Hello everybody, and welcome to this session webinar about the value of international cooperation and funding opportunities. I'm Julia Parkel, I'm the Secretary General of NEMO for the ones who are new in this NEMO European Museum conference. This is the last day, but we have quite many sessions in front of us. Before I give the floor to our moderator, Ludwig Kuiper, I would like to make you familiar with some of the technical details for this webinar.  If you have any questions, please post them in the chat in the Zoom function. And we also want to inform you that all the webinar will be recorded so you can access it later on our channels. So now, without further ado, I'm giving the floor to Ludwig Kuiper, who is managing or moderating the session together with Margarita, Sani, with Jenny Xiong and Pierre Johammari. Thank you, Julia. Good morning, participants. Welcome to this webinar about the value of international cooperation for museums, a toolkit to get started. Today, we are going to talk about international cooperation. The background of this webinar is that in 2019, NEMO ordered a valuable study with an analysis of museums participation in the four main EU funding programs from 2014 to 2018. NEMO did this to get a full picture of which museums and from which countries profited from EU funding in order to ensure the best possible access from museums to their future EU funding programs starting in 2021. The outcome of this study was very insightful, but also slightly worrying. Out of the cultural institutions that profited from the Creative Europe program, the main program from the EU, only 6% were museums. And for the other three programs, Erasmus Plus, Horizon 2020, and Europe for Citizens, the percentage of the share of museums was even less than 1%. Therefore, the working group at Focassie drew the conclusion that museums do not use all the EU resources that are there. Following this study, the working group at Focassie started to think of instruments to improve museums' knowledge about international cooperation and access to the EU funding. We as a working group, for which I am the chair, that's why I'm also referring to it, we came up with the idea of a toolkit providing museums with a map how to navigate the international cooperation and EU program landscape and help museums get access to the resources that are there. That's what brings us together in this webinar. Margarita Zani has done an impressive job in creating a toolkit with practical tips, but also a lot of valuable background information. She will start with a presentation on the EU toolkit. If you have questions, feel free to submit them in a chat. We will have time for a Q&A straight after Margarita's presentations, I will be your moderator. Then we will have two cases from Pirio and Jenny, who will share their experiences with international cooperation and EU funding, and share their lessons learned. Now I want to introduce the speakers a little bit more in detail. First of all, Margarita Zani works at the Institute of Cultural Heritage of the region, Emilia Romagna, where she is in charge of international projects in the museum field. In the last 20 years, she has designed and managed several EU funded projects, in particular on museum education, lifelong learning, and intercultural dialogue. She's an active member of many professional museum associations and networks, among which NIMO, ICOM, and the European Museum Academy. Then our next speaker is Pirio Hamari. She is an experienced heritage professional who has been working with heritage management and policy related questions at the Finnish Heritage Agency since 2001. She graduated in archaeology in 1996 and even received a PhD in 2019, and initially worked in the archaeological field work and site management as a researcher. In 2001, she moved on to digital heritage management and policy development as a senior advisor. Then our last speaker of this session will be Jenny Seier, and she is head of education in the Chester BD in W. She commenced her post at the Chester BD first as the best Chester BD first education of 2000 and has developed the first multi and intercultural learning program in Irish Museum. Her work involves engaging with the Islamic, East Asian, North African, East Asian and European collections of the museum. There are numerous programs, including intercultural projects for schools, cultural festivals, and creating links with local multi-ethnic communities. With no further ado, I'd like to give the floor to Margarita for her presentation. Thank you very much, Ludvig. I will start sharing my screen right away, but I should be able to share the screen, and at the moment it tells me I can't. My office can go ahead and use the presentation I sent, or else please let me be able to share my screen. Right, so here we go. The value of international cooperation for European museums, a toolkit to get started. That's what the advocacy group of Nemo asked me to do and to prepare, and this is what I've been working on in the last weeks, months. Of course, as Ludvig said, the initiative starts from this publication, which Nemo commissioned in 2019 to see how museums were faring in what it is called the EU jungle, the jungle of European programs. Indeed, as Ludvig was saying, there is a lot that can be done and improved to encourage museums to take part in European projects. Because there is a value and I'm very fond of international cooperation, which has given to me so much personally and professionally. There is a lot that can be done and the objective of the toolkit is to encourage museums to start these international cooperation projects. The toolkit will be ready, I guess, if not at the end of this year, very early in 2021, it is finished and it's going now to the designer, so it should be. So I'm giving you a preview of what you will be able to see and read very soon. After an introduction on the benefits for museums of international cooperation projects, we go into the toolkit, such into the step by step guide of what one should do. And let's look at these areas together. First of all, the organizational check. First of all, the questions that one should ask oneself like, do I already have contacts? Do I have a network? Do I belong to an organization which is active at European or international level? Are there events in my area that could create some useful connections like festivals like the European Europe of capital or some other twinning maybe opportunities and so on. But the organizational checking in the sense of also doing an internal self evaluation of how your organization is ready and willing to undertake an international cooperation project. That's also very important. So does my organization have an international strategy, what are our mission and values and when it comes to the funding program, do they match with this international funding program and so on. Also personally, this is very important for me to underline because in my own experience, the governance that of my organization which changed at some point really changed also my way of working internationally. I really had the moment in time, a period in time in which I was given the possibility to explore and to produce and to be creative in the European arena. With the governance we knew director board of directors and so on my this this freedom of of experiment and and and try out different international cooperation models was a bit limited my change again but please check that if you want to embark on one of these initiatives, you have the organization behind you but then because then it is up to the decision makers to decide whether you can go ahead or not. The second element of building a network, this is absolutely a prerequisite for international cooperation projects not only because you need partners in your project but also because you need to develop your project with your partners in order for it to be successful to be there and to really be successful. So of course now we are in a context Nemo which which really facilitates and allows to to have this sort of contacts and to have an exchange with colleagues. And of course other networks are equally important in the in the toolkit you will find one testimonial of a maritime museum and Italian maritime museum which belongs to the International Association of maritime museums and surely these exchange with with with peers would like minded organizations and individuals helps a lot, although I must say that international projects are also very good to try out cooperation with non museum organizations with adult education organizations with tech companies with NGOs with a variety of partners that otherwise you would not meet so also thinking out of the box is very important. How do one build, how does one build a network or how does one enter into a network there are very many ways and as I keep repeating in this context start small. Maybe start even with a with a study visit to someplace with a travel grant that you can obtain either through various organizations that are available, or also using the Nemo grants to go and be part of a learning exchange or a study visit. So, again, building a network having a network is is very important. Developing the project idea I wish it was really like this that at some point one light bulb gets off in your head. It's not like that there is a lot of preparatory work before the right project idea comes around because again. I said already it is not your own idea, your own as an individual and not even your own as an organization, because in international cooperation what you need to be aware of is that what is important for you might not be important for other organizations that will be your partners, and therefore also the project idea needs to be developed in partnership. And needs to have an international value. This is, this is what will be asked of you when you fill in the application one of the applications maybe. What is the international value of your project why does it need to be funded internationally and not nationally or regionally or locally. So, developing the project idea for me is something like this and this refers to a real life experience in 2006 I think it was at the end of an Nemo conference that I had breakfast with some Slovenian colleagues of the Slovenian Museums Association, they talked about different things, and then they came up with the fact that there was a new piece of legislation being passed on volunteering in the country. And because I knew that we were interested in in the topic my organization was and other organizations I knew in different countries where we put together a project on volunteering and call it which was then called Valk volunteering where the heritage was funded and producing produce the handbook and so on. So, developing the project idea also starts during coffee breaks or breakfast time. Okay, and looking for funds okay this is very important when you have bright project idea you've shared it with possible partners then you, you're looking for funds. In the toolkit I deal with different kinds of funding sources both direct and indirect so the structure of funds, I mean they cannot they are not delting in detail but mentioned so you can follow up. And then of course they direct funds that we all know that the programs that we all know that fund culture Europe for citizens. Horizon 2020 which will then be called the starting in 2021 horizon for Europe creative Europe, and so on. So these these projects, these programs and also other programs are briefly describing the toolkit. The main thing that I would like to underline here is that Europe doesn't fund your project Europe funds its own policies and programs to your projects so that is very important. I mean, no matter how relevant for you and for your partners your project is, it is only relevant in as long as it is relevant for the European Union, because the European Union sets is priorities, its policies, and when your project matches those priorities and policies, then it is a good project that can be funded. Again, the EU co funds project so the it's it's important to to find that matching funding source. And we have in the toolkit some interesting suggestions by some countries which created a fund to co fund approved European projects. Also, in this case, looking for funds, my advice is to start small and to and to get acquainted with projects with programs and I'm focusing now on European programs by maybe being a minor partner in a partnership in a consortium because you really learn a lot by, you know, by being there not having maybe a relevant role or a demanding role, but getting to know how things work and I personally, when I started in 1999. My organization was a partner in a project which was very badly managed. I'm not mentioning the program not mentioning the project or the person that was very badly managed. I learned a lot. That's what I started. I learned a lot of how not to manage a project. So, you know, even if you enter even if you're a bit doubtful, but enter the partnership and see how things go. And, and, and, and you can also learn a lot from other people's mistakes. Very quickly now from the project idea to the project application, how we love those forms, how we love those application for all those questions. So, of course, as I was saying, it's important to know the priorities of the program that you're going for. And when you start working on an application, you really need to start thinking systematically. So this is what is required of you being aware that the application, if the project if your project is funded becomes your contract in some EU programs, you can still negotiate. There are still, there is maybe two stage process, but in many programs like creative Europe, you what you write is what you bind yourself to so be very careful that what you offer is realistic is doable is manageable, and so on. So, the project application as I said requires systematic way of thinking the EU programs force you to think in detail how your project is going to be action by action starting from the goals and then detailing the goals into actions in some actions and so on. So these actions need to be costly. So in the toolkit you will find some tools that will help you think systematically, but again referring to my own personal experience when I started writing applications, I was not aware of these tools, and I was successful, because I simply followed the application form questions and they force you to think systematically and to think ahead and to plan forward. So it's good to be aware of those of those tools, but don't get scared if they are a bit complex, because even without knowing them you can be successful in following the application writing the proposal, okay, writing the proposal means, of course, again, having looked at all the project in all its details, answering all the questions, and doing it in a way which is simple, straightforward, understandable, because the application and the proposal is what the evaluator will look at and assess. And so it is important that the application is consistent, that it is comprehensible and so on. In the toolkit we also have tips from the evaluator, some tips that an evaluator of creative Europe projects and Erasmus Plus projects provided and those are very good to be looked at because you have to put yourselves also in the shoes of the evaluator. Not all evaluators know your field, so it's important to be very clear and so on. I think the proposal can be a collective exercise or a solo exercise and when I mean a solo exercise, I don't only mean the exercise of one person, but maybe of one organization because it is important to bring together all the components, the budget in itself needs some expertise. And so, even if it is a solo exercise, nevertheless, it has to be shared with the partners because when the project is approved when it has to be carried out, every partner needs to feel that that project belongs to him or her. This sense of ownership is very important and you only achieve that if you take all the ideas and needs and expectations of your partners into consideration. So if the project is funded, what is next? Now the funds are tried, the meetings, the conferences, the study visits and so on. In the toolkit we have tips for the project leader when the project is funded and tips for the project partners. My main suggestion is be very clear, invest, well, this is true for every phase of an international project, invest very much in the planning phase that is before the project is funded, invest very much in the initial phase. So if you are the project leader, invest very much in the kickoff meeting, first time when people get together, make it also fun, make it a good interesting opportunity to meet colleagues, but plan it very carefully so that everyone knows exactly what he or she is meant to do in the following two, three or four years. So being very clear and having a clear idea of what everybody's tasks is important. Okay, and for project partners, don't be afraid to ask. So the other sections of the toolkit tells you where to find support in the different contact points of the different projects of the different programs. The role of the Musings Association that can also be very supportive in advising about opportunities for funding in liaising also with the national contact points. And the resources we have resources websites and bibliography the glossary for glossary. And then we have two appendix is one is, I call it now maybe I don't know whether it will be called hyperlinks in the end but anyway, it provides links to the parts that are not detailed in the toolkit needs to be an agile in order to be to be manageable and readable. But these other parts where you find more detailed information is in the hyperlinks and then there is this very valuable part for me, which is called challenges personal benefits and lessons learned. And where we have some testimonials like period like Jenny, who tell about their own experience their lessons learned what they did wrong or right and how they would live differently. So, indeed, the toolkit is a bit a sort of like the scaffolding, but the lessons learned and the challenges these appendix be is really the flesh and what is interesting. So to conclude, I think that the I mean this is me right in in a tight rope walking exercise because to me European projects are a tight rope walking exercise in the sense that you have to juggle between different objectives. The objectives of your own organization and the priorities of the funding program, the different, the different cultural backgrounds and organizational cultures of your partners, and also what you write in the project application and how the project develops, because every project is is an organic, say, endeavor, and so can develop in a way that is unexpected. In this case, you should know that, of course, what you have written is binding, but there is a margin of flexibility that unexpected events are, if explained, possible, and you should take the advantage of them, because also from from new new possibilities and new suggestions of partners things that you had not considered. A lot of good things can follow. So this is for me. Thank you very much. And I give it back to you. Thank you, Margarita for this very lively and very clear walkthrough through the different parts of the toolbox. I'm seeing, I think that your, your story was so very clear that there are not yet questions. Also looking at the time I suggested is a good move that we straight away go to video to hear her case first. And if people in the meantime have questions still you can put them in the jets and we can discuss them later. So I would love now to give the floor to Pio. Thank you very much. Thank you very much. Thank you very much. And also thanks to Margarita for for the presentation. I'm sure this tool kit will become a very useful tool for us to in the future. And now I would like to ask you if you can see my presentation. I hope so it looks promising from my part. Yes. Yes. Thank you. All right. So, following Margarita, I will now make a short introduction of how we develop one project for the creative Europe funding. It's an applicant experience. And I should warn you beforehand that we are the co-ordinating partner. So this is a description of a partner that perhaps has done most work in order to make this project happen. But don't be alarmed by this. It's a description of that. But there are many other ways of joining a project besides being the lead partner. But I will share our experience with you and we can hopefully then also discuss parts of it. What I'm talking about is a project called Moi Museums of Impact. Moi in Finnish means hello. That's a really nice thing for us always to remind people of. And we are a project that has now received funding from Creative Europe programme. We are running until November 2022. And like many projects currently there's a slight COVID extension to the activities. But our project has not overly suffered from this impact. The only downside is that we have not been able to organise the physical meetings we are looking for, we're looking for, but these have been turned into virtual meetings. We are a partnership of 11 partners across eight countries across Europe. And as you see from the number of partners and also the co-operation too, we are a large co-operation project from the Creative Europe programme. And what we aim to do is to produce a European Museum self-evaluation framework for museums of all size and types with the help of which museums can increase their impact in society. So it's a tool for museums to work with their activities and to think about their mission and the way their activities are organised in order to achieve impact. And this aim and this framework we will create through a series of workshops for partners working together. We organise a number of open stakeholder forums for the museum communities across different countries in Europe to help us formulate the new framework. When we have a draft framework we will organise a number of pilots in different museums across Europe to test in real life how applicable what we have been thinking is to the activities of the museums or how practical the model is to be used and fine tune it after these pilots through another series of workshops and stakeholder forums. And finally publish the models and disseminate information about that. It's quite a straightforward work programme, but of course our aim is to create something that has European added value. And specifically for that a European cooperation project is a very good way of working for us. I'm also advertising the next session where I will be going to more detail about the project itself and there will be links at the end of this presentation where you can read more about Moi and the project itself. But following Margarita's presentation I wanted to take you through our application process since we are an example of failing and then coming back and being successful. And we thought together that this might also give you an idea that this is also possible to do. And here you see the path we follow through the development of the project. Of course user evaluation is something that we have been working with a nationally for already several years in Finland and we knew already that other places, other countries and other actors in Europe were working with the same kinds of or similar or connected ways of working. And we had networks through which we could start building an idea about European cooperation, but the first ideas, our first concept paper was written in October 2016. And all throughout 2017 we then developed, I see a typo in the first arrow, but don't mind that, we contacted officially more partners in order to be able to leave the application in January 2018. And all through the autumn of 2017 we continued discussion with prospective partners first through emails. But there was also a possibility to organize a pre submission partner meeting and this was actually done in connection with the Nemo conference organized in Ghent in October 2017. So networking activities like Nemo is organizing where an essential part of our success in submitting this application. I've also put in that the contact with our national creative Europe desk was very useful and I strongly recommend everybody who's thinking about applying, contacting their national desk because they have a lot of expertise and they are usually very happy to help you onwards. That's why they exist and get funded. So our application date was in January 2018. The evaluation process takes time. And eventually we got the results back in July 2018. Unfortunately it was a rejection of the first application. I put also in the scoring so we scored 74 points out of 100 when the threshold for successful application was 81. So this was the first point that we were quite close in being successful as an applicant. Of course you know these are very competitive funding and it's not easy to get through, but we knew it was not completely in the woods. The application. In between these two application phases I put two main things that made us decide to go forward with the reapplication and the first one was a very positive feedback from our partners for all the work done and immediate questions about the possibility of reapplying and also joining the application. And of course we had an innate desire to work on this topic on a European level. So this was also our, we had our own motivation to try, think about trying to do this another time. So we took the decision to reapply in our organization quite soon after we received information about the first rejection. So we started an official dialogue with our partners and luckily or because of the partnership was already strong it was possible to reapply with most of the existing partners with only some replacements or dropouts. So basically the same consortium applying again. The second application date was in December 2018 and we got an acceptance letter in in July 2019 there's all again a typo. And this time reaching 81 points out of 100 with the threshold of being 80. So, not by much, but enough to be a successful project. As this was an reapplication, of course, in addition to having to decide whether it's worth to reapply, we needed to make and needed to be very careful about adjusting the project in a way that would make it more successful next time. Where did we fail. You receive an evaluation report for for both successful and not successful proposals and of course they are a very good source for you to understand what exactly was seen as not so well developed in the proposal so failing is also an opportunity to improve. We could see because it's divided like Margarita said it's very structural and we could see that there was where some specific parts where our, our proposal not was not very successful, specifically the relevance, which means for creative Europe how well the project matches the objectives of the call. And we did a lot of work with this and we managed to raise the scores we got from relevance from 1926 so so the feedback from from the evaluators was really helpful in helping us to do this there were there were other things as well. And the remedies we did that we fixed things that were obviously wrong. We explained things better that were misunderstood, for example, one of the evaluators was expecting artistic fees or artistic direction for the pilots, which was clearly and misunderstanding what what we were talking talking about the pilots and and this was then our job to do a better explanation with. And for some comments we thought that okay they have their views and we have our views and we feel quite strongly about that Margarita was already making a mention that projects can well be developed in breakfast tables and dinner so we feel strongly that good food makes better project so catering costs are not. Something extra but they are key to the activities well this is this this is because this is a cooperation project where we bring together a lot of stakeholders, so this was the explanation why there are. And a lot of no mention not specified not sufficiently detailed so things just needed to be better explained. And I'm probably nearing the end of what I thought what time I have a lot of it but I have gathered here some key points that are learning outcomes from the process itself. Many of these are or all of these are in the toolkits and no need to go into detail, but I would just re emphasize what Margarita was saying that this is not about what you think is the key in the project. It's about what the objectives of the call expect you to do. And even though we might not like this approach from the European Commission or the programs. That's how they categorize projects and and that's what you need to match so it's very, very important that your application explains or matches the objectives of the call. And the other thing there are things here. Several things I just wanted to emphasize the importance of having a good consortium so use your existing networks and and and that's an experienced applicant on and also from the other side of the desk I would emphasize that pay attention to not only not only to the relevance part the beef of your presentation but please make sure that all the extra bits are also in order you need to have a good communication and dissemination plan you need to explain your risk management you need to explain your management processes you need to explain how you will ensure quality you need to explain who is doing what all these bits that might be left undeveloped because you are focusing on the key activities but they are very important for for you to gain the extra points in the presentation in the application in order to reach the threshold above which you will be funded. And I just wanted to emphasize in the in the end that it's not an easy process, but it's absolutely worth it. There are so many benefits for working on a European level, and I would encourage you also to perhaps not start with the whole project of your own but just to put your hands in between the door and join an existing project find the connections and and spread your wings in a smaller way but but but during European cooperation this has also given me a lot of personal advancement and and also benefits for my organization. Just some contact details if you want to know more you can contact me or our project and you can also find the Moin Museums of Impact project on Facebook and and on on internet. And if I finish my presentation just to show that the consortium we have this mostly represented in the image this was the first and the only physical meeting we have been able to organize so far. I was talking about the importance of kickoff meetings, and this is was our kickoff meeting in Helsinki in January 2000 and and 19 in 2020 sorry, and I think I've said everything I can in the time a lot it to me and we'll move on. Thank you very much. Thank you, period. That was again a very insightful case that you shared with us even yours or honest also to tell the project was first in a certain moment rejected and then improve the plan and then it got awarded in the end it's I think very interesting to also hear that people can learn from that. And I want to go straight away to our next speaker which is Jenny, also looking a little bit at the time so Jenny before is yours. Thank you. Ludwig, I'm just going to share my screen. Except my PowerPoint. I'm sorry would I be able to ask Nemo to upload my PowerPoint. Is that possible. Yeah, give me a minute. I have it on my desktop. This is not appearing. Thank you. Thank you very much. And thank you to everybody in Nemo for all of this organizing this, as well as my colleagues on the panel. And my name is Jenny, I'm from the Chester beauty. It's an art library museum in Dublin. And I suppose the benefits of working with international partners has been incredibly useful for the practice of museum education and learning, particularly in my organization. Because when we relocated from the suburbs to the city center and opened in January to February 2000, there was very little elsewhere in terms of my peer organizations working with an Islamic East Asian European collection. So when we won the European Museum of the Year in 2002, that opened a door into the world of European networks and European projects because I met Margarita in 2003 at a EU funded workshop in Italy. And I met her again the following year. And then she invited me, our organization to be part of the European project. I initially said no, because I didn't understand it. And then I did a U turn and said, yes, I think we should join it. And I suppose that if you look at the next slide, this is just to give you an idea of our collection. Because it comprises of, as I said, Islamic East Asian and European rare books, religious objects, decorative materials, but it's unique within the island of Ireland. And for most Irish people, these collections would have been very unfamiliar to them, as well as the cultures. And I suppose the benefits of being part of the European project is I was able to meet other organizations and colleagues who are working in a similar area, such as the collections similar to ours. I also had experience of devising learning programs, which again wouldn't have been prevalent in Ireland back around, you know, first up from 2002 2010 or thereabouts. I've just give you a sense that in a small country with a small cluster of museums, which tend to look at Irish national history. This doesn't really fit into that remit. However, we are an Irish culture institution, we do have a national remit, but we are very international as well in our standing because the nature of the collections. We'll just look at the next slide please. And I suppose in terms of where we've come since then is how do museums compete with the outside world. I think the last time I stepped out of Ireland before COVID-19, I went to icon Kyoto in September 2019. And I had the fortune I was able to look at team lab, which is a digital immersive experience. Some of you around Europe may have had the fortune of having team lab come to your country or come to your museum, but they are high tech, incredibly innovative, and I would imagine incredibly expensive. And how do museums on a low budget meet the needs of people who are our audiences who are tech savvy and are looking for that immersive experience. That I suppose comes from the ability to be flexible, but also the ability to be creative. Let me look at the next slide, because I think I come from the world of the old formula. And I think a lot of my peers have this traditional trajectory of going to school, graduating from college and planning of the ladder in your career. But I don't believe that works anymore. This became very apparent in a project we were involved in with IBC and Margarita's organization called the Learning Museum, and we were looking at different elements of learning for museum practitioners. And we wanted to continue working together as partners. But we realized that, okay, Margarita was going to go off and do other initiatives. We decided to take our experience from collaborating in European projects and start looking at how do museums take on on the other side and the maker mindset, because the maker mindset sprung out of the crash, the economic crash in 2008. And they just started tinkering and experimenting and using their hands and using their ideas and trying and experimenting how to make things out of pretty much basic tools. In a subgroup, I know Margarita talked about meeting colleagues for coffee. We stood on corners in the streets of Bologna trying to work out where do we take this project next? How do we continue this synergy that we've developed through the Learning Museum? And we came up with the idea that we'll look at the makers, look at what they're doing. How can we learn from them? And this came about through our, we took the chance and we made our own brand application for a project called the Creator Museum. And we took the maker mindset and applied it to how do we upskill museum practitioners with a maker mindset. Thank you. Go to the next slide, please. And so the Creator Museum came about as a result of these conversations that took place on the streets of Bologna. And the grant application went in in 2013. And from 2014 onwards, we successfully acquired Erases Plus funding to upskill and train museum professionals but also collaborate and work with our local maker community. And that was a three year initiative. And then we got an extension of another year to continue the work of the Creator Museum with the Making Museum Project. Go to the next slide, please. And as a result, we've successfully acquired further funding to continue this idea and concepts of bringing creativity and critical thinking and experimentation to a new project that started in 2019. And we'll finish in 2020 called the Creator School, but bring it from the museum professionals and practitioners and makers to teachers and students because as those as a fallout of the economic crash, we're now expected to be far more multifaceted. We're expected to be far more creative and inventive as well as collaborative. And those skills we can share with young people who are coming out of the education system and are going into the workforce because those expectations are also being applied to young people today as well. Go to the next slide, please. So this is the trajectory from the Learning Museum Project from 2010 to 2013. And that moved over to the Creator Museum Project, which went from 2014 to 2016 and then that short turnaround making museum project. And from that, you know, the benefits and I think a margaretian hero have both reflected the benefits of these European projects is the networking, learning from peers, the exchange of the practice and risk taking. Because I suppose when you are working with partners, you are taking a risk through working collaboratively because you're stepping out of your own organization where you're very familiar with its own structures and way of practice. And working with people who may not come from your world, such as I mentioned the makers, and we also collaborate with science centers. I've never worked with a science center until the Creator Museum Project. So there was a great exchange of new ideas and experimenting is something that I really do believe in without feeling afraid or hesitant in experimenting and trying things out. Go to the next slide, please. And this, I suppose, is our biggest experiment in the Chester Beauty is as part of the legacy of the Creator's and Making Museum Project. We started to take on makers as part of a residency. Most museums will take on an artist in residency. They might have a studio allocated for an artist to interpret or respond to the collection. We took on a maker and a maker, somebody who, as I said, uses DIY, do it yourself, comes from a techie engineering background, computer design, digital design, and so on and so forth. And through our partners, the Finnish Museums Association, they were able to put us in contact with a maker who came to Dublin in 2016. It's a 2016, gosh, yes. And he had an MA in digital mapping or digital projection and interpreted our collections and he mapped out, I don't know if you can see in that slide, the very top one on our atrium wall. He mapped out the projection of our images using a Raspberry Pi. And a Raspberry Pi is a homemade computer for around 40 euro. And again, that's the beauty about working with makers is they, they work from the bottom up. And things may not always be as expensive as I showed with team lab immersive experience in Tokyo, which is definitely not 40 euro. It costs a lot more. We had our first projection mapping and projection mapping in an Irish Museum. Because there are other commercial events that do use projection mapping on buildings or images or lights and lights display. There's a light festival in Milan. There's a digital projection festival in Latvia. So it is very familiar, but for museums, it's very expensive. And we also did two follow up sessions with two more makers in residencies through the San Jose twinning, which is a twinning between the city of San Jose and Dublin. And we were able to tap into funding. Margarita mentioned funding as well. And we tapped into that funding in 2017 and 2019 with two makers. The first being Korean Polkata Takara, who responded to the art of Japanese knot making inspired by Celtic knots. And she came over and did a week of workshops with our teams. And then last year we worked with an Iranian American artist called Pantia Karimi. And she responded to our Persian medieval scientific manuscripts and worked with teens for a week as well. Next slide please. And I suppose the benefits for our own organization is we're embedding a practice of exchange with other European partners. But it's bringing in the non-museum practitioners to work in collaboration with our organization. I think that's really, really important to bring in outsiders who may not be familiar with our organization. The nature of our organization. But also I get to know the creative, innovative thinking of makers who we're not familiar with. It's trying something new and testing and experimenting. And it's okay for planning and carrying out activities to messy. I'm saying messy because it's often perfect. Be prepared to test and learn and fail and try again without getting into trouble. We can play the clip of the projection mapping. So that should play. There's a play button underneath the image. And that's to give you a sense of the projection mapping. I personally think it's one of the most beautiful things I've seen in our museum engagement with our public. And then the last slide I think. So the two, just to give you an idea of makers. And so the left is Korean. Korean is not making workshops. We do the teams and Pente on the right. This is a, we went out to our local maker space called hog. And we were able to just explore local maker practice and have an exchange of ideas. And the last slide. And that's to say thank you because we've got to wrap up now. So thank you everyone. Thank you to Jenny for a very insightful narrative with a lot of experiences shared. And it's also nice to see it in the comments. Also people are mentioning, for example, Joe's on the land that she can put into words how much experience has been gained from you projects and cooperation. Also reduces the class and seven so it's nice to hear people recognize the story and experiences that you share. It's time for one question that was there for period. And that's the question. Is the mentioned European self evaluation framework somehow connected to the ISO key indicators from museums. That's a question to you. Maybe you can quickly answer that one. Yes. Very quick answer is no it's not connected. The ISO ISO, we know, of course, about the ISO ISO indicators, but they are indicators and museums of impact evaluation frameworks framework is not an indicator framework. It doesn't assess your performance. So this is the basic difference. But we are positioning the more project in conjunction with all these kinds of previous, for example, registration or accreditation systems in addition to these kinds of of indicator frameworks. Thank you. Thank you. Then we have time for one last question to Jenny. Do you have experience of horizon EU projects written developed and coordinated by graduating students as capstone projects proposing to a network of museums and international cooperation. In other words, do you think that EU international development programs have to be pushed and developed into only internationally. That's a tricky question. I have never myself apply for a horizon EU project because it tends to lie in the world of third level university researchers and departments. And we've been invited to participate, but I believe the competition is very stiff. I also believe the lead in time takes up around two years to develop. Before you submit your application. So it's something we haven't taken on ourselves. But we've had a little taste of the grant application by participating in applications and they seem quite unwieldy. But they tend to be used by the third level university sector. That's all I can say for my own experience. I don't know if that answers novella's question. Thank you Jenny. I think that's a great moment to wrap up this whole session. I want to thank all three of you, Margarita, Perio and Jenny for your contributions on behalf of all the participants. All the participants thank you so much for joining in the session and being involved and reading the questions. I would like now to give the floor back to Julia. Hello everybody and I would actually like to thank all four of you including Lodewijk and Margarita, Jenny and Perio. And maybe to this question we are now presenting.


Ever wondered what is the difference between direct and indirect light? This video is for you. Before we start I wanted to let you know that this is part one of a series on natural light for plants so you would like to check all of the other episodes. Make sure to check out this playlist right here. But now let's get to the video. I can tell you I have learned so much about natural light with Darryl Chang from the Houseplant Journal. If you would like to check out his website I'm gonna leave it in the description below and now I'm gonna tell you what I know about indirect light. The easiest way that I can explain it indirect light is when your plant can see the sky during the day but not the sun. This can happen in many different ways. You can have a plant right in front of a window during a cloudy day so the plant will be able to see the sky but the clouds will be hiding the sun so this is considered indirect light. This also works with other kinds of obstructions for example trees right outside of your window or sheer curtains that of course will elute the light that comes to your place through the window. Depending on where the sun is at a specific time of the day your plant may be receiving direct light at some points of the day and also indirect light at other points of the day. For example here we have a south facing window so during the morning we receive some sunlight but the sun is actually coming from the east so as you can see here during the morning hours my plants actually receive a very nice light sunlight but they don't get any direct sunlight because the sun is not in their very fair of view but as you can see at other points of the day my plants will be able to see the sun. In this case they're actually receiving direct sunlight but let's really define direct sunlight. Using the same logic your plant will receive direct sunlight when she can see the sky and also the sun. Another way to know if your plant is receiving direct or indirect sunlight is to look at the shadow. If the shadow of your plant is very sharp and well defined she is receiving direct sunlight. If during the day your plant has a more fuzzy shadow or doesn't have any shadow at all she is receiving indirect sunlight. Now a very important piece of information that changed my life with plants is this. The more sky your plant can see from the place that it's standing the better it will grow and thrive. So you want to place your plants where they have a bigger view of the sky. When providing a view of the sky for our plants we want to make sure that we understand how much of direct sunlight they can actually take. This will differ depending on the plant. Some plants are okay with five hours of direct sunlight whereas others will only tolerate one or two hours. So for example if you place a plant right in front of a window you want to measure how many hours of direct sunlight she will get there and compare it to her tolerance of direct sunlight. If she receives less hours of direct sunlight than the tolerance she has she will be fine. If she receives more hours of direct sunlight than she can tolerate this is gonna be a problem and it will burn the leaves. So very important inform yourself about how many hours of direct sunlight your plant can take. And if you are interested in my course on life for plants I actually offer a document with 50 of the most common house plants and their life requirements which also includes their tolerance for direct light. So make sure to check that out. If you have any other questions or tips about light make sure to comment below. I can assure you the whole community will appreciate it and we can help each other out in the comments. And as always I will see you in the next one. Okay adios!


Hello everyone, welcome to our pre-owned vehicles of the week. I'm Gabrielle over here at Oxmer Toyota. So I have three vehicles that we're going to talk a little bit about and I want to go ahead and start with this one right here. Our first vehicle is a 2022 Toyota Avalon XLE. The exterior color is in a harbor gray. Now this is certified. There's going to be navigation, blind spot monitoring, Bluetooth. There's a clean car fax, one previous owner, and you're also going to have heated leather seating. Now the interior color is in a black, mileage is $1,374, and the price is $45,000. Our second vehicle is a 2019 Alfa Romero Gullia base. The exterior color is in a gray metallic. This vehicle is going to have 17-inch alloy wheels. You're going to have eight speakers. There is going to be a backup camera. There is the power driver's seat. There's also going to be Apple CarPlay with Android Auto. Now the interior is in a red leather, mileage is $24,264, and the price is $35,000. Our last vehicle is a 2019 Volkswagen Atlas 3.6-liter V6 SE. The exterior color is in a platinum gray. So this is going to have 18-inch black alloy wheels. There's going to be a power lift gate. You'll have a backup camera. There's going to be eight speakers. You'll have an eight-inch touchscreen. That interior is in a Titan black leather. Mileage is $45,828, and the price is $38,000. All right, you all, if you have any questions on any one of these vehicles, feel free to let us know. All of our contact info is listed right here. Thanks you all so much for watching. I hope you have a wonderful weekend, and I'll see you all next week. Bye.


So, first of all, let me get this out of the way. My name is Jeffrey. I'm not giving you my last name. I do work in the intelligence community. No, you can't spot me anymore. It's too late. Too obvious. And I have actually been required to provide you guys with this disclaimer. Everything that I put out here as to my solution for protecting these internet-enabled alarm system monitoring panels is not to be considered officially sanctioned policy by the United States government. It's only my particular solution in areas where facilities that I actually am responsible for. And so any issues you have with it, come yell at me. Don't yell at any of the feds. It's not their fault. OK, basically what we're here to discuss is alarm systems in general. And more specifically, issues involved with monitoring the status of the alarm systems and issues in protecting those alarm monitoring pieces, the hardware that is used to do that. Essentially, there are really, essentially, two, maybe three types of alarms. Most people associate when they talk about an alarm system, most people associate that with either a fire alarm, which basically detects smoke or fire in a facility, and then alerts the authorities or inhabits the area to the problem. And then more commonly, which is both residential and commercial, burglar alarms, which essentially do the same thing except without fire. Quite often, you'll find both types of alarms in one facility. And burglar alarms are basically the same thing. They detect unauthorized intrusion into your facility and then alert whoever the appropriate individual is to the situation. OK. Excuse me? What about moisture? Moisture? None of that. Well, I don't know. By the way, there's an individual up front who's a friend of mine who actually does a lot of physical security. I do more network security aside, but so occasionally, I will defer to him on that. Are you aware of any sensors that actually are designed for moisture? Would that be in the safety systems more than the burglar or fire? You want to come on up here or make it easier? Come on up, Lass.  No, you're not officially speaking. OK. My caveat would be, I don't deal with the moisture was because, frankly, all my stuff is in these lovely nice, as you've heard from our lovely vice president, Man's Eye Saves. So if they get flooded, I don't care as long as they don't float out the window and you get what's in them.  Must have laughed a little bit. So anyway, you can go ahead and then. There are sensors for everything. Moisture, heat, biochem sensors, air quality sensors. There's sensors for everything. Alarms and alarm, the control panels are the panels and he'll go into more of that. But the sensors are absolutely everything out there. OK. Basically, this is the anatomy of a burglar alarm, which is the most common alarm I have to deal with in my facilities, because I really, again, I don't care if the things blow up, burn up, or get completely moistened as long as you don't get what's on them. So all I care about is if you're coming in there and looking around. In the basic topology of a burglar alarm is you have a central panel that controls all the signals. And everything else is basically a seemingly spoken wheel topology with all the sensors lying on the outer sides. And there are multiple types of sensors. Most businesses will usually use one, maybe two of the types of sensors in areas that they care about. Military installations and some businesses that actually make a lot of money and are really paranoid. We use multiple sensors in an area to protect it. Generally, my facilities, every door has a balanced magnetic trigger on it. Every room has IR sensors that are set up to optimally monitor the room. And if, for some Godforsaken reason, the area has a window, we put glass breaks. And then the last piece of the puzzle is what the main item of my talk is about is monitoring the actual status of the alarm system. So in addition to the sensors and the main panel, you have the monitoring hardware connected. All right. This is basically, in my opinion, the de-evolution of alarm system monitoring hardware. Many, many years ago, excuse me. And if you can't hear me, let me know, and I'll speak up. When it first began, not that many people used alarms, because they're very expensive. So you either had a lot of money, like you were the government, or a really big business, and you really, really cared, because you were willing to pay out lots of money to monitor your alarm system. And the way it was done was generally dry copper hair pulled into your facility. Otherwise known as a T1. And they worked lovely. They're dedicated lines solely for your use, but they're extremely expensive. However, the reason I titled the slide de-evolution is, from a security standpoint, that's probably the most trivial thing to protect, because all you've got to do is harden your DMARC and anything beyond the phone switches is out of your control anyway. And you're not going to be the only one affected really. So that's pretty easy to protect. You just harden your lease line, harden your DMARC, and it's almost solely a fiscal security issue. Along the lines, after a few years, the alarm companies realized that most of the people that were using alarms at that time all had pots, plain old telephone service lines in their facility. So they began using the ubiquitous pots lines as they're monitoring data communication channel, because it was common. It wasn't something they had to specifically bring into the facility, because it was almost always there. And it's very cheap. What, was it about the 80s they moved to RF and cellular? Yeah, around the 80s, they discovered that while it was easier to take some of the expense of maintaining pots lines or requiring pots lines and move it over into cellular and radio backup systems, which then all they had to do is either maintain the towers and things like that, or outsource to somebody else like Sprint or whoever, and they had to maintain the infrastructure. The problem with that is, well, it's not that it's difficult to secure, it's just out of your hands. And you are subject to any outages on this other person's infrastructure. So a lot of the quality of service and stuff is now out of your hands. However, you have less to secure at your facility. And then, long about mid to late 90s and now, basically most alarm systems, especially new ones that are getting installed, the alarm companies aren't offering you, in general they're not offering you cellular backups. They're pushing the internet-enabled monitoring hardware. Reason being, because there's very little, there's very little infrastructure they have to maintain with that. And frankly, they say, well, everybody, everybody we deal with, whether it be you at your home or you at your business, we've all got broadband access at this point, so why not make use of it? And all they have to do is maintain a receiver station at their facility. And they put this client panel in on your system and call it a day. And it should be obvious to a lot of people here why I and quite a few people actually consider this a bad idea, because now quality of service, the quality of your internet connection becomes highly important. I mean, if you've got a lot of people that are playing online games on your network, now your alarm system as status packets have to compete with that traffic. And you begin to start getting a lot of false positives when you start getting your network flooded. Basically, there are quite a few of the internet-enabled alarm hardware, but two of the examples that I'm familiar with and that are most commonly deployed are ones made by a company called DMP, which basically makes a lot of that, DMP or a DEMCO. And they basically make a majority of the sensors that are deployed in alarm systems. They make a product that's called the ICOM or the ICOM-E. The only difference between ICOM and ICOM-E is ICOM-E, they added an AES encryption engine onto it. So frankly, if you have the option of getting ICOM or ICOM-E, they're not that much, they're not that different in cost, and one of them is going unencrypted. And the other major, the other more common one is a product called AlarmNet. The specific, well, there's a whole series of alarm data monitoring hardware under the AlarmNet name. This particular one is the AlarmNet I, which is for internet, or the common reference, the model number for it with Honeywell is 7845 I. And these are basically the two most common that if you're deploying a new alarm system, these are probably the two that you're going to be asked to choose from. Yes, yes, actually both of them do. In fact, the AlarmNet one, you don't have to choose whether you want unencrypted or encrypted. The AlarmNet product actually, by default, comes with encryption, and what's actually, I find kind of nice about it, is you get to choose which algorithm you want. And I'll get to it in a little while, but the DMP only uses AES, and the AlarmNet lets you choose, in depth, to one of the keynote speakers here, Blowfish or AES. In fact, I think the AlarmNet defaults to Blowfish, so you actually have to change the option to move it to AES. Some of us don't have a choice. OK, basically the DMP product, you have a choice between either UDP or TCP for your reporting traffic. It defaults to UDP, so if you want a little bit of a transaction integrity with TCP, you have to change the option to tell it you want TCP. The port is configurable on it. However, the default for the factory is port 201, and frankly, let's be honest, how often do you think the install tech bothers to change any of the factory defaults unless you actually insist? So this will come into play later when we discuss actually snarling around on your network to try and find these things, just because you're curious. Now, one of the things I find interesting about it is it also uses, if you choose AES, the AES key is 128-bit, which I find disappointing because the AlarmNet, when you deploy the AlarmNet one, the key is actually a 256-bit, which since the overhead isn't that big these days and embedded equipment is fairly, you know, resource, fairly well done. A 256-bit AES key is not really going to be too much trouble for it to use, so why didn't they bother using the largest key size? I don't know. One thing that's interesting is that the DMP guys, if you actually read their little marketing stuff, they tout all their lovely security features on there. And some of them, for people who are in this community who actually attend DEFCON at least once, maybe more than once, having a bit of a clue, you'll actually find some of the reasoning fairly laughable. And the sad point is this is not their sale stuff. Basically, this is the install text information. I got it because I shoulder-served my tech and when he left all this stuff, I kept it. So basically, one of the things that they touted as being a security feature is the fact that their communication protocol is proprietary and writes on top of TCPIP. And yeah, nobody's ever figured out a proprietary protocol, have they? And actually, even worse than that, I will read you the application note for the tech that is what they are told to spout back to you when you ask about the security features. The really sad part is this last little bit, and I'll read it off, it's a little long, but I'll read it off because I think some people at least get a kick out of it, especially here considering what's taking place at this DEFCON. Furthermore, it would be extremely difficult for a hacker to break into a panel or central station receiver through the network monitoring connection because several pieces of unfamiliar information are required to gain access. A potential hacker would have to know all of the following information, account number. Now, account number, OK, granted, I can understand how they think that's a problem. But generally, all of us who have alarm systems, everybody gets a little card. And guess what's on the top of that card, the account number, because hey, when you screw up and you actually have to talk to the data monitoring people and go, yeah, I know I set off the alarm, but I'm really supposed to be allowed to be here. First thing they ask you is, read off the alarm account number on your card, please.  The next one is IP address. And I'm sure nobody here knows how to use Nmap and figure out what IPs are available on the network. And then in addition to that, they say the port number used by the system, and as I discussed previously, granted, the port is configurable. But it defaults to 2001, and what do you want to bet? They didn't change it. So all you got to do is go map the network. For anything on port 201, 2001, you probably found the alarm net. But beyond that, they actually have one semi valid, which is panel secret remote key, which is basically the shared secret that they use. I can tell you from my own experience, having shoulder surfed install at several of my facilities, in more than one state, as a matter of fact. The shared secret is only eight characters, and I didn't actually just breathe over a shoulder, but it looked to me as if it's the same one everywhere. And then the last one is their lovely feeling that their proprietary communication protocol running a top TCP IP is actually going to save you. So good luck. But the point I wanted to make actually in my talk is they're talking about access to the system. And frankly, I can tell you from my perspective, dealing in highly classified security environments, I don't really care to get access to your system. If I can disrupt it, I can make it useless. As long as I make your alarm system useless, you're not going to look at what I'm doing anywhere else. You're going to pay attention to all the phone calls coming in from Honeywell or ADT. You're going to pay attention to all the people complaining that they're getting alerts from the alarm system, and you're not going to pay attention to anything else. OK, and now a little bit about the alarm net one. It only uses TCP, so you don't have a nice little default there. You don't have to bother deciding whether or not UDP or TCP is good. And one point that I forgot to mention earlier and make earlier is that what we're talking about here is you've got guys who normally don't do network stuff. These guys, as far as they're concerned, the computer is that thing that plays solitaire for them all day. So asking them whether or not they want to use UDP or TCP is meaningless to them. They don't know whether one is better than the other. So they'll just go, whatever you think is good, go ahead. And so naturally, the tech's going to just leave it at the default. Now, the Honeywell on the downside, the port is not configurable. So there's your big tip on if you want to find one of the Honeywells. Anything running on port 54109, TCP, you probably found one. And in a second, I'll tell you, you can see at the bottom if you in-map it, if you've got a node on your network and it responds in some way on 54109, TCP. And you see in the in-map scan that the network adapter is identified as a DEMCO, Bingo. You know definitively that's an AlarmNet i device. Now the nice thing, as I mentioned earlier about the AlarmNet i, is you actually get to choose which encryption protocol you use. And if you're a general business or even residential, this is actually not specific to just businesses and military and all that. They're actually starting to deploy these and residential too, which is another point that I wanted to make in this talk, is that how many people out in suburbia are actually going to care about all this stuff? They're not. They're frankly, and all the DMP stuff and the AlarmNet stuff, they don't actually insist that you segregate this from the net at all. Their feeling is it's perfectly fine to stick this straight on the net. Because hey, nobody ever probes things on the net, do they? So you actually have a choice. It defaults to blowfish. Frankly, I love blowfish. I'd be more than happy to use blowfish. AES is actually a very good algorithm for my purposes and for anybody here that actually deals in facilities that have that nasty acronym SKIF. You have no choice. You have to use AES. The reason you do is because AES is UL2040 certified. And you cannot, in a SKIF or any other classified military environment, you cannot use any algorithm that's not. It's been UL2040 certified. So you have no choice but to default to AES. And then, of course, both of the monitoring panels will default back to a plain old telephone service dialer. And that's their backup method. If they can't communicate over the network because you flooded it or whatever's happened, the router's down or whatever, then they will flip over to the alternative, which is the dialer, which we'll call the central station. But basically, what the dialers do is they dial the central station, then they hang up. The central station calls back in and checks the status and all that. And again, this goes back to people who deal with SKIF. You don't have this option. I'll explain that in a little bit. OK, this is some of the characteristics. Some of this is I've already gone over. But basically, the DMP runs on port 2001. It is configurable, but generally you're going to find nobody ever changes it. Defaults to UDP, the reporting central station is a piece of hardware known as a CSC1R. And in DMP at Demco's favor, I will actually say that it's not easy to get a hold of their equipment. Unfortunately, it's not quite the same with the AlarmNet I equipment, which will play into disruption and attacks in areas later. And then with the AlarmNet, it defaults to, well, you have no choice, it uses TCP port 54109. And then it reports to an AlarmNet product called the 7810 IR. And what I found is, doing a little looking around, you can actually go on eBay and for $100, you can buy the reporting note. And as I mentioned, this actually will play a key part in attack and disruption scenarios later in the talk. One of the other amusing things about the DMP product in their extremely secure product, one of the defaults is you can configure the entire panel across the land with Telnet. Yeah. Now, the AlarmNet, as I said, reports to a 7810 IR. Now, the nice thing about the AlarmNet is you can't actually configure it over the network. It takes effort to, and a little bit of extra hardware to actually make it network accessible. The default way for configuration on the AlarmNet product is the AlarmNet device. It's an RS232 handheld configuration panel. And the device is called the 7720P. So, OK, now it's wonderful, because you think, OK, well, I can only configure it with this one device. But guess what? Go back to our friend eBay, you can buy one for $30. So basically, now the DMP product, as I mentioned, they're very, very careful about accessing it. You have to be a valid, verified vendor before they'll even sell it to you.  However, I'm sure if you go talk to Kevin Mendecki, it'll probably be happy to help you do a little social engineering and pretend you're a vendor. OK, now, basically, this is some really sanitized traffic, just to give you guys an idea of what the traffic looks like, so you can see what it looks like. And then you can see what it looks like. And we have actually noticed that there are indeed certain patterns that show up, both in the window sizes and in the sequence numbers. And there's not enough here to actually see the patterns. But at the end of the talk, I have actually set up a wiki for anybody who's interested in joining a few of us that are working on playing with these things and seeing what we can find out about them. And we actually have extensive traffic captures up there, so you're welcome to download and fire up TCP dump or Wireshark, read them in, and go look at them. And you will start to notice there are a lot of patterns in there. So our main goal is to basically reverse engineer the proprietary communication protocol, just to point out that there are a lot of patterns just to point out to them that that's not a security feature and please do something about it. And I'm also trying to, as I'll mention later, we're also trying to talk to them about other scenarios for trying to at least mitigate some of these issues. But yeah, this is basically what if you see traffic along these lines. And you'll notice they do definitely repeat. You get the normal TCP traffic with a little bit of a twist because you get the send coming back with a send act, and then you get the act. But then you get a push act and a push act back and a reset. And that's it. That's all you get. There's no act coming back for the client ever. And it just starts over. And it's really odd. And we've noticed that some of the Windows links today. And looking at the actual payloads on the things if you pull down the traffic captures that we have up on our Wiki, you'll notice that the payloads actually have certain areas that never change. So we're fairly certain that we have an idea of what they're using for an IV for their keys, too. Which also led us to believe that, frankly, all the shared secrets that they're putting in are probably the same everywhere. And then here's the example of traffic out of the DMP icon me. And again, you can actually notice that some of the traffic patterns, there are certain patterns that do show up in the traffic. And it's very similar to the other one, although you actually do see in the DMP product that somebody there must have read TCP IP Illustrator at some point because they understood that you should send a phone at the end. So they actually do halfway close the connection. All right, now this is really what I wanted to stress here is what are the considerations you have to take into account when your system, you're deploying into an alarm system and you're being told you're gonna monitor it via the net. And basically at this point, quality of service on your network becomes of the utmost important. And frankly, I do deal with firewalls, routers, and I personally am not really good with QoS. I mean, I can make it work, but it takes a long time. I know a few people are really good with QoS, but I'm not one of them. And one of the chances that most of the people that work in the physical security side are too, which leads to yet another issue that I'll address later. Now, as I mentioned earlier, if you're in a classified environment, specifically one that is covered by the security rules set forth in DCID6 slash nine, and most of the fans will be happy to explain to you what that is. It's basically, it's a director central of dollars directive that tells you what security criteria you must meet to protect an SCI facility. And one of the things in the NXB that I've denoted there is that you cannot have two-way communication to your alarm system. So guess what? That nice little lovely backup dialer? You're not allowed to have it. Why? Because the system, when the backup dialer calls into the station, the station will call back to you. At that point, the station can actually check all your sensors and everything. And if somebody on your end tells the station to initiate a configuration modification, they can upload your entire configuration out of your site, mod it, and have it re-downloaded to your system. I.e. they can change the access restrictions that are applied to certain accounts. They can add no accounts. They can delete accounts. They can change opening close times that you may have restricted for certain areas for reasons. And it's not that odd a scenario that someone could get that kind of elevated privilege to do those things with your system. And the reason I say that is you would be amazed what you can learn by simply shoulder surfing the install tech when he's at your place. Case in point, one of my facilities while I was walking around behind the ADT guy, I at this point actually know the ADT tech install login for the entire continental US. So I can log in as an ADT install tech because guess what?   You will if you give him a cookie. So, and then if you do figure it out and you get busted, I will not testify on your behalf. And then don't bother, don't bother Jennifer Granick or the EFS people because they're just gonna tell you good luck. Okay, more deployment considerations. As I said, network QS is now basically the most important thing right up there with firewalling.  Now your alarm system's not gonna be able to communicate back to the central station, which means you're gonna start getting a lot of false alarms. If you're in a regular facility that's allowed to use the backup dialer, that's not quite as big an issue.  Yes, I'm getting to that. But it states that the alarm must be on a separate line but it also states very definitively, no two-way communication. And the dialer does indeed allow two-way communication. But the other issue that you brought up, I am getting to that. And as I said earlier, I have been required by my sponsor to say this is not at this point and I cannot imply that it will be, although wink, wink, I'm working with them. Official US policy on how to protect any system that may be monitored via the net as opposed to RF or lease line. So basically, yeah, routing issues are going to become the most important thing that you have to deal with. And frankly, you can only control all the way up to your next hop router. At that point, it's out of your hands, which is one of the reasons why I tried to explain to them before. They allowed all the alarm systems to say, no, we don't offer these other services to you. Sorry, take it or leave it, but it was a bad idea because how often do you have problems routing on the net pretty much every day? The other issue is now, angry Eastern block teenagers can come talk to your alarm system. And the last issue is, unless you do as the gentleman in the back mentioned and as most people that live in that particular environment are required to do and should, if they don't already do, is that it's not a good idea to put this straight on your land because now it's just another node, just like all the desktop boxes, which means, which will mean that not necessarily people are gonna maliciously mess with it, although some probably will, but if you get a box that's infected with a worm, it's gonna flood the network, cause you problems. So, and beyond that, it means all the guys in the golf courts and the flashlights with the nice shiny badges actually have to make nice with all of you guys. And how often do black T-shirt wearing shut-ins enjoy talking to the guy in the golf cart? It doesn't work out really well. Okay, some of the disruption scenarios, because as I stated, the point of our project is we don't really need access to the alarm system. We're not interested in taking it over and making it do what we want, although that might be a nice mystery box game for next DC. But basically all I care about is can I make your alarm system useless? Cause this is all I need. So the DMP guys and the alumni guys, unfortunately, both think that the fact that, oh, we have no, you scan it and you see no open ports, so therefore it's safe. But guess what, they talk IP. So they talk to the network. If they can talk to the network, the network can talk back. So what happens when you flood the network? Well, it depends on the reporting window that you have configured in your system. If your reporting window is once 24 hours, I'm pretty sure at some point I'm gonna figure out that my network's being flooded within that 24 hours and take care of it before it flags the system as having communication failure and people start getting calls. However, facilities like the one I live in, I have to have a reporting time that's like three minutes. So I start getting lots of false positives every day, and they are false positives.  So what happens when you set, what happens when you set your own syndrome resets back to the system? Same thing. The thing doesn't talk to the other end. Eventually you hit that reporting window, you start getting phone calls. Now the other thing is we haven't had much luck, but we're certain that it's possible. Since these things don't actually use DNS, they only talk to IP on the network. So DNS really isn't an issue because they don't even bother with DNS. But frankly, at that point, ARP cash poisoning becomes very important because if you can figure out what the, all you gotta do is figure out what the MAC address of the next upstream hop is on the system, poison the ARP cash, and then tell it you're the next hop, tell it you're also the reporting, got a system IP, and now it's talking to you.  ARP cash poisoning, tell it, quit talking to the guy over there over in Florida, frankly. That's where ADT keeps their boxes. Not that I'm encouraging people to go look for them. And now you tell them I'm really the box in Florida, even though all of a sudden you're only one hop away. So again, my disclaimer, this is my solution. This is not official government policy. This is only mine based on common sense from having done this kind of stuff for 17 years. My own experience is dealing in all sorts of facilities, both regular business facilities, my own home, and other facilities on behalf of the man, and then stuff I've cleaned from all the various tech install manuals that I've managed to sequester away when I'm dealing with some of the techs and they forget things at lunch. So basically what we did at my facility, and I'm trying to, at this point with the project that I'm gonna, after DEFCON here, open up to the public, is we basically decided that, well, it made sense as the gentleman back there pointed out, that not only would SCI facilities be benefit from having their system segregated on its own line, but everybody would. So we thought, well, if the vendors aren't gonna bother trying to solve this problem on the hardware side on theirs, then why not put a piece of hardware of our own design that we know has been thoroughly vetted and does the job properly and has security mitigation issues, security mitigation methods in place. So what we did, what I've been doing on the policy side is trying to put together a deployment policy. One of the things would be, insist that don't put it on your land, go pull in a DSL line, because DSL lines are like 20 bucks a month. So pull in a DSL line, because frankly, as I mentioned in the first talk, POTS lines and facilities are common.  And then the QoS becomes less of a worry, because now you've only got one node talking on that network. QoS is still important, but it's not nearly as important because you're not gonna have to worry about other nodes on that network. At least you would hope not if you properly follow layer one security, fiscal security issues and lock it away. But at that point now, QoS becomes less of a worry, because you've only got one node, you've got your reporting node, you've got your firewall, you've got your DSL router. Beyond that, you can't control it, so why worry about it? One of the other things that I do basically, because it's a requirement for me, but it's also just part of my paranoid nature, is the DSL account is actually an individual's name, and no, it's not mine, so don't go look for it. And then we actually have all the billing go to a disassociated mailbox. But those are actually standard, those are operating procedure issues, not really directly relevant, but somewhat pertinent. So what we did was we started to build our own firewall. We decided the easiest way to build an embedded firewall was either a PCWrap box, or frankly, I like the Socrates boxes, so I defaulted to the Socrates boxes, because they're nice and cheap, really nice boxes. And frankly, after, I think like next week, Socrates is finally coming out with a really nice 686 box, only about 300 bucks in a 19 inch, one new rack mountable case for like 350 bucks, which not bad, I mean, granted it's a little more than a Linksys router, but you're not gonna want a Linksys router as your firewall for this for a few reasons. So basically, we're working on building a Linux system from source. We're looking at whether we wanna hack together our own distro, or whether we just wanna build a modification of busybox. The cost is potentially less than the long run, because in order to get a system that really is the quality you want protecting your alarm system, you're not gonna get a Linksys, you're gonna get one of the commercial ones, which are gonna potentially cost you a few thousand dollars, as opposed to a couple hundred bucks and maybe a day or two of your time. You also have more control over the configuration. I mean, when you buy a commercial firewall, and granted they're very good, but you don't have full control. You can't add or modify any of the services, really, at least not without avoiding the warranty on it, and then it becomes your own very expensive version of this. And in my case, doing this allowed me to standardize my hardware and software solution across the board. So if you have a situation like I do, where you deal with multiple facilities, and they're spread out all over the world, all over the country, all over the world, or whatever, you can still guarantee that troubleshooting issues is gonna be capital minimum, because the hardware's the same, software's the same, so it really reduces your troubleshooting issues to find out why the alarm system's not really happy. Some of the choices we made also, for whatever personal reasons we decided, for some of the reasons why we decided to make our own firewall is because we decided to use syslog ng as our logger, instead of sysklog. Reason for that is because syslog ng will actually report over TCP, which will also allow you to wrap it in an SSL tunnel, thus protecting your firewalling logs. If you decide that you want to do off-box logging, you can mitigate the network access on that by firewalling off the NF face that you connect to your administration monitoring network and simply tunnel the logs over there so that you don't have any issues with snitching or injecting at that point. And we also wanted to include log watch and log rotate, at least in my instance, because frankly, I'm lazy, and so I like having log watch, so it'll mail me my logs every morning and I can see what's been going on with people probing the system. And then I frankly did not want to build post fix or send mail or anything simply to move those logs off, so this allowed me to put SSMTP, because that's really all you need.  So some of the issues that I had to deal with was, if you're responsible for multiple alarm net monitors, how are you gonna monitor the logs? That will explain to you why I did the log watch thing because frankly I wanted to move all my logs off onto my desktop because it's one thing to monitor multiple sensors throughout a building. It's another thing to monitor multiple alarm sensors or alarm monitoring hardware throughout the country or throughout the world. You can't continually, every morning, fly to a different area and go check the logs. So this allowed us to run our logger over S tunnel to protect the logs and then run log watch to fire them off to us every morning so that we have a centralized nice little thing in our inbox instead of having to actually go out to each of the firewalls and actually log into them and monitor the logs manually. And also building our own firewall allows us to control the patching. When we built our own firewall that allowed us to only put in what we wanted. So we don't have a whole bunch of extra junk in there.  It's solely because that's part of the LSB package on Red Hat and you can't actually remove it without really mangling the distro. So this way, building our own version of it allowed us to keep a lot of the stuff that had no business being on the firewall offered in the first place.  And then it also allowed us to have far more control over the firewalling rule set because we could literally get a shell if we needed and manually manipulate the rule sets on the fly as we saw fit as opposed to being restricted to whatever interface was provided to us and having no other options. And if we wanted to, as I mentioned earlier, if we want to add other functionality, whether or not it's a good idea, we would at that point be allowed to add things like inline start capability which would create some semblance of an active IPS. Well, what we're doing at this point is I've been dealing with a lot of IPS vendors and stuff, frankly, because I'm in the AHA group with H.E. Moore and a few other people. And so we've been, some of us have been talking about it, trying to develop traffic signatures from these so that you can identify them, not necessarily from nefarious purposes, but so that we can get a good handle on what is actually good traffic for these things, thus making it easier to pick up anomalous traffic and therefore if we decide to add inline snort functionality or whatever, now we have an easy way to deploy signatures that will actually do stateful packet inspection and say, even though this looks like is an acceptable firewall, a piece of traffic for the firewall, looking at the payload, I know it's malicious, handle it however I see fit. And the other thing that we have ongoing right now is we're actually, in addition to trying to pick out what the shared secret is, just for our own curiosity, we're trying to find people that are pretty handy with crypto, that are interested in testing to see how effectively the crypto was implemented in these items, granted they're UL2040 certified, which is great, but maybe they missed something maybe there are actual ways to bypass the encryption and grab a look at the proprietary communication protocol and then create your own man in the middle. And actually one of the points under there under the effectiveness is the timestamp and recently, we'll see it was a middle of last week, one of the guys is looking at the traffic captures that we have up on our wiki, he had mentioned that he thought it was a timestamp for the IB, but when I and a couple other people took a closer look at it, we realized actually there was a pattern and it looked to be the same, so obviously it's not a timestamp because it would change a little bit every single time and it doesn't, so that's actually a missed number. Now one of the things I have been trying to discuss with the vendors to, I got five, one of the things I have been trying to discuss with the vendors to take care of this is to get at least a minimum of authenticity to the entire communications process is trying to see if I can't convince them to implement an IP stack in their client and monitoring receiver stations, so you at least will have a modicum of secure feeling that you are indeed talking to the distant end that you think you are, thus not eliminating, but at least making the ARP cash portioning issue a little bit more difficult to pull off. And then basically at this point, that is actually the URL at the bottom is the wiki. As I said, we haven't actually gotten a fully functional version of the firewalling base out yet, but once we do, a link to the subversion repository for it, we'll actually go up on the wiki. So anybody who wants to go to that wiki, get yourself a count and start helping out, looking at traffic, making suggestions, helping out with working on the firewalling code or anything you're more than welcome to. The one thing I would suggest is I'm really cheap, so I didn't bother paying Dreamhost for a static IP. So there are no TLS connections. So frankly, if you get yourself an account here at DEF CON, you better change the password as soon as you get home because somebody else is gonna start using it. Basically, that's it. So if anybody's got any questions, I'll be happy to answer them. And thank you very much for your time. Yes? Vendor, what are some of the things that we have in here? Actually, they're actually pretty good about that too. Oddly enough. They really are. Like I said, the AlarmNet guys, they're the ones that I got more of their install manuals and stuff. And frankly, it's not, on that, it's not the vendor that's the problem. Getting the manuals, I got the manuals from the install tax because they don't pay attention. They go, I'm half done, but I gotta go out and get a smoke. So they go, you know? And they leave the manuals sitting right there. So I run over the copier, I copy it, I put it back. Now I gotta copy the manual. They don't look around, they don't know. They don't take the manual with them. But frankly, as I said, that's not the vendor. That's the Chubb employee or the Honeywell employee or the DMP or the Mom and Pop Alarm Shop if it's a residence. So that's something that's out of their reach. So I don't actually blame them for the fact that I have a lot of their install stuff. That's not their fault. They can only tell the vendor, please be careful with this and they can't fall them around and babysit them. Anybody else? Okay, thank you very much.