegating. It's also for tasks that are part of someone's regular routine, knowing when and where to provide advice and how much of that advice to provide. I work with a reference services team. I've done reference in the past. Reference is fun and exciting and sometimes people come to me and they'll tell me about a reference question they're working on. My first impulse will be to ask them which sources they've checked and give them advice on certain sources but you've got to resist that because your team are competent, they're capable. If they want you to give them advice on how to do this, the nuts and bolts of the job and how to develop a certain strategy, they'll ask you. They might just be there to share with you an interesting story or share a challenge. Understanding when to provide advice versus when to listen is something that I would put within this bubble of assigning tasks and setting objectives. Finally, we get to the big one that people think about when they're thinking about leadership which is providing strategic direction and context. This is where we get into the vision setting and the strategic priority setting and aligning work with strategy. It can be one of the most enjoyable parts of the job if you're someone who likes to think about the big picture. It flows through all of your work but it's not something that you tend to spend a lot of hours on every day. It's something just to think about that you have to have an awareness of your context within your organization but also within sometimes the larger world of librarianship. Know what's coming, know what trends are emerging, know what technologies are potentially coming that could impact your team. That to me is sort of the big categories of the leadership responsibilities that I work on. My day-to-day, I spend my day-to-day in a couple of these bubbles that you always have to be, you can always find ways to build your skills with all of them and keep thinking about all of them as you go through. The next slide. In this one I've looked at, well, we've talked about the responsibilities. So what are the competencies, the skills and knowledge that you need to actually fulfill those competencies? And for me, there were three areas or groupings of categories that I need in order to be a manager and a leader. The first of these is functional knowledge and this is what you're gaining. This is what you gain in library school when you take management courses. This is what you gain on the job as you're learning to do different tasks. You're learning about how to do the work. So it could be anything from learning how to budget, learning how to manage people, learning how to run an effective competition, writing a good job poster for a new position, learning how to manage your time and organize tasks and prioritize. This is arranged. Some of these are hard skills, some of these are soft skills, but there's a lot of great course offerings that can teach you a bit of this. SJSU has a lot of courses, the single credit management courses, which can give you some good insights into each of these different, you know, a lot of these different functional skills. The second is contextual knowledge and this is going to vary in every role that you're in because it really depends on the organization you work with. You know, it's not enough just to know how, you know, for example, budgeting works. You need to know how budgeting works in your library because budgeting works, you know, there are principles in place, but the specific nuts and bolts of who do I speak to, what kind of things are most likely to get approved, how do I frame my argument in order to get things approved? That's going to vary from context to context. So you want to really build that organizational awareness and you also want to start training the people that you work with to give you, to look for that themselves and also to, you know, keep you in the loop to share information about that context so that your team is all, you know, sort of build that organizational awareness with you. And then the final bit is yourself knowledge. It's understanding how you work and how you like to, how you like to lead and how you like to manage.  You know, you need to know what works for you, what doesn't work for you, where you can grow and all of that will, you know, it impacts your happiness on the job and it impacts the happiness of the people that work with you. Because if you're miserable, if you're in a job that's a bad fit, if you find you're always, you know, trying to use competencies that are a stretch, you know, it's going to be tough and people are going to sense that difficulty.  All right, so next slide. So when I'm thinking about the way I lead and what I do on the job, I have a list of questions that I try and ask myself and some of these are scary questions and my objective is to be able to answer, to be able to answer the, if I can answer yes or if I can answer positively to these questions and I feel like I'm doing a good job. And the first is, and you'll see they're related to my, to my values and to my response and my list of responsibilities. And my first question was, do people in the organization trust me? This is key to relationships. Have you built up credibility? Have you built up, you know, authority? Have you built up trust?  If you don't have trust, then you're not going to have good relationships. Do my employees feel they can come with me, to me with new ideas and initiatives? For me, I'm a very strong believer in collaboration and employee empowerment and engagement. So I want to see people, you know, starting ideas. I want people to feel like they can experiment. And if people are not, you know, coming to me with new ideas, I want to know if it's, you know, is it because they don't feel that they're able to, you know, is it an issue in our relationship?  Is it something that they maybe don't feel confident about themselves? So I want to see, you know, I try to create environments where people feel like they can, you know, take risks and introduce initiatives. The next one is probably the hardest. Do my employees feel like they can question or criticize my actions to me directly? And this is one that nobody likes to be criticized. No one likes to hear they're wrong. But I would much rather, if my employees think that I'm wrong about something, I would much rather have them come to me directly and tell them that I'm wrong, then to hear through the grapevine that people don't think that I'm on the right track. And if people think that I'm wrong, then it gives me a chance to reflect and try and make better decisions if I'm not making good ones. I might not have all the facts. I might not be aware of certain historical elements of a situation. So the more open conversation I can have with my teams and with my peers and my supervisors, the better I can work for the team, the better I can work for the organization and the more I can grow. Do my employees feel that they were heard and their opinions and needs were taken into account in decision-making processes? This for me, as someone who believes in collaborative reading and creating a collaborative workplace, this is really related to that value.  It's inevitable that there are going to be people who don't like what you've decided, but can they live with it? And part of whether they can live with it or not is if they feel that their objections have been heard. You might not be able to change what you're doing. You might not be able to change a process. You might be in a position where you're pushing through a change that was made at a much higher level where you may or may not agree with it, but do you feel that you had a chance to state your objections, that your objections were considered, that there was an adequate answer when your objections were raised? That's something that I would look at. And it's part of making your decisions defensible and justifiable if you've thought about alternatives. If you've thought about the impacts, that to me is an important part of decision-making for leadership. My next question again for myself relates to leadership, to relationships. Did my actions help to build a relationship or did they damage a relationship? I found early in my career I was very concerned with being right. I came out of library school thinking I've got this degree. I'm now an expert in libraries and management. When I'm presenting a model of doing something, it's based on the evidence and it's based on all the best practice about how metadata should look. So people should just accept that and move along with it and you can imagine the reaction that that type of attitude had. Over time and working with projects, you realize that it's is it more important to be right or is it more important that you've got the project, that you've achieved the project's objective, that you've got a team that functions. And so you focus more on the relationship than winning the argument. My next question that I asked myself is do people feel that I respond to their requests and questions effectively and efficiently? One of the key roles in being a leader that I sort of I realized didn't put on my responsibilities chart but one of your key roles is as an information conduit. You're bringing information to the team, you're taking information from the team and passing them on to your managers. So are you a good information conduit or are you a bottleneck where information is getting lost? That affects trust, that affects ability to get things done and that's sort of the second question after that. Are you specifically thinking about information flows? And then finally, am I able to defend and justify my decisions? Have I looked at the evidence? Have I considered the team? Have I considered all the stakeholders? So these are questions that you're not going to ask yourself every, you know, you're not going to get a chance to ask yourself every minute of every day. But it's good to take time to reflect on these. Especially if you're having if you're having a time in your job where things are tough. If you've made a transition to a new role. If you're working on a particularly difficult project. If you are, you know, transitioning to a different role. If you're preparing for the start of a project and you're figuring out how to put a plan together. You're not going to achieve all of these all the time. We have bad days. You might get in an argument with an employee. But you always have a chance to rebuild the relationship later. You always have a second chance to try and work towards your ideals. Because we're all growing and we're all learning and we're all developing. So that was my that was my very, my very quick review of my my view of leadership. And so now I'm open to any questions that you have. Thank you very much for the overview and introduction, Melissa. I just following on Melissa's lead everyone. We're going to open the floor to questions from any of you or comments. You can put those in the chat. Or raise your hand if you want to do that. We can get you to unmute your microphone. But in the meantime, while you're thinking about that, Melissa, Sue and I have a couple of questions we'd like to ask you to. I think maybe you've seen some of these before. But one of the things that we hear from students a lot and the career center has heard as well too is just around you know the kind of fear of taking on a management role and leadership role because of the human relations aspects involved. So what role did you have in your supervisory experience? Did you have before you took on your first management or leadership role? Let's see. Before my first role, my previous role before this one, I did have a staff person. I did have one employee who worked for me. So I was in a supervisory role then. I had unofficial supervision in roles before that. I'd supervised volunteers. So you sort of learn that supervision there's two aspects for it. There's formal supervision and then there's sort of the informal relationship building. When it comes to formal supervision, you're actually very strongly supported in most organizations. You have human resources department. You have suites of HR policies. So I learned in going through whenever I had to do anything on the job that involves like a formal aspect of supervision or giving a performance evaluation, there were always things that I could model that work on. I'd go speak to my managers and get advice from them. I'd go speak to HR and they'd help me through the process. So I never had to do any of that alone. When it came to the less documented aspects of human resource of supervising and human resource management, that's your interpersonal skill.  You know it works, you know it doesn't. You learn your style of relating to people. So you start learning that when you work with teams in school and not just in your master's program but throughout your educational career. So I had a fair bit of supervisory experience over the years because I always found even from my first role, you're always at least supervising a volunteer. So you're never working in isolation. You always have some people who are working for you. So right from the time you graduate when I moved from managing one person to managing 14 and then 17, it was I was a bit worried because it was a big leap. But I found that the principals are there. It's just the complexity comes from the fact that everyone you're working with people and everyone's different. So you learn about, you build a relationship with people over time and there's no there's no secret to it. There's no magic to it. It's not different in the work context than it is in other contexts of your life. It's something that you apply a lot of what you learned elsewhere. That's so true isn't it? That idea of transferable skills and I know you are well familiar with that idea of transferable skills. For those of you who are participating today Melissa has written a wonderful article around transferable competencies when we're looking at moving between library types or even two jobs that are not that are non-traditional. So some of Melissa's work is around librarians who have the skills and use the skills from your MLIS degree and work in other kinds of settings. And so she thinks and writes a lot about this idea of transferable competencies. That leads me into my second question for you Melissa. So maybe timely. You just talked about how when you came into your current position last fall there was kind of a bit of drama in terms of a few people left people got conned or whatever you had to rebuild your team and bring on quite a few people and you spent a lot of time getting new members up and running on your team and so those of our participants who are in the program right now what would you say to them as an employer and as someone who does some hiring when you're hiring people into those positions or any position or a leadership position what do you think are the most important skills or traits or qualities that stood out to you during that period of hiring or if you were to hire again what advice would you give our students about things that they should try to convey when they're looking for jobs that involve leadership? Well it's those transferable competencies right and it's a lot of softer skills that we look for so for example when we're hiring we look at things that are related to emotional intelligence we look at your ability to listen active listening is vital your ability to teach others and I don't mean formal having you know formal training and education but your ability to listen to what people need to adjust your communication style to match what people need so that you're not talking down to people but that you're also not using too much jargon and making things too complex for people to understand we look at time management is vital in my workplace we work for the Library of Parliament so we serve Parliamentarians so members of Parliament and Senators in Canada so these are very these are very busy clients they're very high profile clients they have a lot of information requests and they're all VIPs so when we get requests we have often very very quick turnaround time we often have very high volumes of requests we cannot keep people waiting when they say something's needed at a certain time it's got to be there so we do need people who who can juggle large amounts of work and that organization time management it's also communication with your team sometimes it's negotiation with clients sometimes it's learning to work with a team to be able to understand where you can get help we don't want to see people try and be superheroes and take everything on alone you need to be able to talk to your colleagues and let them know when you need help and that's not a sign of weakness of really understanding yourself and what's needed and understanding what goes into the task writing and writing abilities are also very important because in our context we have most we respond in writing we provide written reference responses to people so you need to be able to write very clearly you need to be able to organize your thoughts you need to be able to provide something in a good quick structure that someone can read and understand very quickly in Canada we're a bilingual country so we actually do respond my team responds in French and English to questions that come in but it's that communication that organization that being able to speak with people and have good relationships with people those are the things that we really look for that make people stand out as being able to do the job and I think that's not unique to our setting I think that those are skills that people look for no matter what type of library they're in thank you so much Melissa and I want to encourage people in the audience to type in any question that you have this is an opportunity for you to find out at any level about management or leadership but Melissa I have a question you had said at the very beginning that you observed your father and got some leadership training at a very early age are there other examples that you can think of either people that you have worked for or observed who were either strong or weak leaders who have influenced your style I think I've learned from a lot of people over the years I think really every there are so many opportunities for learning and you want to try and take advantage of as many as you can and I learned different things from different people I think my I spent eight years at the Office of Privacy Commissioner of Canada and my manager there was excellent because she gave me what I needed I had a manager there who allowed me to experiment and redefine the boundaries of my job and try new things and that's something that I appreciated so much and I passed on to and I try to pass that on to the people in my team I learned from the people that I went to school with I really love Dr. Stenstrom's work on influence she's looked at influence and really highlighted relationships and that's a lesson that I've really pulled into a lot of the work that I do because of knowing that if you want to get things done for your library you've got to build liking and relationships with the people that you're trying to work with and that you're trying to influence that can have an impact on your library's budget in terms of leadership that I've seen in the past that hasn't gone well I've had some lessons stellar experiences in my career I think we all do I think we've all had jobs that weren't a good fit and I think one of the worst fits that I had was a case where my manager was actually very new to management as well and I think that that med made her a little bit a little bit more inclined to micromanagement a little bit more inclined to having very harsh reactions to any mistakes that I made as an employee every employee makes mistakes but how you react to that is really going to set their tone in the job I made a mistake in that role and I was punished for it for months because my manager felt that any mistake that her team made reflected poorly on her and they had to be discouraged from ever making mistakes again and so I'm not inclined to take that kind of approach with people for me because I know I've made mistakes, everyone makes mistakes and I'd like and you move on so in terms of other influences in addition to watching what people do and reading on management and leadership there's also a lot of popular culture that you can kind of look at and study and this kind of started with my father who believed he was I guess he had intended for me to be a manager so we'd watch movies and he'd say well look at what the leaders doing in this sometimes movies about military movies are actually a great place to start where you can see teams in action and sort of look at what files you like and what's working, what's not working so there's plenty of examples and models you can look at there is a question in the chat I don't know if you can see it from where you are but I'll read it out loud I am a strong introvert and just getting started in professional service leadership what are some tips for introverts on leading I am also pretty good at written communication I struggle sometimes with verbal communication how can I improve I can relate to that I'm an introvert as well for those of you who are familiar with Myers-Briggs I'm an INTJ so I'm not a naturally gregarious person I'm not the person who comes into the room and socializes with everyone but I've seen people like that my mother is one of those people who can go into a room and have a 30 minute conversation with everybody in there and it's a skill that I've admired that I've never had I'm not going to be that person so I find some of the tips are first off you can be a leader without being an extrovert there are quite a few introverts who are leaders and strong leaders part of it is your strengths are going to be different than an extrovert you might not be the one talking on the fly that doesn't mean you're not coming up with good ideas you can encourage you can try and find platforms to share your thoughts in ways that work for you if you don't want to give an oral presentation you can send your ideas in writing in some cases if you do want to work on verbal communication there are different courses and different activities you can undertake to do that I'd say practice with presenting practice with small safe groups first if you're in a small work team ask if you can make maybe a presentation to your small work team on if you've gone on a training session ask to give a summary of the training session to the group just to get you started there if you don't want to do it in the workplace there are groups like Toastmasters Debating and Public Speaking so there are ways that you can work on that I was actually involved in community theater when I was in high school and I find that for me as an introvert if I have a purpose for the conversation if I have developed a speech if I have a script that I'm working on if I know the objective of the interaction that helps me to do well rather than going and having to completely improvise on the spot there's another question have you had any issues with being a woman in leadership? that's an interesting question I think it's one that I think every woman is going to and being a woman is part of when you are a woman it's part of who you are it is going to impact how people react to you I had I probably had people react to me negatively in ways that I may or may not have noticed I think for me the bigger I've had more issues with people thinking I was too young for leadership rather than having an issue with me being a woman in leadership and it might be even because I'm a woman that you become a sectionality in that if I were a young man I wouldn't be quite as much they might not have reacted as much as they would to me being a younger woman I find if I always try and turn a disadvantage into an advantage when I'm faced with people who I think are not giving me the same amount of respect that they would if I were in a different category whether it's whether I'm perceived as not being experienced enough or if people have issues with a woman in leadership and sometimes I find that it helps you I'm trying to articulate this the best example is when I was in university I got involved in debate and I remember I was in a session where I was it was a historical debate and I was the only woman in the room all the other debaters were men and I noticed that they wouldn't be quite as harsh I think they didn't want to fight with me because I was the woman so they were kind of trying to be gentle on me well I wasn't gentle on them I kind of turned it around and I ended up being one of the most one of the most awkward people in there it was a historical debate on Suez Canal crisis and I think I was representing you with the Flavia so in the model you went to debate that would not have put me in a good position to make any points but because I did work extra I think I probably worked extra hard because I was the only woman in the room and I ended up winning a prize for the debate so it's I think we always have to we're never going to be in a situation where aspects of ourselves are not going to either give us privilege or potentially take away from our privilege but we have to be aware of how it's playing out what are the dynamics in the room and then what can we do about it we can't influence how other people are going that we can certainly we can raise awareness when we see aggressions, when we see microaggressions we can raise awareness when we see that structures are set up in a way that disadvantage women and then we can try and do our best to overcome them because it is possible and there are ways to overcome it I think I also want to mention before I took this role I saw the coasting for this job right as I was coming back from maternity leave and part of me thought well should I go for it I've just come back from a year of maternity leave I have a baby at home can I take on the challenge of working a much more senior role and having longer hours with a baby at home and the answer was yes I won the role I worked out with my husband different ways of managing the house different ways of managing daycare pickup so it's there are some extra challenges but there are ways to overcome it you can overcome it in your own actions you can overcome it by working with the people around you by working if you're lucky enough to have a supportive partner at home by working with them I'd love to say no there's no issues being a woman in leadership and it's all easy and it's all good it's all different some people are going to have a harder time than others but you're not alone and there are ways to help that you can find help there are people you can talk to and I would encourage you to do it if you're in an organization where you really feel like women are disadvantaged go and talk to other women in that organization because you might find that when a couple of you are working together to raise it you can have a bigger impact in leadership skills either through a mentor or through professional associations can you talk about either of those and then before you do that I'll say remind people please enter any questions you want in the chat so on finding a mentor I'm lucky that I can talk about my own experience and also the experience of participants that I interviewed when I did my thesis and a lot of the people I talked to did work with mentors I did participate in a formal mentorship program in a library association when I was a new librarian and that was great I met with a senior librarian we went for dinner, I got to ask questions I tried to shadow people on the job I watched what my bosses do I've got to meet people in associations through not formal mentoring programs but just participating committees and watching what people do and learning from them learning in the SJSU program you get to meet people who have a lot of great experiences coming from different types of libraries so I got to benefit from that I think mentorship doesn't have to be it doesn't have to be formal it can be an informal it can be as simple as just going for coffee with someone asking questions and you'll find them within a library community they're really open they're really willing to stop and talk so I would just say if you reach out and ask someone and I'm sure you'll find there's a lot of people out there who will be happy to answer thank you for that answer Melissa I've got a question for you first again while everyone might be thinking about any of their last questions to put in the chat and take advantage of you and your time while you're here but kind of a big one for you personally, what drew you to leadership and why were you considering taking on these bigger and bigger challenges was it about the work that felt that you made you want to apply and become a leader within the sector I think for me I like to have an opinion and I like to be consulted like I want to have an impact on what's happening in my world I don't like to just sit back and let things happen to me or let decisions be made without having a seat at the table and you can't if you're not going to be a leader you're not going to show leadership and you're not going to have a seat at the table that's what happens now you don't necessarily have to move into management to have a voice but it does make things easier there's still a lot of higher teeth in this world we're not in totally flat organizations we may be moving towards flatter models but if you want to really have a voice you need to be willing to take the risk and jump into decisions of greater responsibility so that's for me why I did it I'm the kind of person that just I can't sit back and let others make good decisions I had to have a seat it's great it sounds like a combination of you were brought up from an early age with that attitude and also the nature of your personality as well too we're going to put out another call for questions from the audience again while we have Melissa on the line I have a quick one for you I don't know if you can answer this off the top of your head Melissa one of the questions we've been asking some other participants is if there's anything that you've read lately or anything that stands out to you that you would recommend that people read on the topic of leadership and management okay there's a couple and so this is going to I'm curious what people think of this or if they've read it in the last couple of years that really made me think and reflected on the values that I have is how to win friends and influence people because it really focuses on having relationships listening to people focusing on having not just being after your own interests but working to achieve new goals so for me that really spoke to where the place that I lead from I've read a lot of different management things over the years there are a lot of the category of management fables their fun read some of them stick with you more than others I think there are a couple of change management that are good fun and nice quick reads I think one of the other presenters talked about my iceberg is melting who moved my cheese I think I actually found that one more fun which is also about change management and the need to constantly be moving forward and thinking about new challenges and new strategies but I also would recommend the Harvard Business Review is a big one if you don't have time because I know a lot of people are very busy you don't necessarily have time to read read a lot I would say if you have a subscription free subscription for the Harvard Business Review like tip of the day which is it's a paragraph of text it's based on research that's in the business review so I'd say if you only have a couple of minutes today and you want to get a good mix of different management advice just sign up for that those are all great titles classic that's the question that I don't know if everyone saw this in the chat I was scrolling by a little bit but the question Melissa is what's the male-female balance at your workplace and do you have anything to share with us about managing males and females okay interesting now I feel as a woman leader I feel very privileged that I have often worked in workplaces with a lot of female managers and senior managers and part of that is in libraries where women tend to dominate numerically at the office of the privacy commissioner we actually had a couple of commissioners during my tenure there I was there for eight years but two of the three commissioners that I worked for were women I remember sitting at the senior executive table at some meetings and seeing that women outnumbered men in the executive positions for a while there and here at the library of parliament the parliamentary librarians it's just the assistant parliamentary librarian is a woman so I've always had a lot of strong female managers and senior managers to look up to in terms of staff I tend to have more women and men work on my teams again probably because in librarianship we still tend to be about 80% female but I think that the difference that I found in managing people are less related to their sex than it is to other aspects of their personality I pay more attention to whether people are introverts or extroverts than I do to their sex because that really affects how I plan meetings my introverts hate it when I throw a new topic a new brainstorming topic a discussion topic at the meeting without any advance warning so when I'm actually planning strategies I think about communication style I think about those kind of preferences more than I do about the sex it's a great point you know often management so much more than just sort of those single traits even though gender can make a difference there's a whole package to everyone that you're supervising any last questions from our crowd and let me extend that to Dr. Alman is there do you have anything any other questions you'd like to ask before we wrap up no I think we're all set and I just wanted to thank Melissa so much for taking time to share her thoughts on leadership with us it's been very enlightening and thank you for all your suggestions thank you for having you it's been my pleasure Melissa I'd like to thank you too it's always a treat to speak with you and hear you speak with other participants as well for coming today great turnout again and for those of you who've been to our other two sessions you know that this is being recorded so the link gets posted on our website as soon as our technicians have a chance to get that all set up usually within a few days and I would invite everybody to come and join in on our last of the four part series next week same time Friday I believe 10 a.m. Pacific we're all in different time zones so for me it was 2 o'clock in the afternoon so check the time on our website and we look forward to having you there otherwise thank you again Melissa wonderful discussion and have a great weekend


Hi guys! Welcome to my birthday weekend vlog. Yesterday was my actual birthday, September 8th, but today we're kind of like doing a celebration as well as tomorrow. So I'm just going... I'm keeping it like pretty small this year because it's kind of annoying to book a restaurant with like more than six people. So I pretty much just invited like a couple friends and then some classmates who are also my friends. I don't know I just like to describe them that way so you guys know like how I know them. We are going to Bar Italia tonight, but first Piper is going to get groomed and this is the day that basically they were like uh we don't have you but we can schedule... we can reschedule you because you weren't in the system before and I was like oh okay so it was today and then they called me saying that they could take Piper earlier so I'm like oh my goodness thank goodness because I didn't want her to go in so late but that's what they had available so I was like I'll just make it work. They were like we can take her earlier and that's where we are on our way right now and it's gonna be fun. I also didn't want to like do anything like super expensive because of like my budget and like other people's budgets. That's why I was like okay I love a good steakhouse you guys know that but need to keep it you know a reasonably priced so I picked Italian and then this restaurant's still like really nice but like they're priced they don't like price gals and stuff so that's why I'm like it's perfect I could make a reservation for just six people I didn't have to like call or they wouldn't have to charge me I don't know I just didn't want to go through all that this year especially because like it's not like a major major birthday I'm 27 now which is crazy. Yesterday was spent going to school and I had a job another like job interview for one of my dream hospitals so fingers crossed that like everything works out I will make a decision on Monday so yeah I don't know but no matter where I end up like I will be happy because I like the two top options so I know I will love wherever I end up and know that it's meant to be so I wanted to vlog and do like get ready with me for an interview for my dream hospital but I was like I don't have time for all that I need to just focus on like getting ready and stuff and not having to like worry about what to talk about and like I had to hurry and do the hair and like all that so unfortunately I didn't make that TikTok even though I wanted to all right so I'm gonna stop talking now I kind of wanted to catch you guys up on like what actually happened on my birthday my real birthday in this video we made it in it's always so nice here at Wolfgang for lunch I got the Panera so I got the salad mac and cheese is in there and then my little cookie here oh what's up pumpkin how fun oh my goodness look at all she got bows I cannot even she always looks great thank you so much look at how gorgeous she is I love when she smells all clean and she looks good look at her nice paws here man if she can only smell like this all the time which she doesn't smell that bad but like sometimes I'm just like oh I hate when she goes outside too much because it just makes her smell so the dilemma I'm facing is of what I'm gonna wear I have no idea I'll show you guys some options with what I come up with I have no idea the struggle is real okay so this is what I landed on minus the socks basically I was debating on wearing this dress and my mom was like oh it's kind of plain and this is my the outfit I'm wearing is my original like outfit plan I also had this blouse from ritzia I love it and then this top with the pants I'm wearing but it looks like two like going out-ish I don't know just not the vibe I was going for so yeah we landed on this outfit this is the final look it's very me it's very like the vibe of the restaurant it's like nice but not like crazy nice I mean I don't know it's kind of hard to describe but this is the fit I absolutely love it super cute just a vibe I guess and then the hair turned out well I hope the curls last I curled them yesterday but of course it rained so like when they got wet they fell out so yep I'm gonna leave pretty soon oh look these pieces already have fallen out that's just great okay so I got here kind of early because I didn't know about traffic parking all of that just getting messages from people oh my gosh so my friend Kyra you guys have seen her a million times she dyed her hair black so I cannot wait to like see everyone's reaction she did tell me because I called her um because I was waiting for my dog to get finished getting groomed so she was doing her uber eats and she was like I dyed my hair black I'm like you gotta send me a pic I am here a bit early I think I might head in soon just so my car is not like running I wanted to come early because again like parking didn't want to be late if there is like accidents traffic was pretty heavy yeah I'm going to head in very soon and this little area in Winter Park it has like a cheesecake factory pf Chang's I saw free people store Kendra Scott there's so many stores and restaurants around here it's pretty cool here's the black hair I was telling you about look at that and then London's here oh my gosh you look like a ghost sorry okay now now it's fixed now it's fixed oh okay so I'm just coming on here to end this video I had such a great time last night we took great pictures it was so much fun I was thinking about just continuing on the vlog but honestly I kind of just want my birthday vlog to like have its time and not be mixed with today's activities so I think I'm just going to start a new video I don't care how short this one is because like whatever but I hope you guys enjoyed I certainly had one of the best birthdays ever I was telling my friends this like I haven't had so many friends at once and when I say that I mean like friends that I talk to at least like every week you know what I'm saying or at least like have some interaction with on like in in real life basis like yes I have a lot of good people in my life but like I don't talk to them like bi-weekly weekly basis or even daily like some of the girls in the video so I'm very lucky very thankful if you guys are watching this thank you so much you mean so much to me I couldn't have gotten through like this whole like search tech program without you yeah so anyway before it gets too emotional if you guys enjoyed this video make sure to give it a thumbs up don't forget to subscribe and I will see you guys in my next video bye


So you love deleting things. Not a problem. Delete face is really simple. When you left click a face it's going to delete whatever target you set. If you're on single poly it'll delete one poly. If you're on front facing it'll delete the front face. If you're on poly loop it'll delete that poly loop. If you're on poly group island it'll delete everything that is the same color. Hope that helps and as always I hope you have a fantastic day and I'll see you around.


Calls continue for the release of three student activists who were detained by the Sri Lankan government under the Draconian Prevention of Terrorism Act or PTA on August 22nd. The three activists are Vasantha Mudilage of the Inter-University Students' Federation, Galveva Siridham Atheero of the Bhiku Federation, and Hasantha Javantha Gunithalake of the Kelaanya University Students' Union. President Ranil Vikramasinghe also approved the 90-day detention of the activists on August 22nd. Sri Lankan students had organized major demonstrations on August 18th, the first day after the emergency post from July 17th was lifted. The three were arrested while taking part in a student rally in Colombo on the same day. Thousands of student protesters raised slogans against the Ranil Rajapaksa Junta and the ongoing economic crisis in the country. The key demand of the students was the immediate release of anti-government protesters who were arrested under emergency measures. Soon after the march began, students were confronted by a massive contingent of police including riot control officers. The students were brutally assorted with water cannons and tear gas. While most of the arrested students have now been released on bail, the detention of the three student activists under the PTA is being decried as a new law for the Vikramasinghe government. The PTA was enacted in 1979 under President J. R. J. Bharatane. The controversial law has a history of views by consecutive governments to scuttle dissent especially during the civil war. It was introduced as an urgent temporary bill and was used to suppress the Tamil population and target those associated with the liberation tigers of Tamil elam. More recently hundreds of Muslim youth were targeted and charged under the Draconian law following the 2019 insuborm attacks. The PTA has been the most debated of Sri Lanka's anti-terrorism laws due to its controversial provisions that gave unfettered extensive power to the police. The Human Rights Commission of Sri Lanka has criticized the arrest of the student activists. The commission affirmed that no suspect exercising their fundamental right under the constitution should be wrongly treated as a terrorist. UN Special Rapporteur on Human Rights, Mary Lawlor, has also expressed concerns regarding the arrest. In its first weeks in power, the government of President Vikramasinghe has faced increasing criticism for its scuttling of dissent and brutal repression of protests. State authorities and the police have arrested a number of citizens who were part of the mass anti-government protests at Auschwitz President Rajapaksa last month. Moreover, the emergency enforced on July 17th had placed broad and disproportionate power in the hands of the executive. The economic crisis in Sri Lanka continues to be at the heart of the problems being faced by its citizens. While Sri Lanka is experiencing its worst economic breakdown in several decades, the inflation rate in the country is set to touch 66.7% in August. The food inflation rose to a record 82.5% in July from 75.8% in June. In mid-May this year, the Sri Lankan Central Bank had declared a pre-emptive default on all of its foreign debt, which stands at US$51 billion. The economic crisis is characterized by a foreign exchange shortage and a subsequent scarcity of essentials such as food fuel and medicines. Meanwhile, the World Food Program's report on Sri Lanka has presented some alarming details on the ongoing food security crisis in the island nation. According to the report, as of August 4th, 6.3 million out of Sri Lanka's 22 million population are facing food insecurity.


I've had to compete and that's something that's really tried to Tried to raise my game, you know through competition and the Sean's been great We've been working hard together and you know learning things from him and I'm sure he's doing the same so it's been good Yeah, absolutely. I think you know Even still I try to find myself sometimes getting getting too high and too low But it's just trying to be consistent each and every day, you know, I try I think that a Ryan does a great job of that You know, whether he throws a pick or touchdown I think he just tries to stay, you know, even keel and that's definitely something that I try to translate into my game for sure Yeah, absolutely, you know, it's been a while since I've got to get back in a game and throw it around a little bit And kind of lead the offense. So I'm definitely excited about that Just working each day to to get ready to go in Atlanta Yeah, extremely talented group by far, you know, the most talented group of receivers I've ever been a part of you know from the top down with AJ and who you all the way down to, you know Marcus Johnson and you know, Freddie Brown and a bunch of those guys of it's a good group And you know, I'm confident throwing all those guys and I think it'd be good to get in some games and to play with them. I Mean that they're they're different but similar in a lot of ways, you know I think Todd, you know is is more of a you know quarterback guy He's coached quarterbacks for a long time So that's definitely been good for me in the sense that you know his coach to position coached a lot of great quarterbacks And you know gives me tips and kind of see it from a quarterback set of eyes. I think that's been great. He's been awesome Yeah, it's it's been a lot easier, you know I've spent a ton of time with this offense and you know going into my my third camp with the Titans and offense It's been it's been a lot better for me You know just kind of been it being able to go out there and react kind of know and Kind of leave my group of guys, you know, if a rookie or somebody like that Then know what they're doing, you know, I have the confidence now to to get them in the right spot And I think that's the main thing for me and it's been good I think it's just get get the playmakers the ball, right? I mean Makes my job a little easier when you got those guys out there So it's just find the ways to get them the ball and let them do what they do Yeah, they're just flying around a lot, you know a lot faster Then I've seen like in the past and I think it's you know a lot of a lot of vets They played a lot of snaps together over there and you know a lot of talent over there And they've been they've been doing a good job and making it difficult on us for sure