I want to welcome everyone to our zoning administrator meeting, and we're just working out a few more things. We appreciate your patience for, we'll get started shortly. Again, we want to welcome everyone to our zoning administrator meeting, and we are going to get started shortly. We appreciate your patience. Good evening, everyone. We're going to go ahead and get started. My name is Amy Nicholson. I'm a senior planner with the Planning and Economics Development Department, and I will be acting as today's zoning administrator.  Sorry, just a moment. It's up, Amy. Thank you. Are you able to hear me okay, Kimberly? Yeah, you sound great. Thanks. Okay. I'm not sure what's going on on my computer end, but I actually cannot see the Zoom webinar, so actually I'm going to leave for just a moment. So I can see staff's presentation. So just a moment. Great. Thank you all for your patience. This is a special meeting of the zoning administrator for June 15th of 2021. We are holding this meeting in a remote fashion due to the governor's executive orders and also to reduce the spread of COVID-19. Kimberly, if you could scroll down a bit on the agenda, please. So today I am calling the meeting to order. We will move right into the scheduled items. The first item 2.1 is a public hearing. This was continued from the June 1st special meeting of the zoning administrator, and this is for Stoney Oaks Apartments, EIR, an addendum to a previously approved EIR by council and a minor design review. This is for a residential project located at 2542 Old Stoney Point Road. And Adam Roth is the project planner. He will go through his presentation and the applicant will also make a presentation. And we will open the public hearing for the public to provide any comments on this item. So if you are participating on the Zoom platform, you can go ahead and use the raise hand button when that time comes. And if you're calling in, you can press star nine for your comment to be acknowledged. So with that, I will go ahead and turn it over to Adam. Thank you, Ms. Nicholson, zoning administrator. I'm going to go ahead and open up the presentation and get started here. Okay, let me know if you can see that. Yes, I can. Thank you. Cool. Excellent. Thank you. Today, the item is the continued item of Stoney Oaks Apartments minor design review. This is the 2542 Old Stoney Point Road. The zoning administrator meeting the June 1 should be updated at June 15. This is from the previous public hearing. I am Adam Ross in terms senior planner, the project planner for this project. The project includes two parts. One is the director level approval, which means it's ministerial that is the density bonus that is state approved. So by right, there's 132 units for this project. You have, and this proposal includes a density bonus of 7.5% to get 10 additional units for 142 units. This section is fully affordable. And when you get a density bonus that is state approved, you based on your determination or your designation of affordable units, you can have up to three concessions. The applicant has requested one for height. It's an increase of five feet to 50 feet. This section is the density bonus is for information only. And this itself is not under review tonight. That is, again, a ministerial by right. Sorry, not by right. It is a state mandated approval. That's a sense that's not part of this review tonight. So the approval that which is tonight is for minor design review. It's for a modified review authority under zoning code section 20 dash 16.070. Essentially that takes projects in priority development areas such as this, which I'll get into in a little bit from a major designer view to a minor designer view. And just to reiterate, the use is allowed by right. The allowed density is 132 units by right. And the density state density bonus gets them to 142 units. The project is located in the Southwest quadrant of the of the city. This is a general area over here. Sorry, right about here. Here's a aerial image here, as you can see in a look and I'll go over it a little bit more in this presentation but there are some existing trees on site outgrown trees on site. This is the New York project. It's, it's one building four story is four story apartment building. That's, again, that's 142 units that, which is a 7.5% density bonus. One can, and they're requesting one concession. They project has been deemed eligible to obtain this density bonus. Again, that's not under this review tonight. The project includes one two and three bedroom units fully affordable. There are two and three story elements on the end of the lord of the single building, which is shown in the, in this presentation and the applicant team will also go over that in greater detail. The project includes an Oak Grove preservation at the entrance. Again, that was the one that I just referenced in the previous slide. The project is still subject to the tree mitigation, the city code for tree mitigation. So, and that is outlined in conditions of approval on the resolution of this project. The amenities include a child's play area and passive outdoor recreation. There are 185 parking spaces provided that is per government code section 65915 P one. That is the max that the city can ask for for affordable housing projects, and in this case they have provided that and are within code required parking. That is within the prior rosin priority development area and is with, which is part of the Rosalind sabassable road specific plan for which an ER was certified by city council. And that plays into the environmental review for this project, which I'll go over a little bit later in the presentation. Right plan. There are two entrances, one on her and one on old stony point road. There is as much of the preserve of the Oak Grove as the applicant has been able to obtain. And there is a tree mitigation tree construct tree mitigation survey included as an attachment for this project for the public's view. There is it's one building part of that comes from the concept design review here meeting, which was noticed and held with the designer review board. Some of those comments indicated that preservation of the Oak Grove and the onsite amenities are more important than breaking up the building into multiple buildings. So one building is appropriate that also allows the onsite circulation for fire access and and internal access for residents as well. Here's some renderings of the project. Part of the roof and roof lining and elements were considerations for the applicant team given by the designer review board. So those are outlined in the resolution for the designer view permit. Sorry, the designer view resolution. Here's another rendering. As you can see there are there is a proposed six foot good neighbor wood fence surrounding the project site is another rendering as well. Again allowed by right is 45 feet in this area. The density bonus is to increase to 50 feet. So only it. So it is only five feet larger, five feet taller. Here's some materials and colors. So landscape plan was which is essentially the same site plan shown earlier. Here's a close up of some of the landscaping. Here's some passive amenity spaces outdoor amenity spaces for residents. Here's some outdoor amenity spaces. A child's play area. Some of what that wood fencing would look like. This fencing would go along the Heron Avenue entrance and the Stony Oaks entrance for vehicles. Part of the review of this project included traffic. It was conducted by W trans the date is actually May 18, 2021 it is included in this packet. It indicated that 51 am and 62 pm peak hours were would be included as part of this project.  And in that traffic impact study it it it analyze intersections around the area and how acceptable they would how they would operate on a on a level of service. As well as pedestrian bicycle facilities. Those conclusions indicated that they would all continue to operate acceptably. In addition to pedestrian bicycle facilities being adequate for the site. The project would also contribute 9.3% of the cost of the proportion proportional share of the signalization of Heron Avenue and Burbank Avenue. So that's the cost down indicated down here. The environmental review of this project. Included a thorough analysis. So, with the specific plan EIR. There is sequel section 15183 which are for projects 15182 which are projects pursuant to specific plans for which an EIR was certified. Because there is a state density bonus of 7.5%. The project had to analyze. Could not fall under the consistency determination. However, under sequel section 15164 it provides that an addendum to an approved EIR is appropriate when only minor technical changes or additions are made but none of the conditions described in section 15162 has occurred. Section 15162 includes that the proposed project does not constitute a substantial change that would require major revisions to the previously certified final EIR. And there have been no substantial changes with respect to the circumstances under which the proposed project or Rosalind area, subascible road specific plan will be constructed that would require major major revisions to the previously certified final EIR. And there's been no new information of substantial importance that was not known and could not have been known with the exercise of reasonable diligence at the time the specific final EIR was certified that has come to light and does not show that the project would not have would have one or more significant effects and does not show that the project, sorry, was certified and has come to light and that shows any of the following that the proposed project or Rosalind subascible road specific plan would have one or more significant effects not discussed in the certified final EIR and that significant effects previously examined would be substantially more severe and that mitigation measures or alternatives, alternatives previously not to be feasible would in fact be feasible or substantially reduce one or more significant effects and that mitigation measures or alternative alternatives considerably different from those analyzed previously would have substantially reduced one or more significant effects. In this case, none of those appeared to be none of those were shown to be as part of the sequel analysis for this project. The analysis included a VMT analysis for which this project has screened out for for vehicle miles traveled which is what sequel would now consider for traffic which has to do with greenhouse gas emissions. In this case, it screens out and doesn't does not have a significant effect, and the addition of 10 additional units, as opposed to the 132 that are allowed by right does not have a significant effect on the environment. And for this an addendum was prepared, and that addendum also includes a mitigation and monitoring reporting program, and is included as part of the attachments to this agenda and included as the first resolution attached to the first resolution for adopting the agenda for adopting the addendum I apologize. And then last two things to go over before I finished my presentation. The first is that there is a condition of approval on from engineering and traffic for this project. So, as you can see here on the bottom section of this her and avenue entrance and exit. There is no. There isn't any adequate sidewalk pedestrian access. There is a bicycle lane but there is not pedestrian access along this frontage. So, the city went through a few exercises with the applicant team. One is to pursue that the applicant on their own discuss with the landowners adjacent to their property to obtain easement rights to provide pedestrian access down to this location, which is arrow would drive and then install a signal on a flashing crosswalk here to connect pedestrians from this exit down here so they can go to a place to play. I'm sorry not a place to play the Southwest Community Park. If that doesn't happen. This is, and just to be clear the city is not requiring this to happen, but are making the applicant go through the due diligence of working with the property owners. And in this case one property owner is not against it, but these things do take time to figure out. And in this case, there is another, you know, they, they could also potentially speak with this property owner to cut through directly through these. It's like an if this than that. And finally, if none of those are able to be obtained by the applicant, not by the city. It would be, and then if those are unable to occur. There would be signs and limited access so that only vehicles could go in and out of this location. And then all pedestrian access would have to go to Old Stony Point Road, where they would connect via sidewalk to the southern portion of her now. And under the going back just a little bit to the final EIR, the mitigation monitoring reporting program for this project does require that the applicant obtain all necessary environmental permits. That is from the regional water quality control board, which are 401 permits and or 404 permits from the US Army Corps of Engineering. And also from the US Department of Fish and Wildlife for California Tiger Salamander mitigations, which is, which is critical habitat for all for nearly all of Southwest Santa Rosa. So these are still requirements that they have to make just just to make that clear. So those are. One aspect of this engineering development services here in the meeting to go over that if any questions arise to discuss that condition of approval. And then one more. And then that would, I apologize that would be it. And with that, that concludes my presentation. This is a applicant presentation for which I can, I will now upload. Thank you, Mr. Ross for that presentation and we can go ahead and move right into the applicant presentation. And I will be saving my questions for after the public hearing portion of the meeting. Thank you. And let me know if you see this presentation. Yeah, Adam, it's up now. Yeah, thank you for your presentation. Good evening, everyone. This is Taylor Rasmussen development director with meta housing. We could probably drop down a slide. So at the initial hearing held on June 1, a few community members asked some questions about the project, mostly surrounding topics of Sequa traffic density for the area. So we're going to go right in the way in which our projects fit into the surrounding community. And that extends to our commitment to addressing specific questions that residents may have for us as a developer. So again, we want to have that open dialogue to help address misconceptions and are grateful for the opportunity to meaningfully engage with our neighbors here this evening. So I think Adam touched on a lot of the topics. I'm going to briefly address and I think first we wanted to touch on the traffic analysis. So as Adam mentioned, the traffic is not required. Sorry, the project is not required to perform a vehicle miles traveled or VMT analysis for two primary reasons. One, the project site is in an area of Santa Rosa that has a baseline residential VMT per capita. That is more than 15% below the county wide average. And two, as 100% affordable housing, affordable residential housing development. The project qualifies for VMT screening criteria established by the city of Santa Rosa. So according to the city and our consultants as well, either one of these project characteristics establishes a presumption that the project will have a less than significant VMT impact. Additionally, the city's traffic engineer as well as the traffic engineer who analyzed project related traffic are available to address any specific questions surrounding those determinations. You know, next topic was with Sequa. So, I think Adam touched on this one as well but Sequa consistency was analyzed through the addendum process and EIR for the specific plan in this area, analyzed all environmental impacts for this project with the exception of those 10 dwelling units that are being provided via a density bonus. The purpose of the addendum is to address those 10 units to ensure that no additional significant impacts are caused by their inclusion. State Sequa guidelines do not require a circulation of an EIR addendum because these changes are very minor in their very nature. Lastly, state and local density bonus. So those 10 units and height increase are permitted by the state and local density bonus. The city has a mandatory duty under state law to allow both providing it with pretty limited discretion at the city level. And the minor increase will help the community address the housing crisis and need to house residents of the Santa Rosa area. So those are the main concerns that were addressed at the previous meeting, according to our notes. But if I missed anything or that I missed anything, we're happy to discuss further if community members have further questions and comments and are on this evening. That's all I had on my end for the applicant and I can turn it over to the Dolan group, our architect on the project. I would like to briefly go through a few slides here and present to the community. If you could please raise your hand so that you'll go to the top of the participants. Thank you. Great. Did that work. Yes. Oh, excellent. Thank you. Great.  If you want to drop down a slide. Adam did, you know, very thorough job going through the project again and Taylor hit the high points of the some of the questions that we received. So I'm just going to keep this very, very short. I can go into more detail of questions arise, but I want to keep it very brief and just hit some high points. As Adam mentioned, one of the things that this this design does is preserves that existing Oak Grove on the page left side of the site the western side of the site. We felt that was really important for preserving the, the interface with the neighborhood the rest of the site is has very few trees on it it's kind of just an open field. And that's the main access point for both vehicular and pedestrians coming into the site is from old Stony Point Road that is a cul-de-sac. And so that is limiting the, the impact on the surrounding neighborhood. The access point off of her is a secondary vehicular access. But the main point of entry is through that Oak Grove on the western side from old Stony Point Road. So as, as Adam mentioned, we are fencing the site. We also have a pretty decent tree row all the way around the site in a landscape strip plus additional landscape islands to create a pretty significant tree buffer around this site. And then the building is pushed even further back by the parking area that surrounds it so it's really centered in the site and pushed away from from the neighborhood. Next slide please. The other thing I wanted to show is this is, as you can see in the lower graphic, this is the view, the one viewpoint from Herne Avenue. And what we've done is taken the building and the, the portions of the building that are on that south side are short little wings. We've taken the building and dropped it from four stories to three stories, but this particular wing that's closest to Herne Avenue we've dropped it all the way down to two stories. The building is designed now reflects the designer view board comments and some of their suggestions and so that really helped us sculpt the building in response to their comments. But we wanted to maintain this change in massing and change of form where to address the neighborhood. That's really the very brief presentation I had for this evening. Again, I'm happy to go into more detail if it's needed. Thank you. Thank you for those presentations. Next I'd like to go ahead and open the public hearing so we can hear from members of the public on this item so if you're interested in providing any public comments please press the raise hand button on zoom or star nine from your phone. Okay, so first we have Aaron Reimberg. Can you guys hear me okay. Yes. Thank you for taking my public comment today. I still have concerns about the president being sent the long term residents need to give up their property for this project to have a right away I understand that it's the applicants. It's a great job to speak with these residents and get their permission to do an easement but the fact that that's being recommended by the city and kind of setting the president that neighbors need to give up their land in order to put in a big huge development that's way out of place in this neighborhood is is still a great concern. And noted on the public record there. Another concerning feature about this is that Rosalind continues to be inundated with these housing projects. It was surprising to the developer actually my husband had got to have a conversation with the developer a very nice cordial conversation that was eye opening for both parties. And what was revealed in there is that this developer has no idea that there are four to five other projects of equal size and mass planned within a two mile radius of this area, meaning that our public open spaces are open fields are agricultural traditions are being threatened by this over development of continuing to classify Rosalind as a primary development area. So I really would like the city to be more transparent with that with applicants. It's not just their project that's being put through its multiple projects being dumped in Rosalind and taking away our open spaces and our, our land. It's scary for water rights, it's scary for fires, it's scary for traffic. I'm worried about current and future residents and whether they'll be able to evacuate safety safely if there is a fire, let alone the environmental impacts of all of this development, especially in this area. So, having that conversation with the developer just highlights all the more how the city is really covering up. So I think the first development is going in and kind of using that as a way to say oh no this is just one project and really play on the heartstrings of everybody here. Another thing that was eye opening with that was the traffic study comes into play then with four or five potential developments going in in a two mile radius. The traffic study is in an adequate. You can see a ton of congestion on her and it's already a dangerous street and Old City and Point Road has a ton of traffic overflow from the current apartment complex just north of this proposed site. So I just asked for more transparency from the city. Take a big picture look at all the development going on in Roseland so that everything's done fairly and that we're not just inundating Roseland, especially this quadrant with housing projects for the sake of approving things as Roseland's development area. Thank you for your time tonight. Thank you, Aaron for your comments. Next we have Larry McCauley. Mr. McCauley, can you see the timer. Yeah, can you hear me alright. Hello, we hear you. Yeah, so I wanted to echo a couple of things that Aaron had said definitely traffic is terrible on her and Avenue and the impact reports that have been done I don't think clearly. I haven't taken a consideration all of the different projects that are being put in I happened to live on her and Avenue and I can tell you now that that there's quite a few people that walk in the street. Right where this project is going in, even though we have a sidewalk across the street, and the concept of putting a sign in at a driveway where cars are going through that that's going to keep people from walking is laughable. I don't, I don't think I've ever seen a sign stop somebody from walking or having to turn around and walk another 100 yards out of their way. So, another thing that comes to mind is I didn't hear anybody mentioned visitor parking, we have 142 units and 185 spaces, and it's not unreasonable to think that out of 142 units there's going to be an average of one and a half cars per unit. You know so that equals 213 cars. Now there's no room for any overflow parking as there is now an extra 28 spaces. And then visitors, a five to 10% of visitors stopping by. So where is this overflow going to go they're going to go down arrowhead and then be parking 30 cars in front of the residents there. So that's something that hasn't been considered and nobody's mentioned at all the. Let's see also, last two weeks ago when we had the meeting and I was there. My wife brought the mail in to me and right there we had from the water district telling me I need to cut back 20% on my water as a reasonable measure as a resident here and then we're talking about putting 280 people right across the street and that makes me wonder am I cutting back 20% so that they can have water for this development here. It doesn't make a lot of sense to me there. Additionally, one of the things that occurs to me to is that preserving the Oak Grove comes at a cost for all of the neighbors here of obscuring their view their skyline view lines with this two, three and four, a story construction going on. I think I can't recommend that this project even go forward and I want that to be considered the impact that it'll make on all of the pedestrians that are going there unsafe, we already have conditions on her and Avenue where people exceed the speed limit on a regular basis and it's unsafe for people pedestrians there. So, I don't have any other comments thank you for your time. Thank you Larry for your comments. And next I see Lorna McBain. Hi, thank you. I want to echo the previous public comments. I am a long term resident of Roseland and I'm seeing as the other two public speakers have noted that our land is being absorbed by projects that are not fitting of a rural area. My major concern at this point. I have been hearing a lot of sirens. We are in a drought situation and fire hazards are extremely common in Santa Rosa. I want to know what kind of hazard mitigation report has been done to evacuate approximately 2000 more people in a very small. I think about two square miles. It doesn't make sense to me that there is only one egress and one ingress on one project we've already been exposed to. And this is a sizable project where you're expecting people if there's a fire to egress on only two streets, Herne and Old Stony Point Road. If anybody has gone in this area during the first fire evacuation, you will note that it was bumper to bumper. It was very scary for a lot of these residents. If the city does not look at the fact that this could impact people's lives. Certainly property without a proper hazard mitigation report and traffic study about how to flow people out safely. Then it's on the city if there's loss of life and property. It's very disconcerting to me as a resident here. So I don't know if anybody has looked at that. As a developer I would be very concerned that my project could potentially interfere with somebody's safety. So I want to know what kind of traffic study was done to incorporate any kind of evacuation issues. The previous person said that's not just one project in this area. There's four or five. That is a lot of people and a lot of cars. I hear that some of the developers believe that not everybody has a car or that there's less than two cars when in fact the Sonoma County standard for cars is 2.4 per household. There's really no place to have overflow parking that needs to be considered. There's nowhere to park on Stony Point or North Point Parkway. So please, as Miss Reinberg said, consider the holistic approach instead of one project singularly. Thank you. Thank you, Lorna, for your comments. Next I see Nick Reinberg. All right, can you hear me? Yes, I can. Well, you know, as stated by some of my predecessors who have spoken earlier. The big issue here I think is just the overdevelopment of Roseland here and the fact that we've got 150 unit one roughly here going in 50 units, going in two parcels north of it, plus another 80 unit give or take going in. Two miles away on Burbank Avenue. And further down you've also got development going on in Dutton Meadows. So you've got a high concentration and a high volume of people that are going to be moving into this area moving through this area. And I don't think that the traffic studies are going to adequately provide sufficient information for this massive influx of traffic that's going to be coming through here. Maybe really is poor planning by not having sufficient infrastructure here when planning they're just you guys are just going build build build without having any proper infrastructure. Additionally, I think that it's important that the block issue be addressed. I don't think that it's right that the city potentially has the potential to eminent domain of I discussed this with the developers earlier that they don't plan on having eminent domain and they plan on just having discussions with the residents that easements might need to be procured for a walkway of some kind. But, you know, really, the city should have had those kinds of plans in place well before the developer came along, and had to, you know, make these negotiations, in my opinion, further it's really just, I just really think it's just over development for over development sake, the design itself to is not conducive to this area. You know, it's a modern building in the middle of a rural area with no consideration for the meshing of the two aesthetically, and it's, and it is important to I think, consider having additional open spaces here in Roseland considering that we are deficient in parks per, we're deficient in the park per population ratio that is upheld elsewhere in the city. And we really, and really four stories is way too big for the location of this area when there are no other buildings anywhere near this size. So I really think that the city needs to roll back a little bit and think hard about this project and maybe redesign aspects of it both through infrastructure and the actual design of the property. Thank you. Thank you, Nick for your comments. I'm not seeing any additional hands raised. I'd like to just give one more opportunity if anyone is interested in making a public comment on this item please press the raise hand button or star nine from your phone. Okay, I see Elisa pastor. Hi. Sorry. So my name is Elisa pastor I am land use council for the applicant. So I actually like a chance to respond to some of the comments that were raised. I don't know if this is the appropriate time or if you want to have staff respond first and then I'll jump in for the applicant. I think we can have staff respond first and then after we close the public hearing and then you and the applicant team will have a chance to respond as well. Thank you. Thank you so much. I'm not seeing any additional hands raised so with that I am going to go ahead and close the public hearing portion and bring it back to staff to answer some questions and perhaps the applicant team might be able to speak to some as well. So I will direct it back to Mr Ross, the project plan to speak to some of the planning issues that were raised. Sure, give me. Thank you I'll be happy to respond to what I can and then anything that I miss please. You know remind me and I'll and I'll do my best to respond to those as well. I'm going to share my screen one more time just this site plan is so there's some form of reference. So give me one second. Thank you. So. Okay, so in response to just a few of these I'm going to go down the list. I did forget to mention that the condition of approval regarding the easement for access to provide the to provide the pedestrian access over in this her and Avenue exit area. There is a final one that that requires an in lieu fee in case these in case the neighbors are in the applicant team cannot come to an agreement on it. And then that would be held by the city until future development of the site would go in here obviously that you know there's no timeframe for when if and when that would ever happen. And as far as some of the other infrastructure responses is, you know, the the public improvements as new development comes in that's when the city can get the public improvements required for this area. There's also, as far as, you know, Rosalind goes it was it's a it's a pretty comprehensive specific plan, but at the same time there is a general plan update going on right now and that's a, you know, multi year process, I think three more years are left. And I, you know, I want to let any members of the public here know that there is an opportunity to participate in that if there is a, you know, some, some of the concerns for the density and zoning in the in the Rosalind area. Second, the traffic study does include multiple projects as does all of the traffic studies for other projects. So it's, it's, it does consider nearby developments, and that is reviewed and approved by the traffic engineering division. And planning, you know, reviews that and and in planning would kind of take the authority on that as a traffic engineering division. So if they have to review it and vet it and go through a process and it's not just submit and accept there is there there are there are requirements of that and it is it does have to be done by a professional traffic engineering firm. I do believe the the applicant team does have a traffic engineer in attendance here that could possibly add on to this. As far as parking goes, you know that that may be a management thing for visitors for visitor parking. There's only so much that the city can ask for for parking for affordable housing projects. There's also a shift in, you know, kind of an overall for for in in the city of Santa Rosa Sonoma County in general is to get out of single occupancy vehicles and in cases where parking is required takes up so much space when the potential future seen by the city doesn't really envision that I think that's that's more of a policy statement but it's it's kind of there's truth there. And for pedestrian access here, I mean, you can only mitigate or you can only kind of do so much to get people to to to deter people from doing something so you know that is recognized that signs and no pedestrian actual pedestrian gates would be included here if it comes to that where they couldn't provide pedestrian access here. And that's the fact of that's a that's a factor that that comes into play and that's not lost on on the city and that's why, you know, staff had many conversations with the applicant and this at least this property owner here on on the reasoning behind it and and what that looks like. But you know, and whenever visit parking public improvements. There is also a pending development report that's updated frequently by the city that includes all development throughout the city and you could break it down by quadrants and areas you could request that so, it is, it is pretty transparent on the city side of what's being proposed what's approved what's and what's being, you know, currently developed at the same time. And as far as water supply goes, you know, just a couple highlights is the city of Santa Rosa has actually seen its population double since 1990, while total water use has decreased by 14%. And, you know, new development is required to be extremely water efficient. And they have to comply with the city's efficient landscape ordinance and the Cal Green Building Code which requires new developments to be 20% more water efficient than existing developments. And a lot of times more often than not new development often exceeds that 20% target. And, and then, you know, all proposed development reflects general plan policies and zoning, and to change development pattern requires policy change. You know that's that's right now policy change would be the general plan update and you know policy change is not a function of current planning review at this time. And fire is joining is joining the meeting to or is in the meeting I should say to answer evacuation questions. And that is pretty much it from me if there's anything else that you need me to cover please let me know. So Adam I like to hear from fire about evacuation concerns and then there were a few points that you may be able to touch on the applicant might be able to as well so I'll turn it over to Ian. Thank you Amy. As far as our review of this development we we didn't see any evacuation issues I'm here to address any concerns the community or project may have. I'll tell you lessons that we've learned here in Santa Rosa since the tubs fire in, you know the value of early warning and getting people moving early on before, you know, imminent threats are within the vicinity and we have seven different methods of doing that now Nick soul so calm, you know, lots of different ways Noah radios that we've been handing out. There are ways to get people the needed information to get them moving long before a hazard. This property site or project site isn't in a wooey area nor would it ever be considered a wooey area so the threat of a large scale while that we experienced in the wooey areas of Santa Rosa between Santa Rosa and Napa counties is not likely incident here, you know, but that doesn't mean there aren't other emergencies such as earthquakes because I don't see floods being an issue here but earthquakes. Again, we have the ability to provide as early warning as possible you've got multiple major thoroughfares out of here yes her and can be congested during certain times of the of the day. I don't know what the link can to, but those periods of time are manageable from an emergency response standpoint, because during an emergency what we're able to do is take control of traffic flows and redirect traffic out of the area, and get in and get those that need to get out out. And that's just a quick overview of the philosophy and the mechanisms in the process that law and fire have to facilitate emergency evacuations. And again, that's usually not a that's not an enforceable condition that we can put on from a building and fire standpoint because we regulate building standards. Evacuation planning is something we've done successfully with other projects in Santa Rosa up in the wooey and that's a project driven and designed emergency evacuation plan. It's not something the city provides we provide, you know, most likely evacuation routes, you know, in and out of the city, but we don't plan to pick you up in a city bus and move you out. So within a project management team puts together their plan. It's their people. It's their community their buildings their structures, you know that they have to take responsibility, and the city will partner with those projects that do so, and providing the needed information to put those plans together and working with them to put together the best plan moving forward. And I'll just open it up for questions and see where those take us. Awesome. Thank you so much. You're very welcome if there's anything else please let me know I'm here. Great, thank you. Do we have either city staff or the traffic consultant, who might be able to respond to the traffic study and some of the concerns raised regarding what was studied and generally new projects in the area. Yeah, there is. The applicant team does have their traffic engineering consultant here. Good afternoon, Miss Nicholson this is Zach Matwee from W trans in Santa Rosa we completed the traffic impact study for the report. I guess I'll touch on a couple of components. One is that from the sequel perspective and the supplemental ER that was completed. VMT is really the key component now level of service and traffic congestion is no longer considered in on the environmental side. And from the VMT side, the project performs well and and actually screens out because it's considered in a low VMT area and is affordable. So that said, traffic is still considered the city center as it does have level of service standards congestion standards safety standards still have to look at pedestrian bicycle circulation and the like. So the traffic impact study does still do that it's just handled outside of sequel. So the traffic analysis looked at what the impact of the project is when added to existing conditions as one scenario. Then it also looks at the impact of the project in combination with other approved projects in the area and those are pulled from as Adam mentioned the pending development report the city of Santa Rosa makes available. So in this case that was 10 different developments in the area that were included in that scenario and looking at okay, when we have those projects in addition to this project what is the traffic situation. And then ultimately, you know, working back the area is within the Roseland Sebastopol Road specific plan. And so that EIR and project included a fairly exhaustive traffic analysis which looks at build out of the entire Roseland Sebastopol Road specific plan itself, and in a long range condition, you say your 2040 in combination with other cumulative growth happening through the city. And so that also looks at what is the traffic situation there. So for each of these scenarios particularly for that long range scenario the city of Santa Rosa has identified infrastructure improvements that do need to happen, and that will happen over the coming years. These are getting programmed into the city's capital improvement program and the like in the area closest to this project eventually there will be an extension of North County Parkway which comes in real lines with Turn Avenue that will help to reduce traffic volumes on this section of Turn Avenue as well as just better serve that part of Santa Rosa as it develops. There is a fair amount of development envisioned in that specific plan that will occur over time. But there's also a lot of infrastructure improvements to accommodate it. So specifically with this project, its own impacts with respect to traffic level of service were analyzed consistent with the guidelines and procedures set forth by city of Santa Rosa traffic division. And there were generally there were no impacts from a traffic analysis perspective, level of service perspective that are attributable specifically to this project there are some cumulative impacts and that specifically comes out at the intersection of Turn Avenue and Burbank Avenue where is there is a need for a traffic signal that was identified in a Rosalind specific plan. And this project is having to contribute towards the cost of that improvement, as well as traffic impact fees in general so that's sort of a broad brushed overview of the near term mid term long term BMT and impacts and I'm able to address any more specific questions if you have them. Great. Thank you so much Zach. That was very thorough and helpful and I appreciate your response. I don't have any follow up questions at this time. Looks like Lorna's hand is raised I'm seeing some hands come up but we did already close the public comment a little bit. I don't know if this is a particular question, but I'm going to go ahead and let the rest of city staff and the applicant team respond to the questions that have already been raised at this time. Let's see here. Is the project engineer able to just provide a little bit of follow up on the, the right away dedication and the question about the city potentially asking for property owners to dedicate their property I know that was touched on I didn't have anything else to add. Jesus. I'm sorry I had to find the unmute button there. This is the cake staff engineer. I don't have anything further to add at this moment. Okay. Great and then I believe the Mr Ross I'm not sure if you spoke to height and the concern about hi I know you did in your presentation. I'm talking about the density bonus and also the city zoning which does permit. I believe it's 45 feet in height. By right that's allowed by the development standards. The city has requested a concession through their, their density bonus, which would allow for them to have the increased height that is proposed currently. There was also a comment made about the project design being perhaps incompatible with the neighbor, the neighborhood I'm not sure if the architect might wish to respond to that. I don't know if staff would like to respond to that comment. So, I can add a little bit but first I think the applicant team wants to has a has a few to respond to. And then if it's missed in that I'll I'll I'll jump in and add some more. If that's okay with you. Thanks. My name is Lisa pastor. I'm legal counsel for the applicant and, you know, thank you. The city staff and the technical consultants have been a really good job of responding to the technical questions. So I really appreciate that. With regards to, you know, I think it's important to remember right that the Roseland specific plan allows the proposed development here and we are only asking for an additional 10 units than the density that was already approved by the city in the plan and analyzed in the EIR for the Roseland specific plan. So, I understand that there may be some concern about the level of development but what this project is actually asking for. And what the city really has a mandatory duty under the density bonus law is to allow the additional 10 units and the five foot in height. So, I'm hearing a lot of concerns that I think maybe unfairly are being placed on this project and and I think staff has really done a good job of also highlighting this and you know making sure that that they're, they're fulfilling their duties under the state density bonus law with regards to compatibility so with regards to the height so there is a 45 foot height limit that's already permitted by the plan. Under the state density bonus law we're entitled to actually a much taller building and we're only asking for an additional five feet because we needed to have some of the mechanical equipment and some other things. We, we don't believe that it is incompatible again 45 foot is the allowed standard and so I think just by the city's own codes and plans that is already compatible. That is already what is allowed that is already what is planned for in this development. We have set back the building quite a bit into the site and so one of the things that we did talk about and you could have the architect talk a little bit more but you know we only needed like a quite small setback I think it was only a 10 setback and we've set the building back quite a bit more and we have it stepped down because we understand that there is some concern about the height. With regards to the parking that is also something that is mandated by state law that has extensive experience in terms of the amount of parking that actually happens in their development and on a pretty consistent basis. We have fewer cars that are required are sorry few. We don't use all of the parking, essentially, and so there will be spaces for gas and we don't think about it. I believe I addressed the last two points. Ms. Nicholson, please let me know if there's anything else that I can assist with. I appreciate your time. Thank you so much. I think that that is that is a great response to those last two comments that I raised. Adam, did you have anything to add. Yeah, as far as neighborhood compatibility goes. As part of the resilient city development measures, why this project is a special VA meeting, it has to go to concept designer view with the designer view board which I mentioned previously. At that time, the designer view board reviews the project and makes recommendations and considerations for the project moving forward. And then that is those comments are implemented and required for, you know, the city basically makes or the city essentially makes applicant teams respond to those to those comments and considerations whether they adopted the comment or consideration or an explanation as to why they couldn't or, you know, the design difference here. As part of the resolution for the design review permit, not the, the, which is the second resolution tonight. There are bullet points of those comments from the designer view board. And one of them says, depart from neighbor neighboring architecture, create more urban architecture, possibly shed roof styles avoiding 1980s and 1990s design. Next, you have consider avoiding half hazard shed roofs, pick up kick ups in contemplating a more urban architectural design. So those are, those are considerations provided by the designer view board themselves. And I think, you know, just just to reiterate that those are for neighborhood compatibility, those are things that the designer view board asset the applicant consider as well. And so that's why, you know, some of the comments that it's a, it's a rural, and this is more contemporary modern contemporary style. Those are those were considerations that the applicant took in from direction from the designer report. Thank you, Adam that's helpful to understand the process and the feedback from the designer view board and how it was incorporated into the design. There is a just a quick follow up point regarding the configuration of the North Point Parkway. I saw that as a question that was raised and the North Point Parkway and Jesus may be able to speak to this more or. I'm at least on the call as well but I'm the North Point Parkway configuration is shown in the Roseland areas Vestple Road specific plan. It's also shown in the general plan. And this was a design that was studied as part of the traffic analysis for that specific plan and I believe W trans was involved in the traffic analysis done for that specific plan so there there was at one point in application in to reconfigure the North Point Parkway, but I, the application is no longer in process with the city and so the preferred and planned configuration of the North Point Parkway is in the Roseland area specific plan at this time. So that's just a point of clarification there. Okay, so I really appreciate everyone's responses and going through these various items as soon as did you want to add anything. That was something that the alignment of North North Park Parkway, as shown in that in the plan that you refer to was looked at versus this project and it doesn't conflict. And based on there not being any proposed change to that there isn't any impact to this project. I do want to go ahead and move on to some of the questions that I have. One relates to a public comment that I received by way of phone and I didn't hear the speaker on today's call but she lives on the property directly east of the site and I wanted to acknowledge that I had a phone with her. And she was concerned about noise and light from the parking lot, specifically on the Herna Avenue driveway. So I see on the plans that there's a proposed six foot solid wood fence. I'm wondering if someone from the applicant team or perhaps Adam can speak to maybe the potential to have something that might help to buffer any light trespass or sound, whether it be a slight increase in height or perhaps landscaping or something that might help to alleviate the easterly neighbors concerns. So I can speak while maybe the applicant team will need to consider it, but there is some landscaping there. I think, you know, there is some to be considered a site distance obviously but there's I think there's some pretty easy conditions that could potentially be added such as a double sided wood fence that that helps maybe some more landscaping or potential for a sound wall in that location. I wanted to let the, you know, let the applicant team respond with maybe they have another suggestion or, or something like that. From a security standpoint, I believe we will have CCTV cameras on the end of that building on the Eastern end. So if there were any intruders, which very low likelihood we should be able to identify them via video. I guess I have some concerns about the sound wall just, I just know how costly those can get very quickly and I don't want to push this into infeasibility. I do think as Adam mentioned we have, we have landscaping in the area. Again, that'll get more mature over time and, and hopefully buffer some sound and then to address a security concern, those cameras will be in place on that end of that building. You know, I don't know if our architect has any additional thoughts there. Sure. Thanks. Thanks, Taylor. You know the, we do have the tree buffer all the way around the property line in the, in the landscaped area. And so as those trees grow and mature, that's going to give the best visual buffer of anything you'd never want to fence or a wall that tall. So that's really going to soften those edges in conjunction with keeping the outgrowth and then there's a couple other large trees that we're, we're keeping on the perimeter towards the west end as well so I think we've, we've, we've got, you know, significant increase in that vegetative layer that's going to grow and really create that, that soften buffer over time. In response to the, you know, potential likely the project does have to comply with the city's light ordinance. All lighting shall be down lit. There's a 16 foot light pole maximum. Lower is encouraged. They do have to provide lighting for safety as far as the parking lot goes that at night. I believe it is one candle foot. Lumin here that that's that's identified in the in the during the building permit phase, as far as you know that if there is additional as to what would be what's included on the designer view. I think, you know, maybe some, maybe some talk on the a double wood wall where it's just a little bit thicker and then maybe a two foot trellis with some vines there or because I heard the applicant speak on, you know, the west side a little bit more of the oak side but I think the concern was on the east side of the right next where the Herne Avenue entrance and exit or ingress and egress location would be. So I think I think that that would be something that sounds maybe a little bit more amenable by by the applicant team and maybe conditioned as part of the product of the designer view resolution. That way it's not cost prohibitive prohibitive and you know and then it's only a certain portion of the east side along the the neighboring residents location I think that you know that's something that that maybe I'll let the applicant team respond to one one more time but and then I guess go from there. Yeah, I just want to make sure I understand the the suggestion so I'm not following the two foot trellis element if you could explain that a little bit further. Yeah, so you have a six foot good neighbor fence which is a you know would a wood fence and just proposing that it's kind of like the double sided sorry and not trellis lattice. I apologize for that. And it's just you know two additional feet of lattice that is a little bit more. It's not completely solid but you can potentially grow some some vine. Some some vines on it that that maybe that maybe be a little bit more sound protective. I'm sorry, sound buffering. Lori concerns about the structural integrity of a lattice like that being adhered woodwall. I think before we don't really need to get all into the detail here. We could also just add a condition that the landscaping and fencing should be designed to provide an adequate buffer for the site for the property to the east, and then that can be verified as a part of the building permit plan check just so that you can see what's what's feasible, and then Adam can can review it as a part of his planning review. I think that sounds reasonable. Okay. So Adam if you could add that condition to the design review resolution. That would be great. And then I, I don't believe I have any additional questions. I appreciate all the responses that people gave in the public comments that we heard today. So I, you know, recognize that this is part of the Roseland area, which is a priority development area for the city and that's based on the proximity of high frequency transit so there are some more dense residential areas that are planned and allowed within this area so it is an area that is certainly changing and as Adam suggested earlier we are updating our general plan general plans and specific plans are where we set the land use designations and residential densities and building intensities for parcels within the city so I really encourage everyone to be involved in that process, because that's what dictates what type of development can later be approved on properties within the city. I do appreciate that the applicant team considered and integrated a lot of the design review board's comments. I appreciate that the, a lot of the oak trees will be preserved on site I think that that provides a nice, a nice buffer. And also, I appreciate the two and three story elements of the building which help with the overall massing of the project. I appreciate that it's 100% affordable as well. And also the location of the trash, I think is in a good spot that won't really impact a budding neighbors so I feel that a lot of thought went into the project design. And because this item has two resolutions I just want to acknowledge that I will be approving the resolution for the environmental impact report addendum. This is an addendum to the Roslyn area's best forward specific plan EIR and it really just qualifies and quantifies that the addition of the 10 units is allowed by the state density bonus. So I'll go ahead and sign that resolution and then after Adam adds the condition regarding the fencing and landscaping for the eastern property line I will sign the design review board resolution. Thank you all for attending this evening and I'm going to go ahead and close that item and adjourn tonight's meeting.


All right. How's everybody doing today? It's great to be here. Thank you. Well, I developed this presentation and I hope that you all find the various tools on here interesting and most of all fun and useful as useful as I have over the years. See how to try that there. All right. There we go. Anybody know what that's a picture of on the screen? Just raise hands. Just kind of curious. One person. All right. And the audio did not work. Try that one more time. Otherwise. That's what solitaire sounds like when you play it through a sound file. We'll get back to that. All right. So what can us defenders do? You know, sometimes you've been, I'm sure all of you have had malware attack your system before. It does stuff. It drops files. It changes register keys. Things like that. You want to know what happened. Another useful topic we'll talk about today is a file content type identification. Just because a file has an extension, that doesn't mean that's what it is. But we'll look a little deeper than just looking at the magic numbers and so forth. A little bit of steg analysis. A little bit of reversing or encryption. And I don't know. There's just lots of uses for these various tools. There's some stego tools. These are all on the CD. I checked this morning. And then there's a couple of the analysis tools you'll get to see. Attackers have lots of tools, right? Packers, base encoders, cryptors, compressors, wrappers. Oh, I wrote that one.  And various stego tools. There's a lot of stego tools out there. Defenders, of course, hex editors and strings. Y'all know what that is. Footprint. That's one of my tools I wrote that helps identify what malware did to your system. It takes a snapshot of files, registry keys, processes and services. And then you can take a later snapshot and compare them. It does that. WriteBibMat Histogram, which is a terrible title but I can't think of anything else to call it. Takes an image of a file and also takes some basic statistics. You can learn a lot from just a few basic statistics. And then the statistical analyzer kind of combines the two and automates them. And I don't have much time to talk about that one. But it's there and if you want more information, my contact information is at the end of the presentation. A little bit about me. Instead of counting sheep, I counted in powers of two. I learned how to program at 14. I did have a couple of Atari games published. You haven't heard of them. It wasn't Pac-Man or anything. I joined the Air Force, got my degrees. And now I'm an engineer at Harris and a part-time instructor at UTSA. All right, wrappers is just a small utility. Basically it will take any file you want and wrap it up into a bitmap header or a way file header, various types. It's got a few options there. And so it's very simple. It's good for demos. Here's a Stag LSB tool. This one hides in the least significant bit, which is common. This one has five bits hidden. So at first glance, if you didn't see the original, you might not notice. But the original, of course, looks a little better. But you think about that. Five out of eight bits. That's a lot of data. This one hides in JPEGs. That's also on the CD. That's my dog. He texted me last night. He's lonely. You can't see anything, though. You can't see any artifacts between the original and that one. So you've got that tool on your CD as well. We'll show you how you can detect that, though. Malware effects, as I mentioned, does lots of different things to your system. Also, sometimes you install these programs, trial programs, or maybe programs you don't want anymore and you uninstall them. Did the uninstall, get rid of all the register keys? Did it get rid of all the files? Print can help you find out. So it takes a snapshot of the system, stores in a big log file. It can save it by size as well. And date, the date part isn't working yet. I've got to get that one done. But if anybody wants to upgrade a version with date, you can email me. But that's good for finding files that were just recently installed. Often malware will drop a bunch of files maybe in different places, but they all have the same date. So this can identify stuff that's just been dropped on the system. Or if you like getting videos that they don't let you download or pictures that you click on them and you can't save pictures as, go to your content folder and use this tool and it will find it. Regular Windows browsing and searching doesn't search the content folder. But if you get there and use this tool, well, you don't have to get there. You can run it from the C drive and it will find all those files and list them out. So then you can find that video and just simply copy it from that folder to one you want to use it for. Footprint can compare the two different files, okay, log files. Here's all the files, what has changed. Same thing with register keys, same things with processes and services. This is just a sample output. I'm going to go through real quick. Just how it shows you, you know, if a file was deleted or a file was added. It's a very textual type program. But, you know, here's where it shows what it looks like when a file is modified. And it just creates this big log file or small. There hasn't been many changes since the last footprint. All right. File type characteristics. Malware often disguises itself, may pack stuff in executables encrypted. This can help detect that. The right bitmap histogram tool will do a few things. It can create a bitmap image as you saw in the beginning. That was a bitmap image of Solitaire. One person recognized that probably as an executable. The chart on the right was a histogram. That's a typical histogram for a executable. And then before discussing the tools, you've got to do a little bit of math. So once we get through the math, there's a lot of slides. I meant to mention that there's a lot of slides in this presentation. So once we get through the math and you understand a little bit about the tools as it goes on and it's used as if we don't get finished, it will be easy for you to figure out on your own. All right. Who's heard of entropy before and knows what it is? It's curious. Okay. It looks like about half or so. All right. Very good. And what about a histogram? Do y'all know what a histogram is? Okay. About the same people. All right. Usually we consider of course bytes with computers, 0 to 255. So the maximum entropy is the log base 2 of the total number of symbols. So log base 2 of 256 different symbols is 8. So the maximum entropy for a file can be 8. If that file is base 32 encoded, maximum entropy is going to be 5. I don't have an example in the slides this time, but you can actually tell if the base 32 encoding has encoded an encrypted file or if it's encoded a text file just by using this tool. And well, of course, for a base 64, that's a little quiz. 2 to the 6 is 64. So who got a gold star? One person. All right. Very good, too. All right. A little bit of statistics here. So P is the probability. The log is often abbreviated LG to mean log base 2. And that's simply 2 to what power equals X. So log base 2 of 256 is 8. Log base 2 of 4 is 2. Log base 2 of 8 is 3. So on. We can estimate the probability in a file by counting. So you take a file, count how many 0 bytes, count how many 1 bytes, count how many 2 bytes, and so on. And that's the histogram. That's the count. The frequency distribution of each byte is another way of putting it. So giving that count and the total number of bytes, we can compute the probability for each byte. So we can say, you know, if 0 appeared 25 times out of 100, we can say the probability is 0.25. And then we can plug into this nice nifty formula here, okay, which looks complicated, but it's really just a for loop that's multiplying the probability times the log base 2 of the probability and adding it all up. You'll get a negative number out of that. I'll skip the log derivations for today. And you add it up and you get an entropy count. H. H is the entropy. So encrypted files have the greatest entropy. Compressed files are next and so on. Every file type generally has some characteristic range of entropy. 24 bit maps I found have been very varied. But executable files, text files, they're kind of in a range. Compressed and encrypted files are in a very narrow range. So you can identify a lot just by the entropy. So bottom line is the higher the entropy, the more uncertainty. That's what you want in an encrypted file, right? You don't want the opponent, the attacker, to figure out what you've encrypted. You don't want them to have any kind of information about what symbols are. Compressed removes pattern and once you remove pattern you get a randomized looking file. But it's not as random as an encrypted file. English text I found to be around 4.5, 4.6, 4.3. It's in a very narrow range. So you can identify that immediately. Now of course it does depend on having sufficient data. Very small files, the entropy counts are going to be skewed. I found that in practice around 4K is where it starts to get reasonably accurate. Of course the more you have, the more accurate it looks. So histogram, I've kind of talked about that already. Just on the chart, on the left side of the chart, that's going to be the zero count and on the right side of the chart is the 255 count. And the darker lines are at 16 value intervals. So at 16 the line is a little darker, at 32 the line is a little darker just to kind of break it up a little bit. Many file types I discovered have unique histogram characteristics. And so I've used that. You can identify them very quickly in many cases. All right, so of course here's how to identify file. You got this new file, what is it? Well, you look at the extension, but that doesn't mean anything, right? You look at the magic number, that may mean something, if it's not disguised as something. We can apply a visualization, that's what this tool does. It will also do the audioization, which is kind of a very strange word, but it's actually out there. And then statistics. So here's what you check on the file. You know, what's in it? Does it match this extension? Does it have unusual data? Does it have hidden data? Does it have appended data? Is part of it compressed? We can tell a lot. All right, that's just a command line for using the histogram tool. All the tools have usage functions, so I'm sure you can figure them out. And here's the text file. On the left is what it looks like. You can see it's very dark because text is all below 128. So it's all the darker shades of gray. On the right, you can see the histogram. What character is this, do you think? Space. That's right. Space is the most common character in text, followed by the E and the T. These are lower case, upper case is kind of hard to see in this one. There wasn't very many upper case. You got numbers. You can notice the pairing, character turn line feed. Those are all the same size there. So you can see that. This is the text output of the program. So that gives you like the exact numbers. So you can see the exact count. Sometimes it's useful because of course the visual one is scaled, right? So you can't necessarily see the difference between a few values on a large histogram. Here's HTML. So you see that has some textual characteristics, but it also has a lot of pairings. You know, HTML has all the tags with the braces and all so forth. And so you can see that here. C source code, Java code and stuff shows up the same way. You get lots of pairings. So you can distinguish between text and C++ and that type of thing to a certain degree. Here's a bit map. The one characteristic of a, this is a bit map of a bit map, by the way. It's not a, you know, it just kind of gets out of synchronization there. But you can see that it's smooth. That's the characteristic of a natural bit map. All of them are smooth. If they're not fairly smooth, then something's going on. Now 8-bit gray scale is very spiky. Just like that. As well as a 8-bit color bit map. You know, we don't know where the spikes are, which values are the most common, but they all look spiky. And of course, for some of you that know, a gray scale, 8-bit gray scale and 8-bit color is the same in terms of the file content. It's just a palette. That's different. Speech. All 8-bit wave files that are natural wave files will look like this. That's because waves oscillate about the central axis. So you get the most values in the middle. And as you go out towards the edges, you get fewer values. Music is a little fuller than speech. So you still get the central spike. 16-bit speech. It's a little tough to notice at first, but you get, where's my cursor?  It's kind of a very open U there, okay? Because there's very little in the upper extremities. These are the upper extremities, and there's very few samples up there. But when you get music like that, then you get a fuller U shape. If it doesn't have a U shape, it's not 16-bit audio. Okay, now you can take anything, right, just like I did with the Solitaire program and wrap it up in a wave file header, okay? And you will not get this histogram. It will not look like this. But natural audio will all have a U-type shape or a pointed shape if it's 8-bit. JPEG. This one has a lot of zeros. Okay, you see it's pretty uniform over here. See it's fairly flat over there. So that's characteristic of JPEG. Some of them are more spiky than others, but they all have a reasonably uniform distribution across the top. PE files typically have large numbers of zeros and large numbers of FF, and then various values here, okay? The thing about the PE file that's very characteristic is that it has different sections. So, you know, it looks like a text section, which is the actual code, and then various sections in here of different data types. They all have kind of a striped look. Encrypted, I use a program called AXCrypt, which is just available for free download. It's been out there a few years. And you can see this, you can't really tell the difference between the JPEG, but this you can, it's very, very flat. And that gets flatter as the file gets larger. All right, so file type identification. That's kind of the overview of some of the things that the tools that you would be looking for when you use them. So here's this one. Can you tell compressed or encrypted just by looking at the picture of the file? Not really. But from the histogram, and especially the entropy value, this is the entropy calculation over here. It's easy to tell. Entropy 7.99997 for the encrypted file. So unless the files are pretty small, you can use this to distinguish between compressed and encrypted. And even if they're fairly small, the entropy for the encrypted will go down, but the entropy for the compressed will go down further. Pact or not packed. So here's an executable. Does it have, is it packed? You can't tell by looking at a hex editor. But here it's looking pretty smooth to me. Still has a large number of zeros, which probably throws the entropy down a little, but this looks fairly uniform there. So I'm going to say that's more than likely packed. Unless it's just full of compressed data.  Pact or not packed. Quite a difference, right? Now this is throwing off a little bit because of the large number of zeros because all this has to be scaled. It's just as spiky. But you can see the different patterns going throughout there. I used this to examine a ROM one time. And there was one area that was just all white. And that was the area that was the RAM on the firmware. It was like a firmware download, whatever. And that was the RAM on the firmware where it's blank. Here's the zoomed in histogram with the zeros kind of going off the scale. And now you can see it looks kind of like an executable. However, you can see a little bit of uniformity down there kind of in the bottom. So I would say that maybe this has some packed data in it that the whole thing isn't packed up. All right. So histograms and entropy aren't always effective. This is the full color bitmap that you saw earlier in black and white. You see how it's fairly smooth. And let's see if we're hiding something. Data appended to the end of the file. Statistics don't really tell you a lot about it. However, if you look at the histogram, you can see that, right? That's kind of unusual for a 24-bit map to have these kind of spikes in there. And some of that just comes from experience. I've done this on hundreds and hundreds of bitmaps and looked at them over the years and preparing several other talks and so forth. Here is the bitmap shown the picture of it. And then you can see some data hiding at the end, okay? Because that's got a different characteristic there. So that can reveal something. Are we using steganography? LSB steganography hides in at least sniffing a bit. Very difficult to see if the number of bits is less than four. There's some cover images where you can see them, but others where you can't. And sometimes even at four bits, well, at four bits in a normal picture you can't even tell, okay? Five bits is when you can really start to tell. So what about with the histogram? Well, of course. Otherwise I wouldn't bring it up, right? All right. So here's honeybee, the original. You can see a fairly smooth histogram there, entropy 7.55. And then we go to one bit of randomized data. Tough to tell on that one, right? It's not that bad. That would not raise my alert flag there looking at that histogram. It's a little spiky, but not too much. Now we go to two bits. Three bits. Four bits. It's getting easy to tell. The picture, however, can you tell by the picture? I think on this particular image the background is a little blurred so you've got some smoothness. So you can actually tell on the picture a little bit. Go back to three and look at the green background and then go to four. And you can see little bits of discoloration there. But in the foreground where there's lots of detail, you don't really see that. However, the histogram is clear. This is not a histogram of a 24-bit bitmap. And neither is this one. And that one would raise my suspicion. So with two bits. Let's see five on here. It becomes obvious at that point, right? So you can even tell by the picture. Even those that didn't know what a honey bee looked like when I think of that. And then six bits. And then seven bits. Anyone want to guess what kind of data we're hiding? Obviously it's kind of randomized data, right? Because it's very flat over here. If we were hiding text data, we'd get kind of a text look to the histogram at this point. And then eight bits. Now you don't have a bitmap at all, right? How about JPEG? Does this work? Well, here's my favorite pet, Mandy. She actually looks kind of annoyed. I mean, like, why are you taking this picture? And that's the histogram of the JPEG. See, entropy is fairly high, but it's not like an encrypted file. Here's Mandy with 146,256 bytes of hidden data. And she still looks annoyed. But you can't really tell. I can't tell. I can't tell even if I flip between the two of those. The entropy is a bit higher though. 7.97. Okay, so that gets a little higher. But still, it might find JPEGs with that much entropy. Well, how about an image of the JPEG? That doesn't work. However, if we decompose the JPEG into its DCT coefficients and then take a histogram of that, which is where we're hiding, then it's quite obvious that on this side, it's very matching, which is normal for a JPEG. They don't match exactly. I know these look like they're exact, but if you look at the raw numbers, they're not exact, but they're generally close. This is going to be like a, let's see, plus one, two, three, four, five, six, seven. Or something. But generally, the plus coefficients on the lower values match the minus coefficients. So one and negative one, two and negative two and so forth. But when you start messing with those and hiding, they don't match anymore. Okay. And it's easy to figure out why because if you are hiding something in a negative one and you change the least significant bit, what does that number become? Nope. If you change the least significant bit, negative two, right. If you have a one and you change the least significant bit, it becomes a zero. So even if you change one and negative one evenly, they're off balance. So that one's a little bit, takes a little more work to hide. There are some Stego programs that try to balance those out. The one you have will produce a histogram like this. No, no, no. The tool that I provided on the DEF CON CD for hiding in JPEG will do the hiding that you've seen here. But it doesn't do anything to balance the DCT Instagrams. Okay. Well, we might actually have time for demos. I didn't think I'd get through it this fast because there's so many slides. People said you're not going to get through 75, 80 slides in 45 minutes. There's lots of pictures. Am I going too fast? Okay. Let me try some demos. So reversing XOR. I had to put more about this if I didn't know and I got through it quite this fast. Something XORed with itself is zero. So you've got to understand how XOR works. Something XORed with zero will be itself. I don't think I wrote it up here, but the reason XOR is so popular in cryptography is because when you XOR something with a key, you get ciphertext and then when you XOR that ciphertext with the same key, you get back the original. So XORing it twice retrieves the original. Now notice this. This is kind of an interesting property of XOR because a lot of malware will use XOR just a basic XOR encryption to kind of hide stuff. Something XORed with a space will just change the case of a letter. Okay. So if you have an uppercase letter and you XOR it with XOR you have a lower case letter. XORed with X20 becomes an uppercase letter. And of course that's typically the most common character in the English file, in English language. XORing with a single character doesn't even change the entropy. Like if you just use a one key XOR and XOR the whole thing with that same key and entropy stays the same. It just gets shifted a little bit. All right. So here is like a text file that's been XORed with some character. The same characteristic spikes kind of group together. You get a brighter visual because now all these values are upper side of the bit values instead of the lower side. But it still kind of looks like a permuted English text histogram. So that can be revealed. So this kind of looks like an executable. The image does. It looks like this is fairly uniform in here. So entropy 7.2 suggests some type of compression or encryption. Or maybe weak encryption. That's another thing I should point out. The encryption in order for it to have the 7.999 entropy has to be good encryption. If you use weak encryption then you get the same effect as if it were compressed. I discovered that once a client brought us some stuff and said, here tell us what you can tell about these network packets. One of the things I came back with I said, it looks like you're using some kind of weak encryption. He's like, how do you know? Like this. Oh, I should back up. So knowing that the first two bytes in an executable is mz and that zero is prevalent can also help you a little bit with that. Excuse me. So in the target file we found that two bytes were dnn. Looking at the textual histogram together so we can start guessing one of those might be a space, one of those might be an e, one of those might be a t. And I kind of just did some hand waving here because I didn't think I would even get to these slides. So there's a little bit more to it than that, but the point is that you can use the entropy and the histograms and the visual tool to help reverse X or encryption. Statistical analyzer. This one takes the footprint program and combines it with the histogram tool to automate the analysis. So you set it loose on a directory and it will iterate through all the subdirectories and it will run like 10 different statistics, not just entropy. It will create histograms, it will create bitmap images if you want, and then it will compare it to a baseline. So it's one of those kind of training type phase programs, compare it to a baseline and then it will pop out and spit out any anomalies you have. It's a JPEG, but it doesn't look like a JPEG. It has low entropy. Or this one says it's taxed, but it's got high entropy, that kind of thing. I have presented on that particular tool before, a few years ago, and so I didn't obviously include the whole presentation on that here, but if anybody's more interested, my contact information is at the end of the slide presentation. All right, I hope you learned something useful. Looks like we do have some time, so I can do a few more. There's my contact information and you can email me if you want. Here's some blogs at Harris that are relevant. This one's written by someone else, reversing XOR encryption, so if you're interested in that, there's go, and then this one is what I added to it. And then here's some irrelevant blogs at Harris that I wrote. That's actually a serious article. It's not, you know, anything, they wouldn't let me publish one, that was bad, right? All right, and I do want to thank Mr. Gregg Conti. He's presented a black hat before, and he kind of gave me the idea back in 2005 of the whole visualization concept, and that's where a lot of this stuff was born from. All right. Does anybody want to see some demos? All right. Let me find my screen again here. All right, so what do you want to see? Do you want to see like the Steg program? Do you want to see, what demos? Any preferences there? No, I know. Okay, there we go. Yeah, it's on the screen. All right. Let me find the, my favorites. All right, let's see what we have. My favorites are the Stego tools, really. I like to do those as well. All right, so I'll pull out the putt, and where's that? Stag JPEG, okay. All right. And then I just need a little media file here. Find some JPEGs here. I'll try to pull out some more of the interesting ones. Oh, yeah. This is one of my favorite JPEGs to hide in. I actually had heard on the news about this, I heard about this device sold by a particular company, which I will not mention, that was supposed to detect, like, porn on your computer or something. So I decided to see if I can move this one over there. It doesn't want to, okay. I got to figure out how to, I'm sorry. I apologize. Here's my mouse. Yeah, we can duplicate. Let's do that. That'll work better. Thank you. Appreciate it. Okay. I'm going to put my mouse on my laptop. And it divided the pictures into three categories, like suspicious, highly suspicious or not suspicious. This was the one that was the most highly suspicious. Now if I find that, that's not what I'm looking for. All right. Let me find my thing here. Okay, I need to get to this directory. Okay. Okay. So here is, let me change that prompt to you so it's nice and short. So here's the Stag JPEG one. Okay. Just show you that in action. And it has a number of different features to play with. I mean, it can just take randomized input and create it from a pseudo-random number generator. And so you can add that. There's several parameters here. Typically just keep A and U, like four to eight, and quality is pretty high. That'll get you the best file-hiding. And we're going to, let's see, we'll try to hide this one in there. 75K and 209K. All right. So we'll try to hide the flower in the baboon there. So do that. Tell it to dash hide. And then we need a cover file, which is the JPEG. Oh, and it'll take either bitmap or JPEG as a cover file. And then it will convert that to a JPEG cover. And then the message file is a flower. It may not fit, but we'll give it a try here. 100 quality. And I'll just go for the max. On what? The message file can be any arbitrary file, anything. It doesn't carry, it reads it as a stream of bits and hides it. For questions, please come to the microphone. Go ahead. I'm sorry. Yeah, the question was, what kind of files can you hide? No, it can hide any arbitrary file. And the Steg LSB program, that's the same way. It can hide any arbitrary file. You have to give it the dash LSB option, which is in the usage. Because it has a special demo mode. All right. So here's what it said. It said our storage capacity was about 146,000 bytes. The message size was 75,966. So we can look at the resulting file here. Anything? Isn't that a pretty baboon? I took that picture in Africa. So you can't see anything. Of course, no steganography is complete without extraction, right? Because you can always say, yeah, it's hidden in there. So let's see what we can do with that. So we got a stego file. That's going to be the hid file. It should pick up the quality, but these parameters, the dash A and B, you have to match. And then let's see. Oh, and I need to tell it to extract. The command line is very archaic. This would be much better with a GUI. So if anybody likes developing Windows GUIs and they want to develop one, great. Send it to me. I appreciate it. Okay. So that's a good sign, right? I found the same message size. Okay. And let's see. Where is it? That it extracted that to this. What about the file name? Well, I have to put in, in addition to the file data, I put in the size and I went ahead and stored a null-terminated file name. So the first four bytes of the size, then the null-terminated file name, and then the rest of the data. And I'm just going to add a .jpeg extension onto the end of this one. And you'll be able to see. I do. And there's the flower picture. You know what? I should have shown you all, like, yeah, it works. I could have extracted anything. All right. Now let's do the WBH thing here. There's WBH, right? And then this one is a simple command line tool also. So we'll put the .jpeg file there. And the dash B option creates the image of it. So there it is. By the way, this bit entropy, I tried this once. It doesn't tell anything. Yes. It's exactly the same byte for byte. Exactly the same. Yep. Oh, thank you. The question was, does the recovered file have the exact checksum as the original? And the answer is yes, because the original file is stored in there exactly byte for byte. There's no loss. But we see 7.97 with the hidden data. So we've taken compressed data and hidden it in another compressed file. We can look at the textual histogram, just for grins there. So you can kind of scroll down and you can see the exact counts and the exact distribution and so forth of that. And then the where is it? The histogram, the bitmap diagram. It's very uniform here except for a lot of zeros. We can use the tool to get a closer look at this. I'll use what's called the zoom feature and I'll run the same thing again. This time I'll use dash Z and 5. Okay. And now we have one. Let me stretch this out a little bit. With a Z5, that's what that is. I over zoomed a little bit. Let's try 3. So very easily I can do 3. And then go to the zoom 3. And now you can kind of get a closer look at that area. In fact, that would be a good one to use on an executable, right? Because it's not quite as uniform. So we could do WBH of itself. All right. And then take a look at that one. And here's the gram of WBH at zoom 1. So 0 and 255 kind of mask out some of those. So we could use the zoom feature. And dash Z and 3. And now you can see that a little closer. The image. Where did we put that one? That one was the this one here. That's the image of the JPEG with the hidden data. Anything from that? It is with the bitmap. Where you see the file or behind it or whatever. I have time. We have the technology. So these two folders here, by the way, are on your disk. So there's some tools that I just included that you can also download for free just like I did. So here's the Steg LSB one. So we'll take that back over to the demo area here. Let me clear out some of these other things. Just to make room. Okay. So now I have Steg LSB in there. Now all I need are some bitmaps. So let me grab some of those. Okay. Oh, there we go. Now the only thing is for this picture in picture Steg enography, it's really not useful. It's just for playing with. Right? Because everything has to be the exact same size so that I'm going to take the upper four bits of one picture and stuff it in the bottom four bits of the other picture. So let's see here. We have that one is 36, 1711. I don't know. Let's see. I have to find the right media file. 768 by 512. I may not have the right size there. These are all different sizes apparently. Hmm. Well, I might have to just do LSB on that one for now. I'll show you how to do it but it's going to come back and tell me that the files aren't the right matching size. I'm just trying to think where I know I have files on here somewhere that can try on my backup disc here. Yeah, I could do that. But it has to match. I have to match exactly. So I'm sure that I have one nope, maybe not. I really didn't expect to get done as fast as I did but I appreciate your patience with this. I went to the wrong. That's going to be the same thing as what I have here. Well, let me just show since we've just got a couple minutes. Let me just show the files and then we can meet later on. You had a question? Well, if it was unmasked with it wouldn't have anything hidden. Okay. No, the question is if I do a transcoding like when you post stuff to Facebook and Flick or a lot of times they'll change it for you and change the quality or whatever or shrink it. You can't recover your data but can you tell something was hidden? No, because all the coefficients get all scrambled up again and made of new. Okay. You have a question? I have. Sure. What's your question? In your example you used two images that had no relationship to each other. Let's say that we're talking about somebody who is a journalist in a conflict area and they have a picture that is like the street in the street after. So there's a lot of overlaps. Is it possible to use typography to essentially reuse the cover image as part of the stenography? So you just kind of encode the deltas and essentially take advantage of the original image where there are exact or close to similarities. You can certainly encode a delta. There might not be any reason to. When you take two different pictures the way the camera is going to encode it, the way the light hits, everything is going to change. You're going to have very high probability of having very likely completely different images. Mathematically you're going to have very different images anyway. So you can hide both of those in two different images in the same image and you can't really tell that they're related in any way. So you can take advantage of any common runs. In a JPEG there won't be much common. In a bitmap if they were both recorded as bitmaps like 24 bitmap then you would probably be able to find some commonality. But I did not cover in this presentation the math behind the JPEG but it's easy once you know how to use it. There's a lot of different lines and stuff and it gets to be very complex. And so everything is interdependent. You have basically an 8 by 8 matrix and you run it all through a bunch of math at different frequencies. It's kind of like a frequency correlation of your image. And so you just change one little value in there and it's all interdependent. It goes this way and this way and all that. So it gets to be completely different when you have JPEG. Bitmap, yeah there could be a lot of things. Yes, well we're out of time for today and I don't have that tool on the disk. It's a little bit more complex to use. You have to take a baseline first and stuff. But if you email me I'll see about how I can get it to you or whatever. I don't have a problem with giving it out. It's just fairly complex to use. Yeah. Oh sure, do that. It's fairly easy. And you do have time for one more question. Okay. You mentioned wanting a GUI. Is this open source? You have on the disk some of the source code. I honestly don't remember exactly which source code I put on there. I know I put the wrapper source code and the WBH that are all written by me. But if the source code is not there to some of these programs and you want it I'll give it to you. Just email me. Yeah. I appreciate it.


Why did you get the BBC invasions in your house, though? Yeah, so they... Do you regret that? I don't regret it because I destroyed them so badly. But I wasn't... I was certainly suspicious of them. And I knew they were going to try something, but they lied to me. But I didn't never... I would never say I trusted them, but they lied to me. They told me they were going to come and ask me questions about my mental health, and they sat me down and attacked me in an attempt to slander my name with a big setup. And they wanted to talk to me for two hours and find three minutes of me making a mistake or starting or not being able to answer a question and use it against me to slander my name like they've always been doing. But I made a complete fool of them. And that scares me also because that's their primary weapon, is the media. And if you continue to destroy the media, they're going to find other weapons, which is scary to me. Now they've moved on to the judicial system. We'll see what happens after that. But I let them in, not because I trusted them, but I thought, you know what? After all these months in jail, and the fact they're asking me questions about my mental health, and this is my first time talking to the Matrix in a very long time, this might be an interesting conversation, and I was wrong. So instead I had to teach them all a lesson. I made fools of them. I made fools of them. Like I made absolute clowns of them. They should have just asked me interesting questions.