I dream of going and removing the nail, I dream of going and removing the nail, I dream of going and They came to that door to demand his bear, they came to that door to demand his bear, But left taking something just as dear to her, He's reminded who the inhabitants were, He's reminded who the inhabitants were, The shining queen of the pure elon base veil, I dream of going and removing the nail, I dream of going and removing the, Mashallah, I dream of going and removing the nail, Below a mother's feet truly lays Jannah, Below a mother's feet truly lays Jannah, Imagine the treasures beneath Zahra's feet, Still this young woman they did viciously beat, Still this young woman they did viciously beat, They dared to approach her door with no avail, I dream of going and removing the, Louder I dream of the nail, I dream of going and removing the, Faster I dream of going and removing the, From one side they pushed but she also now pushed, To protect her aim and was her only aim, From one side they pushed but she also now pushed, To protect her aim and was her only aim, Did they think of their actions as just a game, Did they think of their actions as just a game, To understand her purity they did fail, I dream of going and removing the, I dream of going welcome and aid me she screamed, One by one they slapped her as they pushed past, With the devil's face these enemies were massed, With the devil's face these enemies were massed, The womb which carried more sin they did impale, I dream of going and removing the, I dream of going the nail, I dream of going and, Greed jealousy and power had corrupted, A pool of blood now lay beneath our temer, Greed jealousy and power had corrupted, A pool of blood now lay beneath our temer, Murdered by those who gathered at certifier, Murdered by those who gathered at certifier, This event on art songs will always remain, I dream of going and removing the, Of going and removing the,


Thanks. Great. You'll see the mystery about that volume adjustment in a minute. So how many of you took family histories on November 24th Thanksgiving Day, a.k.a. Family History Day? One. That's what I thought. So I've been asked by the committee to talk about family history implementation program I think maybe for obvious reasons. It's not done seldomly. It's not done often and it's often not done well. So to quote a famous leader of ours, Charis-Ang, it's the best kept secret in healthcare, family history. By the way, I presented some of this in June at the June meeting and I was out of the room when this agenda item was put on the list so I assumed there was a method to the organizing committee's strategy here to have me come back and I'll talk about a somewhat expanded view of this project. I think everybody in the room understands the obvious opportunity in capturing good family history information and using it effectively in clinical medicine. We've been working on a project that we call the Geno-Medical Connection. Since about 2004, actually this project was conceived around 2000 or so and it took several years to convince the Department of Defense to fund it and this was obviously before we had fancy machines to jude genome sequencing and limited genotyping. So family history has been one of the projects that our group has been focused on for quite some time. I show this slide mainly to illustrate the fact that we can get a lot more done in terms of implementing genetics, genomics and things like family history outside of the university affiliated practices and this is Central North Carolina, Greensboro, somewhat known for the furniture business and near high point and so on has been where we've been working with the Cone Health System on a family history project and we've been working with other non-university affiliated practices in implementation and dissemination of genomic related strategies. So this takes place in Guilford County, it's about 40 miles west of Duke University. Our goal has been to recruit individuals from well visits, from two high volume primary care practices with a goal of enrolling 1500 patients in this family history study with a focus on education, integration to practice and outcomes measures. I think it's clear that family history has got a number of, to take an accurate family history has got a number of significant impediments to it in the context of a very brief primary care visit. Oftentimes the patients are not coming with the right information in hand. Even if they have the information, the clinicians are often confused about what that information really means and how to synthesize it into some recommendations and that has been discussed by several of you already. How this data gets into health records is a little bit obscure and also how to mobilize a family history driven health plan is equally challenging and our premise has been that if we can use electronic media, internet based tool to have patients prepare their family history information pre-visit and have this synthesized and integrated into a clinical decision support tool that enables the physician-patient interaction at the visit to really be focused on what needs to be done whether it's nothing, genetic counseling or genetic testing might be a preferable way to practice. And we've developed a web-based family history tool we call METRI that can be accessed through the internet as I've mentioned. When we were developing this tool almost 10 years ago these were some of the guiding principles about ease of use, ability to actually use published guidelines for risk ratification that we get the patient reports to be understandable by both the patients and the clinician and that they drive a discussion at the visit around the meaning of the family history information and we've incorporated as you can see a multidisciplinary team to implement this. So our developed family history tool and platform can capture data on 48 different diseases. We've been piloting this study in four different diseases that you see here, three cancers as well as one in vascular disease and thrombosis and the report that are generated are for both the patient and the provider. We've used a number of sources that I won't go into detail here that are used and updated to develop the informatics and clinical decision support algorithms. This is an example of the report that the physician sees, so it very clearly states what the recommended actions are, why those actions are being recommended and what other attributes of the patient might be considered as well as the sources of information that were used to generate those recommendations. The patient also sees a report that really as I said encourages them to have a dialogue about whatever risk information has been conveyed to them with their physician and try to come to a decision about what should be done. This particular family history software has some attributes that we believe are at least different than some of the others that have been made available through either the CDC, the Surgeon General or the VA. So you can see that this particular software allows for patient entry, does also name relatives in the family, has decision support and as we're illustrating in this project can be integrated into the clinical workflow. So this could be one report that would be generated that would be a more traditional family history tree but what our clinicians have told us is they don't like that, they don't understand it. They really want to see a tabular report such as what you see here. We began this project in earnest around 2006. We really want to understand the ability of patients to understand the information in such a report. So we did a number of pilot surveys and cognitive assessments of the language with the patient community and we also test drove it with genetic counselors so that we could understand how that information might be integrated as well as how it was received in the reporting. We also have got a team that has been frequently looking at clinical guidelines in the target areas and updating the clinical decision support algorithms to be concurrent with current recommendations for genetic counseling or genetic testing and this is an implementation science program so we're really trying to measure outcomes best as we can at both the patient provider and at the systems level. The first part of this that we've done the most work on is the process, really figuring out how it integrates into patient, into the clinician's workflow in the clinician environment as well as the patient and physician satisfaction. Does it influence patient behaviors? Is it a valid tool and does it kind of be also shown to have an, can be shown to have an effect on outcomes to generate clinical utility and the like. Also from an implementation science component, this is just a snapshot of some of the types of data that we're trying to capture both at the patient level, the provider level as well as the clinic level and this is done in an iterative way to ensure that we can achieve something close to seamless integration with the appropriate workflow environment in which the tool has been placed. These are some of our early data on patient acceptance of such a protocol and you can see by far and away most patients are extremely satisfied with using such a tool in the context of clinical care. They're not threatened by the use of the internet or computers. They found that most of the software that we've ended up using has been very acceptable. Surprisingly the provider community which in our early focus groups was somewhat resistant about having this sort of inserted into their environment has been unbelievably supportive. They now believe that family history is incredibly important. They believe it's improved their practice, made their practice easier. They're recommending it to their peers and when this project ends they're not sure what they're going to do without a funded program to continue the use of it in their program. So this was very different than what we expected. In the first half of the cohort as you can see more than expected number of referrals for genetic counseling and some for genetic testing but we're having these data reviewed by a completely blinded group of genetic counselors to assess the clinical validity. So far these appear to be highly valid results with a sensitivity and specificity of greater than 90% but we need more data. And I thought given the fact, if I can figure out how to do this, that this was around Thanksgiving and I wanted to show you a patient and provider perspective. We had a new station, this is not going to work, okay, never mind but we did have a really poignant interview with patients that were using this and how profound effect it is of this knowledge that they had which was empowering in terms of their behaviors that I wish I could show you. In addition to which the providers were saying how wonderful it was as the surveys indicate to have this as a robust tool within their environment as well. So I'm sorry you couldn't see the video clip but as this summary indicates we've enrolled about 1,000 patients, I think I've said most of this but one of the things we're trying to achieve is also not just how do we integrate this information into the clinical environment but what's the model for capturing the information, delivering the risk information and you can imagine that this could be a prototype for some of the other ways that we not just use family history but use other types of risk information such as genetic risk information. So in the future and areas that I think we should be talking about perhaps in the breakout session later on areas for collaboration is the incorporation of additional risk information to the platform whether it's new diseases that we're currently not studying or new types of risk information such as genetic and genomic testing. Because this has been a DOD study we're very keen to implement this and so is the DOD into the military healthcare system which is one of the impetus for the DOD funding was to create a model that they could actually use more broadly to broaden the decision support. We think that the use of wireless technology to capture this information beyond just using a home-based computer screen is going to be incredibly important and the use of text messaging to set up reminders. So I think with that I'll just stop and take some questions and certainly those of you who are interested in family history can join us in the breakout session. I just also want to mention that Mark Williams and Karis have both been doing family history projects maybe several implementation projects such as this. You may want to add some comments to what I've said but go ahead. Hi, Umberto Villegas from Marshfield. Very, very interesting stuff, couple of questions. I'm one of those people that inherit that OCD so I get a family history for my patients. When I see them updated it becomes a challenge and seems like everybody updates it because nobody else reads somebody else's family history. I take it there's like a central repository that gets updated and then everybody shares it and then the other question is on patients whose first degree relatives were consented, they did not consent but they get their care at Duke. How was that information entered if at all in their medical rate? So on the first question we have an aspirational goal to do what you just said which to have a centrally hosted information repository for the family history but that is predicated on having an electronic medical record that can support that and that just doesn't exist today but is something that we hope will be available in the future and I would just say also our view of this tool, this software is that it should be centrally hosted and accessible to any practices that wish to use it so we're trying to move in that direction and we can talk about more of that later. Your second question was about the use of gathering information from... We're not linking that at this point but again it's a topic of discussion and we hope to do that but again it's right now this is a research protocol patients are consenting so we haven't gone out to consent the other members of a family. I've got an additional point to embarrass and then ask a question following that. We are at Intermountain have developed a family history data mark where the representation of the pedigree structure of course will remain set and is updatable but we're using a primary collection tool much as Jeff has described that would be deployed in primary care clinics. We also recognize that within specialty encounters throughout the system components of family history are collected that are relevant to that specialty so we've been exploring modules specific for cancer that would collect more intensive cancer data but it would all go back to this family history data mark and so over time you have an updated and enhanced family history for a much broader range of diseases that not only hopefully will prevent the patient from having to answer the questions over and over and over again but will also allow exploration of other associations that perhaps were not immediately a parent or not known. The other thing that I would potentially add for your moving forward bullet points also relates I think to a bit to Umberto's question which is the idea of exploring social networking between families to allow family histories to be shared. Now granted there are part of that research agenda would have to be exploring what's allowable under current privacy regulations and under what circumstances it could be done but we've certainly had a lot of patients who have been extremely and this may be a Utah specific phenomena but they're they're used to sharing genealogic information from family family and they don't find it upsetting to think about sharing health information along that same sort of a model and you can imagine this type of a distributed collection of family history where if it all be captured you know within a family data family history data mark and would be available to multiple family members could rapidly increase the speed at which this type of information could be collected and used so I would like to explicitly add that to the research agenda. I think well first of all clearly social networking is a component of how you actually get this information in the first place but it's not on the as sophisticated a platform is probably the one you're envisioning but and I would also guess that social networking as a as a as a healthcare tool is worth worthy of discussion but how do you deal with the myriad of privacy and and policy issues that have to go along with that is is probably a formidable agenda but I'm not saying that should stop us but we should really consider those aspects thanks mark you may not be familiar with the various levels of billing codes when you see patients if one admits a family history one cannot bill as at a level five for a new patient one doesn't review the family history one can't review at a level five for an existing patient so there's four there's an implicit value that CMS has assigned to taking or reviewing a family history it's $28 for a new patient and is $26 per visit for an existing patient so it's an interesting policy opportunity to try and talk about the cost of taking and reviewing a family history is is already accepted by CMS and then try and benchmark that against other genomic interventions that we may choose to do yeah thanks for making it right now I was gonna say the same thing except it also is just illustrative of the thorny complexity of our reimbursement system and how it plays into this entire area of risk assessment Jeff this is Mike Murray from Brigham we've been involved in several family history projects and you've broken through in one area where we just can't which is the support of the primary care providers and I think going forward that's gonna be essential since patients have routinely told us stories such as the one patient who was enthusiastic shared his family history and his primary care doc said everybody dies of something and then put the family history aside so do you have any more granular feedback on why your primary care providers are interested and enthused about this a couple of points first of all this goes to this the discussion we had earlier about institutional leadership so Tim Rice is the CEO of the cone health system and as I said it's not a filler it's a community-based health system that has a far-reaching cashman area and Tim is very interested in having his community-based system being known for its advances in genetics and genomics so it's a very top-down environment where a visionary CEO is at least in this area has encouraged his community base docs to at least put their toe in the water and see how it feels and having done so I think they became adopters over the course of the first six months of this project hearing the feedback from their patients and seeing how much more effective and efficient at least they felt they were being in the care of these patients was huge so they so our goal is to have these docs to be spokespeople and ambassadors for the rest of the community and even to bring it back to Duke which is not it's not currently happening at places like like Duke for probably the similar types of reasons that you experience it at partners Jeff I might just just ask in terms of integration with the medical record we just any from from Vanderbilt did this nice summary of the five initial emerged sites looking at completeness of data and you know 80 to 90 percent complete from medical for medications and that and it was like 20 percent complete for family history and only two of the sites even could tell us how complete it was for family history out of the out of the five and I understand that Serner is putting in a family history module could you comment on how we can get that done so first of all there's there may be others that are more familiar with EMR integration family history than I am this system this group of practices does not currently have an integrated EMR but they're moving in that direction at Duke we're working with Epic and that is one of the one of the topics with our CIO and the Epic integration team as to how do we move this into a centralized resource such as an EMR so do others have experience with Serner or with other EMRs in which had there has been success well I know the mark you probably have but that's good there are a couple of ways to skin this cat I mean one is the ideal situation would be to use the the EMR but of course the challenge that we have in the EMR world right now at least the vendor based community is it's all being driven off of meaningful use so there's a group of us that have signed a letter that has gone to the advisory committee for meaningful use of the Office of the National Coordinator for Health ID to say you need to move family history up from the phase three implementation to phase two implementation which would actually get it on the radar screens of the vendor community in the next year as opposed to three years from now it is on the roadmap but it's down the road so meaningful use will drive integration of family history into electronic health records whether the level of functionality will be anything that would be useful is not clear to me the second thing that we can use perhaps to get around this however is through patient portals or patient-controlled medical records where there's much more innovation space and that if the data model is developed that is compatible with the electronic health record and data warehouse storage capacity that information could be inputted you know in a way that wouldn't necessarily have to involve interaction with the electronic health record and messages to the clinician could be filtered back into the workflow without having to have family history represented as a true component of the electronic health record so there's some opportunities to innovate around that potential roadblock yeah I'm glad you brought that up actually one of the pilot projects we're running right now is use of the patient portal to to capture the information and then this centralized the the information goes to a centralized server that hosts the clinical decision support tool for family history and then flips a report outside of the EHR back to the doc which is not perfect but it works and Dan before you comment I'd like to ask Greg Fero who's been involved in NHGRI's family history efforts for quite some time too so yeah I just sort of extend Mark's comments a little bit we had initiated the in conjunction with the US Surgeon General then it was Surgeon General Karamona the my family health portrait family history tool and part of our efforts over the last several years have been to drive development of family history data standards and adoption of those data standards in the context of electronic health records so currently there exists what's called a core minimum data set for what EHR and PHR systems should be able to capture the minimum about family history and their HL7 data standards for movement of that information around HIT systems the extent to which that has been adopted has been very variable commercial vendors many of them already had some basic functionality around family history data capture largely unstructured and when it was structured not structured in ways that other EHR systems could readily grab on to that being said I think Cerner is an example of a group that's looking at the HL7 model and has adopted it I know Epic has worked with it there are some one-off examples I believe at UVA in the Harvard Partners system with Jennifer Haas's project that have looked at integration of structured family history data I think something to consider for this group is family history is viewed a little bit like genomic data in that there's a little chicken and egg phenomenon going on here with the vendor community which is show me the benefit to the patients get provider demand up and we'll build the functionality in the data structure that's necessary and I think family history is an interesting proxy for a number of issues interoperability of data is key for family history as it is for genomic data issues around consent and data sharing are important to consider version control which was already brought up earlier it's a good proxy any easy proxy for people to wrap their brains around about so who's going to control annotations to the individual patients genome in the medical record figuring out through family history first might be a way to go so anyway there's there's lots of lots going on in that community and the meaningful use issue is a very interesting one of that of course I think would be a much bigger driver than the twenty six dollars that CMS currently is willing to pay for family history collection and data interpretation thanks for Dan nothing I'm about to say should be viewed as as excessively negative but do you have data on how many people have such small kindreds that they're not used that the family the effort that goes into the family history is not useful it was question one and the other question is as I listen to the outcomes part you know we're taught in medical school that the family history is important but beyond that why it's important and where we should focus our efforts is not such a big emphasis and it seems to me that the big payoff in your project so far has been to identify people who may have family cancer syndromes and so whether there is some value in focusing the family history on parts where we have I hate to say the word action ability and and not worrying about whether you know great-grandmother had something that you don't actually know how to characterize you died of cancer or something or died of a heart disease or died of old age or whatever so is there a way to focus the family history and bring it into the 21st century in terms of the kinds of information that we're looking at so we don't we do have data although I don't have the the data for you on the uninformative family history pedigrees that we've captured but we they're there I'm sure and I I think you're right I think we need to I think the the meat of this project is going to come several years down the line not just in in in understanding who has at risk for familial cancer syndromes but have any of their screening tests been informative and actually prevented something that or or earlier detect detected something earlier than otherwise would be I should say and I didn't mention this before that a review of these particular practices for the years pre preceding this project showed zero referrals to genetic counselors by any of them so presumably there was a there were a number of important familial syndromes missed up until now and presumably we will be able to have data in the in the ensuing years on the value of capturing that information so a bit obviously from Utah I can't comment on the small kindred question that you raised Dan but if we set that aside for a set of answers and one of the things that really surprised me was how frequently this is being used in behavioral health that when they have a patient who comes in who's having some issues around depression or that sort of thing they're taking family histories around depression bipolar disorder to determine which medication should be used how long should treatment be maintained if it's a child is this conduct disorder versus attention deficit disorder very innovative ways that intuitively makes sense but for which of course we have no data on whether or not that's appropriate or not so the clinicians that are actively using family history are doing some very innovative things with it and I think we one of the things we should be doing is exploring more of tell us what you're doing and then we can use tools to enhance that and I think that will also help with the issue that Michael raised about buying it so I was responding to Dan's comment about how people use this information what I tell our medical students is that first of all if you go to a cocktail party and you talk to somebody very often the opening for conversation is something about the other person's family so it's the way for the physician to get to know the person and their family a little bit that's a side value but it when it comes down to doing the pedigree there's two challenges one is to get all the information and then how to separate the wheat from the chaff and that's why I think getting it in tabular form we ought to avoid that it's the pedigree that actually allows you to say well it's great that granny had you know whatever but that's irrelevant to this problem at hand today it just can't get you just can't get there based on the pedigree so I would urge us to remember genetic principles so the 21st century model of the family history I think there won't be an insignificant family history because there's going to be a flip here where we've been using family history forever to as a proxy for genetics and now with genomics we're going to be using it as a context for genomics so when we're thinking about the whole genome sequencing we're not thinking about it doing it on any patients at this point unless family members are involved so so putting those novel variants into context but kind of the transition between what we're doing now and then is where we're at on that but we do need to move on so we have Debbie Marugu and Dave and then that'll be it okay I was just going to bring up the context of I think family history is is really important and I agree that focusing on sequencing of families is extremely important right at this juncture but I think we need to think about how we're going to get at the novel mutations that occur every generation in our in our population and how they contribute to disease right I mean this is an important question they are genetic if they arise they will be passed on I mean can we begin to address that if we more systematically study family so is are you saying that the somewhat of an interim holy grail is to link family history with genomic sequencing information so they're all in the same space that we can begin to look at how generational sequence how how how genomes are changing over generations and also what is happening phenotypically I mean I don't know when I think here believes that family history trumps or is a substitute for sequencing or vice versa that the two pieces of information need to go hand-in-hand which is what I think you're at least it doesn't mean that doesn't mean right so I mean we need to be able to look at different models for how DNA can impact disease Morgan man I come from Ohio State I'm kind of spinning on a couple of different things here I think part of this is excuse me it's not just genetics though it's learned behavior it's learned behavior of how you eat how you exercise you get that from your family get that from your parents you get that from your social networks and family history can get that information too and so if we get beyond just looking at the genetic information there's a lot of other things that are in there I mean people get heart attacks and their 50s or 60s but it could be just as easily from their diet as it is from their genetics and so in addition to getting the genetic information they'll learn behavior portions still gonna be there even after we have sequencing information available so my my comment to that is just as there are a myriad of family history tools that some of which we've seen here today there is an equal number of not more of health risk assessment tools that beckon the clinician to try to capture lifestyle information behavioral information diet and so on that could be integrated into this as well to create a more complete picture of what's going on with the individual and their family and physicians generally don't have the time to capture that information on their own I just like to say this is an absolutely critical issue as we go to paperless awards which we're all reaching right now it's just not easy to record to obtain and record a pedigree on the warts and we need to come up with some easy effective and electronic way to do this so please join the breakout group this afternoon David thanks


10. The spirit of independence, the spirit of our celebration is being exhibited across the length and breadth of our island. Our creativity and self-expression can become the key pillars for nation-building and national pride. Let me wish you all a happy celebration of independence and look forward to a very rewarding and fulfilling experience. 9. Today we gather, lest we forget. Today we gather to remember because we care. Let's celebrate what we are, Lucian's friends. We thank God for the legacy of Ansider. 8. To think that you have done something and it is considered to be a value to the nation, you know, you're recommended by a committee and then you know to do this. So I was very, very delighted. 7. Taiwan will continue to collaborate with other primaries of Ethiopia and the government of Senutia, steering our nations to a brighter and more prosperous tomorrow. So I want to thank you for understanding that these grants are necessary and they serve a useful purpose. 6. In a heartwarming gesture of compassion and solidarity, the Taiwanese Embassy via the NGO Simply Hub Foundation has again extended a helping hand to scores of marginalized and less fortunate households in Senutia donating close to US$100,000 worth of essential items to the Ministry of Equity, Social Justice and Empowerment for Distribution. Every act of kindness can create positive change and today your donation is a powerful reminder of that fact. This maintains our civilization. This ensures that we continue to cater and be relevant as a society, cater for those who are most in need. 5. A partnership to empower young leaders has been formalized as the Ministry of Youth Development and Sports has partnered with the United States International Development USA Youth Resilience Inclusion and Empowerment Program to launch the Youth Work Program for effective youth work practice which is aimed at enhancing the skills of youth workers. This collaboration symbolizes the synergy between two entities committed to shaping the future of our communities through the lens of youth development. The Youth Work Program for effective youth work practice is a strategic endeavor to strengthen the Ministry's role in confronting the wide ranging challenges St. Lucian youth face. 4. Education Minister Honorable Sean Edward commended the Cadet Corps for its significant support especially during the time of disasters and says the organization has the answers to some of the major social ills faced with young citizens. The significance of what you do is immense and it is against that backdrop the government will stand shoulder to shoulder with the Cadet Corps to ensure that we give you the requisite support so that your work can be even more impactful than it has been. 3. An initiative to sensitize the nation's youth on climate change and its impact on health was undertaken this week in an effort to change behaviors which can have an adverse effect on climate change Today's activity is very exciting we have the students here from all in the northern part of the island who are getting some information on climate change and health and how they can take an active role in contributing positively to climate change. 2. There was a signing of the DVRP at the Ministry of Infrastructure and I was Minister at a time and I signed it that loan that agreement with the then Prime Minister Kelly Anthony and a long list of roads and walls and buildings that the DVRP would have constructed and it was signed on 26 April 2016 26 April 2016 for the financing of the reconstruction of the PI bridge and the rehabilitation reconstruction of the Ansary Villas Road. 1. The school supervision retreat focused mainly on the collective aspirations of those charged with the supervision of the education sector fostered through dialogue collaboration and a shared vision in order to shape the future of education within St. Lucia and the wider region. Our collective efforts will help the principals the teachers the students and the leaders that we lead to shape this nation to shape our society


How good did that feel? It felt great, man.  It's been a while since we have really affected a quarterback like that. You know, just props to the front, but also props to the guys on the back end.  And, you know, we had a, that was a great team win. And especially the defense, you know, we play together. You guys, I'm sorry, Kayla. Did it take a while for you guys to kind of get used to when Heineke was in there? No, we knew, I mean, even, because we said it, because they brought him in, as you see on film, and we knew he could run. And that's the thing with guys like him. And, you know, he was getting the ball out a little quicker than Ritter, of course. But at the end of the day, man, we found a way to get the stops when we needed it. Like Coach said, it's hard to win this league. At least I'm making it that hard. But at the end of the day, man, it feels great to win. It feels great to be back on that winning side. Man, it's just stacking these wins, you know, and being able to stack wins in this league, you have to win on the road. And we're going to have another tough one Thursday, short week, and we got it mentally and physically to be ready to go. How much should it help with those big passports? Yeah, I mean, that's what it's about.  You know, just that practice, and I just saw his confidence in him. And being able to carry that offense in his professional league, and, you know, props to the whole offense, TK and him calling a great game for Will, and putting him in a position, and guys like Hop, man, it was just waiting to happen. You know, I'm happy for the offense, happy for Hop, happy for the whole, like I said, this is a great team win, and, you know, hopefully we can keep building on this. All the trade stuff, you know, Kevin Byer got the most respect for him, just as a player, and it's six, seven months, whatever it was, I got to be around him.  He, you know, he's obviously the mayor of Murphysboro, so it was hard on the guys, but I mean, we just rallied together, like, at the end of the day, no one player, you know, you saw so many legends come back, and one after another after another. No one player makes his organization. It's us as a collective, and, you know, obviously he's in a position to compete for a Super Bowl and win games as well, so he's not dead, you know, obviously.  We just came, showed up to work, man, everybody having each other's backs top the bottom, and, you know, just locked the gates, and just went and played hard, and now I can't be more proud of the guys. Defenses talked all week about, you know, affecting the quarterback and getting turnovers. You did both today. How good was that? It was great. Obviously, it sucked. Like, Carol had that one towards the end, and, you know, whatever, neither nor there, but as a whole, I just think it was a really good job. Obviously, it's always something to clean up, and no game is going to be the same. Every game is different. So, every game, you know, you got a chance to win.  So, at the end of the day, the main thing that matters is getting the win, which is what we did, and now we put ourselves in position, you know, on a Thursday night, short of week, come back and get ready to go play against Pittsburgh. You see a rookie quarterback like Will today balling out, moving the offense. What does that do for the defense?  You know, Coach Harris, he had told us, like, create the energy, you know, don't, like, wait for somebody else to do it. And that's just, as a collective, on top to bottom, like, just feeding off of each other. Defense, creating energy, you know, offense, special teams, like, I mean, special teams play a huge role in this game. And, man, like, just, I would say, all three phases are just in sync. So, it was big. Not a lot of time to celebrate this one. Obviously, short week. We got to go to Pittsburgh on Thursday night. What's got to be the mindset for you guys? Oh, man, just got to obviously clean up all the things that kind of allowed us to, you know, give up 23 points or whatever it was and build off of the win.  Look good in your early unis, man. Oh, yeah, for sure, you know. I wouldn't mind it at all. I like that. Feeling better and better. Like I said, in the first three weeks, I was dealing with something else that kind of didn't allow me to practice as much as I want to.  So, that's a big factor for me, being able to practice and work on my stuff.  I don't ever get too high or too low. I just keep working, trying to improve. And that's what I'm going to do following this game. What do you guys are reviewing? I mean, everyone to me, I feel like it's hard to win this league. It is, but like I said, I felt confident coming into this game because I felt like we had a good week of preparation for this game. And like I said, we just had to go out there and cut it loose and that was it. You see how you guys see a rookie quarterback out there balling and moving the offense like you did. What do you think of defense? I mean, it brings life to the whole team when you see how he was playing. No, I mean, it's just amazing, man. Happy for him. Happy for the team. Appreciate it. It do a lot. It allows us to come back on the field. It allows them to hold the ball a few. It allows us to catch a break. He did a lot of tremendous things, a lot of good things today. I like what he did today. Shit, two quarterback hits in two games. That's not our standard. That's not what we... That's not our standard. And we took that. We had that by week, of course. We talked as a D-line, so I saw a line back in the room during the by week and then came this week and got work done. Yeah, I mean, we're on the field at home. We're going to win at home. So it's all about those road games. We got to figure out a way to win on the road game. I feel like once we get one road win, then it'll trickle down to a lot of wins on the road.


Okay, cool. So, um, I'm a bit nervous now, following the monkey comedy hour. Um, it's gonna be hard to follow that up. But this is relocation bonus. Attacking the windows loader makes analysts switch careers. So quick introduction, I am Nick Cano. I'm 25, and I'm a senior security architect at Silance. I have written a book on hacking games. Sorry, I didn't know a clap was coming. I've written a book on hacking games. Uh, I'm also a Pluralsight author just had a course published like a month ago on C++ secure coding practices. And what does this talk about? Well, this talk, in essence, is about the windows portable executable header and how it can be weaponized to destroy parsers and other static analysis tools, things like disassemblers and such. And that all culminates into like a PE rebuilder for 32-bit windows binaries. So you might ask, why are you attacking relocations? So, this is a disassembly of a game. A game that I make a bot for. Disassembly. To get rid of a jump call, just put some knobs in there. And then I saved my new binary to disk. I ran it and it crashed. I was like, what the heck is going on here? And I looked at the code and my knobs were now changed. The code was different from what I had patched. And I, I know what you guys are thinking. What the heck? What's going on here? So, as it turns out, there are these things called relocations. So, at first I was like, oh man, this is broken for no reason. Then I was like, okay, relocations corrupted the patched code. Then I was like, maybe I shouldn't patch code that is relocated. But then I thought, I can use relocations to hide my arsenal in the bowels of the machine. So, before we dive into the nitty gritty technical details, let's, let's restate what we're doing here. The windows loader has this piece in it that applies relocations. Relocations exist because binaries will have pointers in there that are, that are sensitive to the position of the binary and where it is loaded. So, if the binary is loaded at a different base address than the compiler expected, those things need to be relocated. So, if we can weaponize that, if we can instrument that and make it modify things for a different purpose, we can use that for obfuscation. And we can get an obfuscator such that there's no deobfuscation code. The windows loader does it all for us and then it's kind of a mystery if it's the first time seeing this, you're like, this thing is a mess on disk and then in memory it's fine before anything executes. So, that's what we're going to talk about. So, first we need to say, well, what are relocations? They exist to enable ASLR and dynamic mapping. That's not exactly true. It's a bit more nuanced than that. But for the sake of executables, they exist to enable ASLR. And let's look at an example. So, this is the same binary loaded at two different base addresses. And I'm specifically looking at a function table. And as you can see, the function tables in the two different loads, one on the left and one on the right, the addresses are different, at least that upper part of them. And on the left we have, what is that, O-1-3-3 and on the right we have O-1-1-7. That is because they're at a different base address. We can see that actually here outlined in blue is kind of reflected by the address of where this function table is in the binary's memory. And we can see that the values are actually changed here in the bytes of the function table. So, let's take a sidebar really quick to talk about the PE header. By the way, this is not my diagram. I got it from Corkami. If you don't know what that is, check it out. A really good resource. So, there are three things we're worried about. And the first thing is image base. Image base is a part in the PE header. Well, so the PE header is kind of the description of a binary in Windows. What needs to be loaded? What parts of memory need to have? What access rights? What functions are imported? Stuff like that. But we're specifically interested in image base, which is a value you can use to say what base address you want your binary loaded at. And if ASLR is not on, that will be followed. Throughout the talk, I might refer to this as desired base. There's also DLL characteristics. Now, this is just a two byte value. And it's like a flags value. We're specifically interested in the bit 0x40, which if it's set means ASLR is on. And if it's not set, ASLR is off. And ASLR is just the part of the loader that says, okay, I'm going to put this binary at a different address for security purposes. And finally, there's the data directories. And specifically, there's an offset from the data directories called image base entry reloc. So the data directory is basically just an array of pointers and sizes to different pieces of data that the loader needs. And we're only worried right now about the reloc index, which points to the relocations table. And the relocations table looks something like this. At the top here, you have the data directories. And then we have this little gray block. And then we have what the reloc blocks actually look like. In the data directory, there's a pointer to these blocks, to the first block. And then all the blocks should be contiguous after that. And there's also a size which refers to the size of all of the blocks in bytes. Each block ends in an OX000, just 2 by 0 to say this is the end of the block. There's another block coming so that the loader knows that it needs to look for a new relocation center. So each block looks something like this. First, there's a virtual address. That virtual address is sort of like a base. So instead of encoding every single address that needs to be relocated, you encode a virtual address and then offsets relative to that virtual address that are less than 4 bytes long and that just saves space. So this virtual address is the base which we will offset from in each entry. There's also size of block. And that is the size of the entire block. That is including the size of size of block and the size of virtual address. So those are both 4 bytes, so 4 plus 4. And then in this case, we have 4 entries which are each 2 bytes. So then plus 2, 4 times and you get the size of the block. So each entry is 16 bits. Four of those bits or half of a byte are the relocations type which we'll talk about in a second. And then the 12 remaining bits are used for the offset. So you get up to 4.096 from the virtual address. So you can have virtual address and then you can have as many entries as you want within 4.096 bytes of that to be relocated. And this optimization, it might not seem like much but when you have a function table where you have like 30 things to be relocated back to back, it makes sense why it's done this way. So this code kind of describes how the loader does relocations. This is just pseudo code. Obviously it's not written in modern C++. But this gives you the gist and we're going to talk about this. Specifically what we care about is the first line where we say delta is equal to base. That's the base that we're actually mapped at. Minus desired base. That's a base that we asked for in the PE header. And then the first if statement inside the loop is the type of relocation we're going to use. So if we were to look at that first if statement, we would see that a plus equal operation is used during relocations and the right hand side of that is delta. So essentially everything that is relocated is the value that's there plus equals delta which is derived from the base address we're given minus the base address we wanted and that's how everything gets fixed up to point to the right place. So the conclusion that we can come to is that if we want to abuse relocations or if we want to be able to control what they're writing, base must be pre-selected or we must have some way to take base and make it be something we know that isn't the base that we asked for. There needs to be a difference there. And desired base is the only means of controlling ASLR. So that's a bit tricky and delta is also dependent on desired base. So we know we need to use desired base somehow to pre-select the base but it's not clear how and I thought maybe we'll just try invalid stuff. So I tried negative one or max int or whatever you want to call it and it didn't work. PE fails to load. Well what I know is those final four F's actually have to mask and be zero because of alignment. So I tried all zeros. PE fails to load invalid header. So then I combined the two and PE loads at base OX1 with four zeros after it consistently every time. So we're getting a base address every time that is different than the one we asked for and always the same. As I later learned, Corkami already had all of this documented so this has been known for a few years as well. So let's talk about the loading process. It's pretty complex and this is not all of it but this is sort of what the Windows loader does. So you don't really have to read this whole thing. What we really care about is that the things in blue are things that happen before relocations are applied by the loader and the things in orange are things that happen after relocations are applied. So if we want to obfuscate things, we might want to obfuscate things that happen after relocations are applied or we might break something. So if we just take out everything that isn't relevant, this is when we do our attack this is what it will look like. This is the flow chart we'll go through. Now you might notice there's a red arrow coming from ASLR enabled which means we're actually going to have ASLR set to off and the attack happens here. So it turns out we're not tricking ASLR but when the allocator is being asked to locate something at ff ff 0 0 0 0 it's saying yeah I can do that but it's spitting back 0x 1 0 0 0 0 for whatever reason. So our targets for relocation obfuscation well we know import table is loaded post relocations so we can obfuscate the entire import table that is all of the libraries and functions that are imported from DLLs can be obfuscated so on disk they look like trash but the loader fixes them up at load time. Additionally even though sections are mapped pre-reloc they're not used until execution which is post-reloc. Additionally their memory protections aren't set properly until after relocations in case read-only stuff has to be relocated. Also entry point isn't used until post-reloc so we could obfuscate the entry point making it that much harder. The problem is that is right protected before relocations are done so you can only do this if the target machine doesn't have data execution prevention turned on. So and the conclusion is pretty much what I just said we can hit imports code and resource sections and optionally the entry point with this attack and that is this little green area you can see highlighted. Now you might look at this and say okay that's only like half of the binary but what you have to realize is this is a minified PE and that is actually most of the important stuff and in like a real binary it's going to be somewhere like above 90% or 95% of what's actually there and what's actually important content. So the final attack looks something like this. We'll load the target PE file, the PE file that we want to obfuscate. Then we'll apply the original relocations because remember relocations are there for a reason OX10000 is probably not where that binary wanted to be mapped. So it's going to break unless we apply the original relocations and say okay fix everything up for that address. Once we do that we flip ASLR off because remember even though we plan to trick ASLR we're actually tricking the allocation function. Then we set desired base to that tricky FFFF000 and then we loop over all of the data that we want to obfuscate that is sections, import table, stuff like that in D word or UN32 size chunks and we decrement them by what we expect Delta to be. That decrement is because the relocations part of the windows loader doesn't increment so we just do the opposite of that and that is kind of our obfuscation. So every integer in the stuff we're obfuscating is going to be messed up a bit which is good enough. Then we discard the original relocations table because we've already applied them on disk. We generate a new relocations table reflecting the positions of every single decrement that we've done so that the loader can fix them up. We save the new PE file to disk and profit we're done. We now have a PE that is completely mangled on disk. It has a huge relocations table and then when it runs it maps perfectly fine. So let's jump into some demos. So here I'm trying to load it in IDA. You can see the messed up DLL name IDA thinks is an import. IDA throws some weird errors. On older versions of IDA it was crashing sometimes. I can't get newer versions of IDA to crash. You can see IDA lights up red. It doesn't know what it's looking at.  Everything looks like trash. Binge is going to be mostly the same. It's going to see two subs but it's got like question marks there. It doesn't know what it's looking at. So next is CFF Explorer. This one actually crashes somewhat consistently. I think it's this one that like it reaches out on the network and does a bunch of like out of band scans that come back like a few minutes later and those do cause crashes more than any other tool. There's no crashes in these demos because one you have to get lucky. They're not even consistent across the same binary and also you have to get a binary that happens to cause them. I haven't looked more into it. I'm really worried about as you can see here the import names are all messed up. Some of them look kind of right because remember we're doing it in four byte chunks. So for strings we're only messing up like one byte at a time. Depends just completely chokes. It has no clue what it's looking at. And then resource hacker just throws an error. It says you don't have a valid resource table because the resource section is encrypted or obfuscated. And even PE bear you can see it just lights up red. Imports look like trash. If we tab over to the disassembly we'll see it says okay these are invalid instructions. We'll also see a bunch of jumps into locations that can't possibly be jumped to. And finally PE view it's going to be the same thing.  Codes are going to be messed up. Okay. And that is that one. Okay. So we've shown that this attack is viable and that it works and we can do something with it. Oh wait what am I doing? I have another video to show. I'm pretty dumb. We like we've seen it break stuff but we haven't seen it work. What am I talking about? So let's do that. So here you can see me clicking on the binary and it runs. This is an encrypted obfuscated binary with this method it's running. And it's just process explorer that I've obfuscated. It's going on over there. It's just process explorer that I've obfuscated so that's why you saw process explorer launch. I did this because this is a relatively complex application. It's got a lot of stuff in its resource section and it's got a lot of non-trivial code. So I figure if it works on this it'll work. What you see right now is me searching for invalid strings in the image to show you that this is actually obfuscated. Some of the strings are not obfuscated because they're in the dot r data section which I didn't obfuscate for this demo but if you look here you'll see a bunch of file paths and a bunch of like error strings that almost look right but are actually gibberish when you try to read them. And it also kind of messes up like a ton of AVs so here's a malicious sample. We're going to go ahead and pack that. And now you see it's generated a new sample sorry. And we're going to drop them both on virus total and see what happens. The first one is going to light up already. And now the second one even though it's effectively the same binary that's just obfuscated by the windows loader I guess we only get two threads. Okay so we know the proof of concept works. We should probably test it on multiple platforms. Windows 7 it works that's what I originally developed it on. Windows 8 no one uses Windows 8 come on.  Yeah I get it. Okay I'm done sorry. Okay no but really we have to find a new attack for Windows 10. What ends up happening is asking for 4f's 4 zeros does not yield that one with 4 zeros after it. It actually lets ASLR go through the process even if the ASLR bit is off and then we get a random base address. So no good. So I thought maybe I can embed multiple PE copies for all possible base addresses and then use some kind of reloc tricks to point to the right one which is something Corkami has actually shown as possible but that would be way too big it would inflate the binary even more than using relocations already does which is actually pretty significant. So then I thought maybe I can tweak ASLR configuration because I know there was a major change on Windows 10 in how all of that works and that actually does work. So if you notice the demos were on Windows 10 and this is what I used to demo on Windows 10. We set mandatory ASLR to on and bottom up ASLR to off and if we do that with this dot red file for specific executables it works but I don't really like it. As soon as you start touching these registry keys everything is going to light up. AVs are going to light up, EDR is going to light up. Monitoring is just going to say hey this is bad if it doesn't just block this entirely so I wanted something else. And then I did a lot of playing with it. I was trying to see what I can do to control base addresses and I noticed this. So this is just a file. I have multiple instances running and I'm basically just looking at the base address of this file. And even though I have multiple processes running of the same file I noticed that they all have the same base address. There's something in Windows that is caching that base address or reusing it on loads. Maybe it has something to do with copy on write. Not exactly sure. And then I noticed okay if I take this file I copy it to another file. I delete the original and then cat the copy into the name of the original. It sounds crazy but it's a way of copying a file to itself without the file system being able to track that it's the same file. And then I launch it again. I invalidate that base address. So they all have the same base address again but it's different from what it was before. So this tells me there's something in the file system that invalidates that base address that's being reused. So I can at least brute force and get a base address that I want by just invalidating it every time. So we're going to go over a pretty complex flowchart. So really quick here's a flowchart on how to read flowcharts. Okay I actually put it in the deep fryer so let's just talk for a sec. So what I figured out is that if you take a file and you memory map it then you close the mapping and you launch that file it will be launched with a different base address than last time you launched it. So if you do this in a loop you launch a file check the base address if it's not what you want memory map the file close the mapping launch it again you can keep getting a new base address and you can brute force and pre-select whatever base you want. And then attack looks like this. So you'll have a root process and a drone process effectively where the drone process is just launching and throwing back a specific return code based on whether or not it has a base address that it wants and then you have your root process which in a loop is doing that mapping stuff with which is highlighted in yellow. So here in orange is really the main part of the attack within the root process we're highlighting the loop that's going in and saying okay I'm going to keep looping until I see the right base address which is signaled from the drone process by an exit code of OX what did I use bad beef yeah. So if OX bad beef is the exit code of the drone process it knows that it didn't get the right base address and it will keep doing this loop. Now these are actually the same file so effectively we want to put that embed this attack in the binary we want to obfuscate it will make a copy of itself to be the drone process so that it can map that copied file to invalidate its base address and launch it over and over and over again. But effectively there's the same code which is why you see at the top we create a mutex and check if it exists and that's how we know for the root process or the drone process. So to weaponize this the tool must create a new section with enough room for this brute forcing code embed the code inside of this new section and make that code aware of the original entry point then it needs to point entry point within the PE header to the embedded code so effectively it's a typical parasitic infection. And for this to work this ASLR pre-selection code this brute force attack must be position agnostic because we're just throwing in a binary wherever you can. It must be generically embeddable in any PE. And yeah that's basically it. So to do that I made a bunch of pre-processor macros so I could do everything in line this you don't need to read these this is just showing a bunch of variadic macros and once I had all of these in place it looks something like this. So like some of the weird stuff I had to do like some of these macros take a string in and then they emit that string as like assembly bytes and then jump over those bytes and then use like a call and then a ret to get the address and like move it into a variable really weird stuff. But this is how I made all that work. Now you might be looking at this big block at the top which is doing a bunch of function resolution and you might say Nick why didn't you resolve get module handle and get proc address and then do the rest normally. And so my answer to that is this is like more obfuscated it's really indirect this code actually looks like a mess. So it's harder to reverse. That answer is a lie. I got really carried away writing the macros and then I had resolved all of my functions by the time I realized I could have done that. So yeah. And it worked. So this actually worked. So there's some caveats. Because this attack is actually running code. We are sorry. I had my bullets wrong in my head.  So it can be slow. It takes about 200 iterations to land on the base address that we want. So depending on what machine you're running it on it can happen in five seconds or a minute because you're launching this executable hundreds of times and you're mapping it to memory in between. So also the size of the executable matters. Size matters. And imports can't be obfuscated. Right. Because what ends up happening is the binary has to get mapped into memory properly for this attack to start running. And if imports are obfuscated on the times where we don't hit the right base address the windows loader is just going to nop out and it's going to say okay this is wrong I can't resolve any of this and it's just going to error. So that's a bit of a problem but there are some advantages. Because first we don't really need to use that one with four zeros after it. Before if you saw the request of FFFF zero zero zero zero and you're like a parser you know it's going to map this address but with this attack we can pre-select any address within the realm of possibility. And the side effect of this is some form of symbolic execution or manual analysis is now needed to determine what base address is going to be obtained. So it's harder to just take this and do the relocations like inside of a parser to fix up the binary. So yeah we can't do imports which was actually really cool to see but at the same time it's harder for automated analysis. And let's see what this looks like. So you see process monitored on the right and you're going to see that just showing a bunch of process launches this is a brute force going. You can see on the left it copied itself to just its name two dot exe. It launched itself a bunch of times looking for the base address showing that in process monitor and eventually it created that binary and then eventually it launched which we see down here. We see that it actually loaded and launched process explorer which is what we had obfuscated. If we go and we look we see okay we had our first thing it copied the second thing it launched it that got mapped properly and then that process explorer actually then drops a 64 bit file and launches that which is why you see an extra process. But that's just showing that we've actually obfuscated resources and they got deobfuscated so that process explorer could dump another binary out of them perfectly without messing it up. Yeah and so what can we really do with this? We've seen it work. We know it's an interesting attack. We've got the windows loaded for deobfuscating stuff for us but what can we do with it? So you can annoy analysts with this. It's going to be annoying like maybe the first time or first few times you see this but if you see this a lot it's actually not that annoying once you know what's going on. We can break a lot of automated static analysis systems as we saw before a lot of PE parsers just choke on it. We can break a lot of tools those two are kind of one in the same but we can break maybe some AV parsers I haven't looked too much into it but I imagine there's at least one out there that's choking on this but there are a lot of improvements we can make as well such as more obfuscations. Now this might mean new targets so instead of just doing like a few sections and imports we might be able to find and identify other things that can be obfuscated or we might be able to do multiple passes. So we do right now each d-word in the file consecutively in any of our targets but what if we do that and then we start over offsetting by one and then we start over offsetting by two and then offsetting by three instead of getting like one or like one and a half bytes that are messed up for every four bytes everything's obfuscated. The thing is your relocations table is going to blow up if you do this but I mean if you really want to make it hard to analyze it's possible. We might also be able to do header scrambling so we might be able to embed things in the relocations table that say these things need to be relocated that aren't things that we've done anything to. Things that are needed by the loader but not needed during execution. So then the loader will go and it will relocate things that were already correct then corrupting them in memory. So not only would you have something that looks corrupt on disk and fine in memory you could selectively corrupt things to make dynamic analysis hard because right now this doesn't really do anything against dynamic analysis. And we might even be able to combine this with runtime packers and that would just be an extra level of annoyance. Now support for 64 bit binaries is definitely possible. The pre-selection attack it seems like there would be a much larger search space but as far as I can tell Windows does kind of prefer to load it around a base address that is like the maximum possible user space address that's available minus the size of the binary. It tries to load it around there at first. So if you do that you might be able to narrow down the search space though I haven't exactly tried it and the FF FF 0000 trick works similarly in 64 bit but not exactly the same. Might also be able to support DLLs. I actually have no evidence for that. I just think it's probably possible with the right modifications. And then you could also do selective obfuscation. So rather than obfuscating the entire binary which just throws up red flags right away you might have an IP address embedded in a section. And you only use this to change one byte in that IP address. So now the analyst is like okay this is the CNC because this is a string this is a hostname or an IP address. So then they try to connect to that and they're like okay the CNC is dead but they were looking at it in IDA which isn't doing relocations at load time you relocate just one byte in that address and now you're good to go. And it's kind of confusing. It won't trick a lot of people for too long but it will add an extra annoying bit there. And that's the end. So we have a bunch of links here. This QR code I believe goes to the slides. So here's what's going to happen with the code release. We've decided to do it like this because while we're not dropping any O-Day or anything that's like super bad we are breaking some stuff so we want to give people time to catch up with that. So in two weeks we're going to drop some samples. So if you're working on fixing this if you write a parser or you work for an AV company you write a PE tool you can go ahead and start thinking about this. The slides are already up so all the information is there. In two weeks you'll have samples to test on and exactly one week after that full source code release everything will be dropped and anyone can play with this, make changes, commit. The source code is in C++ Visual Studio 2017. So I think if you hit the relocation bonus get hub repo. I've posted a timeline on there for now that will eventually point to the code. Full timelines on there but I think it's September 3rd for the full code release. Thank you.


I'd like to call the ninth meeting of the 2014-2015 Common Council to order. Would the clerk please read the quote for today. Thank you, Mayor. People have been known to achieve more as a result of working with others rather than against them. Thank you. Next we'll go on to the roll call. There are 13 present. Alderman Venakren, Alderman Herman, and Alderman Donahue are excused. Next please stand and join me in the Pledge of Allegiance. Pledge allegiance to the flag of the United States of America and to the Republic for which it stands, one nation under God, indivisible, with liberty and justice for all. The next item on the agenda is the approval of the minutes from our last meeting. Alderman Hammond. Thank you, Mr. Mayor. Move to approve. Second. Thank you for that motion and support. The motion is on the floor. Is there any discussion? Seeing none. All those in favor, please signify by saying aye. Aye. Opposed? Motion passes. Next we'll go on to resignations. City Attorney. Thank you, Your Honor. I have a resignation from John Vandermal who's advising that he's residing from the City Plan Commission because of the advanced technology he's not familiar with. He's not familiar with the new board docs just now being used in the meetings to not feel comfortable learning at his age. Enjoyed serving on the committee for the past 15 years. Alderman Hammond. Thank you, Mr. Mayor. Move to accept and file. Second. Thank you for that motion and support. The motion is before us. Any discussion? Seeing none. All those in favor, signify by saying aye. Aye. Opposed? Motion passes. Next is council appointments. City Attorney. Honorable members of the council, hereby submit the following appointment for your consideration. Marilyn Montemayor to be considered for appointment to the City Plan Commission to fill the unexpired term of John Vandermal whose term expires for 2015 signed by the Mayor. That appointment will lie over. And Don Terschner to be considered for appointment to the Housing Authority to fill the unexpired term of Roland Wilson whose term expires for 27-25. Also signed by the Mayor. That will also lie over. And then we'll go on to confirmation of council appointments. City Attorney. Nancy Manchin to be considered for appointment to the Library Board to fill the unexpired term of Marge Segali whose term expires for 30-2016. Alderman Hammond. Thank you, Mr. Mayor. Move to confirm. Second. Thank you for that motion and support. The motion is on the floor. Is there any discussion? Seeing none. All those around, well, no other. We have to call a roll for that. 12 ayes, one no. Motion passes. Next is a presentation by City Assessor Lee Grossnick on the City Reassessment Notice. Lee, please join us in front. To the Common Council, Citizens of Sheboygan. As everybody knows, we just completed a revaluation citywide. And it's generated some interest throughout the city. We've had a fair share of calls. And there's been some articles in the paper and such. And I wanted to share some information with the council and some of the citizens as to what we have done as far as the revaluation itself. Some of these are questions that I've received. Some of these are some statistics. Facts about the revaluation process. We began in June of 2013. It was completed by myself and my staff of three other employees. We also had some additional professional help from Grota Appraisal. There were 15,516 residential parcels that were reviewed and 1,352 commercial parcels. As far as manufacturing that gets taken care of by the Department of Revenue. And the last revaluation was completed in 2006. Now what is a revaluation and why is it necessary? A revaluation is an update of all assessments within the city. When property assessments are no longer within 10% of fair market value, the Wisconsin Department of Revenue notifies the city that they are out of compliance and that a revaluation should be done. Every year the DOR conducts a sales ratio study to establish an equalization ratio or level of assessment. In 2012, the DOR sent our office notice of 1,284 real estate transfers. It then became our job to determine which of the transfers were valid sales and the appraisers after checking each individual sale validated 321 transfers as arms length transactions. Now that's I think a little less than 25%. It just goes to show you what we have to all throw out to find valid sales to work in this process. The information anyway was then passed back to the DOR to analyze and create the 2013 ratio which was at 110.68%. At this point the city was no longer within 10% of fair market value and the valuation was recommended. I also included a listing of tax rates and assessment ratios. Basically all I really wanted to show is how the assessment ratio changes from year to year. In 2006 you can see we were at 100% and that was right following the last revaluation. Then in 2007 we had a normal good year and the sales when compared to our assessments the ratio came in at 94.84%. In 2008 it pretty much was at a standstill. It dropped down a little bit to 94.17%. In 2009 the turn started. It went back up a little bit to 94.92% and then in 2010 all the way back up to 100%. In 2011 it continued as our assessments became for the first time ever really to be bigger than what the sale prices were coming in at. We were at 103.63%. In 2012 it jumped away to 108.67% and then in 2013 it went to 110.68%. How did we determine the values? I've been asked that a few times. In a revaluation the value of your property is based on an analysis of the entire real estate market for a specified period of time before the project is even completed. The study of property sales between January 1, 2011 and December 31 of 2013 allowed the appraisers to establish valuation parameters such as neighborhood ratings, influence factors, and market adjustments. Parameters were then applied to the sale properties and the calculations were tested for closeness to the sales prices. After tests were completed and the results were satisfactory, assessments were generated for the non-sale properties and another review took place by the appraisers and the assessments were also reviewed by style and by square foot value ranges within each neighborhood. You're ahead of me. Did all assessments change at the same rate? Now, many of these questions are questions that I took over the form of recent. Anyway, assessments do not change at the same rate. There are differences that we find between individual properties and between neighborhoods. Values can change from one neighborhood to another. We've all heard it, location, location, location. How can my assessment change when I haven't made any improvements to my property? General economic conditions such as interest rates, inflation, or recession, and changes in tax laws as property values change in the marketplace so can assessments. How will my taxes change as a result of the new assessment? A change up or down an assessment does not mean that property taxes will increase or decrease. Your final property tax amount is affected by budget needs of the city, the county, school district, and technical college. Property taxes are then determined by taking your assessment, dividing by a thousand, and multiplying by the tax rate. Will my assessment go up if I repair my property? Normal maintenance will help retain market value, but generally will not affect your assessment in a significant way. Which is the case generally with roof replacement, generally doors, flooring, those types of items. What will happen to my assessment if I improve my property? Not all improvements increase your assessment, but the following may. An added living area or a new garage. Aluminum or vinyl siding. Vinyl siding is when we run into a property that has like or asphalt. It's not really desirable anymore, like the vinyl, and so therefore it can increase the value of the property. Substantial modernization such as kitchen or baths, addition such as fireplaces or air conditioning, and just plain out extensive remodeling can all have an effect. Nobody inspected the inside of my home, so how could you reassess it? The assessor's office maintains a complete record of each property. Information is kept current through building permits, sales inspections, and exterior reviews. This information is used to develop the new assessment. Did the foreclosed home next to my house affect my assessment? City appraisers did not take foreclosures and share of sales into account when we reviewed the sales. They weren't considered to be arm's length transactions, so we just removed them from the equation. What can property owners do to keep their neighborhood from declining and bring more stability to their neighborhood? There's a number of residents that called. They have picked up some of these older homes in, I'm going to say, at a very reasonable price. They've put money into them, fixed them up, but yet the neighbors around them haven't done so and the area is just in some ways holding their value back. Anyway, I've been encouraging residents to form these neighborhood associations, address neighborhood issues, and interested residents should actually contact the planning department for more information. There's, I believe, funds available for people that are low income. They can get to fix their homes. They just need to ask the questions, and I think if they were to stop at planning, they'd get the answers. What do I do if I disagree with the new assessment? On August 11th through the 15th, we will be holding open book. This week allows concerns, the concern taxpayers, the opportunity to discuss their assessments with the appraisers. If residents are interested in attending, they should just, all they need to do is call the city assessor's office at 459-3393. That's a specific line set that we have for setting these appointments, and we'll be glad to discuss any of their questions or any of the assessments. And for those that want to go on and appeal their assessment, if they're still unhappy with the answers they get from the assessor's office and they want to appeal beyond that, they need to contact the city clerk's office. There's a complaint form that needs to be filled out and filed with the clerk's office, and then they will be given an appointment time as to when to appear. And the Board of Review will be convening on September 9th. And I believe that's pretty much all I have. There are some good resources out there. Excuse me, the Department of Revenue has a website out there where you can get property information guides for property owners. This is one that I just happened to print off, and it basically explains a lot of what I just went through. And do I have a few minutes for any questions? Sure, go ahead. Take one or two. Alderman Hammond. Thank you. Thank you for your presentation. And quick question, is that form available online for people that want to appeal their assessment? Can they go out to the city's website and pick that form up instead of coming into the city hall? Or can we make it available online? I guess it's a better question. I think absolutely we could, sure. Great, thank you. Alderman Boring. Thank you, Mayor. Would it be possible or is it helpful if somebody disagrees with their assessment for them to request somebody from your staff to come over and look at the property before they would come down to the Board of Review? We could make some arrangements for something like that, sure. I've already made that accommodation to a couple of citizens upcoming within the next week or so. Yes, if it's impossible for them to come down here and attend the open book or whatever, we'll find a way to work with them. We can either discuss it over the phone or if they would rather that we went through the property, we can do that as well. Thank you for those questions. And Lee, thanks very much for your presentation. We appreciate all the work that you and the department did on this reassessment of the city. And I think that helps the council and the citizens out to get more information on this. Appreciate it. Next, we'll move on to the public forum. Nothing this evening. Thank you. And then Mayor's announcements. Next week, Tuesday, we have an election coming up and the clerk has consolidated some of the polling locations. So please check their website to make sure you're going to the proper place to vote. Tomorrow night is our national night out. America's night out against crime. It's coming up at between 5 and 7.30 p.m. tomorrow. Things will kick off with events at Fountain Park including some food trucks, music, face painting for the kids. We'll have some law enforcement and fire department equipment on the site for people to examine. And then we'll mind everybody to turn their porch lights on on August 5th. And this event was brought to us by Countywide, Sheboygan Countywide Crime Stoppers. I'd also like to mention that the historic Wolf Olsen Post of 1230 on Union Avenue is celebrating their 90th anniversary. And they're going to have a celebration. I think everybody has an invite on their desk to attend from 1 to 4 p.m. on August 9th. And on September 5th, council meeting, we'll have a special election of the Board of Water Commissioners. And if anyone's interested, they should respond to Alderman Hammond to myself. And we'll get their names down as candidates for that election. And next, I'd just like to mention that last week there was a groundbreaking for the first of six new homes to be built in the Erie Avenue Revitalization Project. This project was started back in 2011 as a partnership between Habitat for Humanity, the Gateway Neighborhood Association, Sheboygan Neighborhood Pride, and the City of Sheboygan. And along the way, this project has also received some needed assistance from the Sheboygan County Treasurer's Office and also some financial sponsorship from U.S. Bank. The ceremony was a culmination of a longtime dream of years of hard work, mostly by city planning director Chad Pellecek. And he was assisted by three determined individuals from the Habitat for Humanity Lakeshore group. Dennis Ketterman, Tom Folly, and Greg Ryan were recognized on that day. They banded together with city staff to accomplish their joint vision. They believed that focusing the combined efforts of Habitat for Humanity and the City of Sheboygan on this one block of Erie Avenue in the Gateway Neighborhood could transform this neighborhood and begin to transform the City of Sheboygan. Dennis Ketterman is with us today. He's representing Habitat for Humanity Lakeside. And I'd like to have a step up and make a short address to the council. Good evening. My name is Dennis Ketterman, like you said, and we are really excited. I find it interesting that in working on this project, what was your opening statement tonight? Let's work together as a community group instead of against each other. Well, that is exactly what we're doing here. Bringing all these groups together along with Habitat for Humanity is a fantastic thing that we're doing. We could not do this project without the city, you know, doing all the things of purchasing the homes and demolishing them so we can put good, decent families into decent affordable homes. A couple of things you might want to know. This is going to be the home we're going to start putting up. That's the color of the families chosen. We have three basic designs and the porches can be moved on either side so we can have a variety of looks throughout the block. We also have different colors throughout the block. And just for your information, too, the community is going to be hugely involved with all the volunteers, corporate sponsorships. We're hoping to see some of you out there coming and giving us a lunch or maybe having a work day, something like that. But you also need to know that these families work hard for this. This family is going to have to put in 500 hours of sweat equity in order to get this home. They need to go through financial advisement. They need to work with Habitat with their family selection committee that is going to make sure they run properly through all the procedures going on and to make sure that once they're in the home, they will be taking care of it. The second thing they'll be doing is getting a non-interest loan for the cost of the home. So they do pay us back for that. They do give us a sweat equity so they're not just giving this home and saying thank you. And we just are so excited about the fact that we're making this block and this entry into Sheboygan look so much better and so great. And I thank Chad Palaszczuk for being a real sponsor of getting us all together and working on this. And not only this, but then our long-term project is going to extend beyond this block up and down the street north and south of those blocks too. So Habitat is super excited about being part of this. And we thank you for bringing this all together. Dennis, thank you very much for your words and also for being a great partner in this project. Appreciate it. Next we'll go on to hearings. 2.1 is a hearing for the proposed assessments for water lateral replacements in South A Street from Kentucky Avenue to Union Avenue. Is there anyone wishing to be heard? Is there anyone wishing to be heard? Is there anyone wishing to be heard? Alderman Hammond. Thank you, Mr. Mayor. Move to close. Second. Thank you for that motion. Any discussion? Seeing none, all those in favor, please signify by saying aye. Aye. Opposed? Motion passes. Next we'll go on to the consent agenda, including items 3.2 through 3.20. Alderman Hammond. Thank you, Mr. Mayor. I move to accept and file all ROs, accept and adopt all ROCs and put all resolutions and ordinances upon their passage. Second. Thank you for that motion. Under discussion, Alderman Boren. Thank you, Mayor. I would like to pull forward document number 3.2 and document 3.16 and refer them to the committee of the whole. Thank you for that motion. Under discussion, 3.2 and it was 3.6? 16. 16. Alderman Hammond. I'm just kind of curious why we would need to refer these to, one's a newspaper article that the entire council's had an opportunity to see when it was referred to committee. And the other one was an informational budget document that, again, the entire council got as part of Alderman Van Akron. So I'm not sure why these need to go to committee of the whole and when everybody's got the information they need. Thank you for that comment. Alderman Boren. Thank you, Mayor. I believe in the way this is worded for 3.2, Alderman Van Akron was, wanted this review during the upcoming budget process. It's my understanding that there may be a committee of the whole meeting next week that's going to deal with the budget. And on 3.16, that was an article regarding health insurance rates, a survey done by our insurance carrier M3. And when we discussed this at Salary and Grievance last week, we made a motion to file it, but I wasn't aware at that time that there was going to possibly be a committee of the whole meeting. And I think this is one of the topics that's very important during our budget discussions, and that is the health insurance issue. Thank you for that comment. Alderman Hammond. Thank you, Mr. Mayor. Not to be the dead horse, but duly noted that we received the article and it addresses health insurance rates. And we all know that health insurance is an issue, but I'd rather focus on our health insurance rates. Everybody's had an opportunity to read the article. Same thing with the information that Alderman Van Akron put together, which again, very timely. But I think his number one intent was to get that information to the hands of the council members, which this document does. I don't need to know that we need to waste time on the committee of the whole meeting just to file a document that everybody has possession of. So thank you. Thank you for those comments. If there's another discussion. Clerk will call the roll to refer these two documents. Five ayes, eight noes. Motion is defeated. The consent agenda again includes everything 3.2 through 3.20. Is there any further discussion? Seeing none, will the clerk please call the roll for passage on the consent agenda. 13 ayes. Motion passes. We'll move on to reports of officers. Items 4.1 through 4.6 will be referred to various committees. Under resolutions, resolution 5.1 is a resolution by Alderman Heidemann authorizing the advertising of bids for the construction and installation of a sanitary sewer in Whedon Creek approximately 1,300 feet west of South Taylor Drive and construction installation of a water main approximately 1,600 feet west of South Taylor Drive. Alderman Heidemann. Second. We have a motion and a second to suspend. All those in favor of suspension, please signify by saying aye. Aye. Opposed? Under suspension Alderman Heidemann. Yeah, I put the resolution upon his passage. Second. Thank you for that motion and support. The documents before us for discussion. Any discussion? Seeing none, will the clerk let's see we'll call that as a voice vote. All those in favor, please signify by saying aye. Aye. Opposed? Motion passes. Items 5.2 through 5.4 will be referred to the finance committee. Under reports of committees, 6.1 is an RC by finance to whom was referred resolution number 46 of 1415 recommending authorizing a transfer of appropriations in the 2014 budget to establish revenue and appropriations for Wisconsin Department of Public Instruction Grant for library services. Alderman Hammond. Thank you, Mr. Mayor. I move to accept and adopt and put the resolution upon its passage. Second. Thank you for that motion and support. Is there any discussion on the motion? Seeing none, will the clerk please call the roll for passage? Thirteen ayes. Motion passes. Item 6.2 is a reported committee by salary and grievances to whom was referred RC number 75 of 1415 by the committee of the whole who met and discussed charter ordinance number one of 1415 being subject to the home rule provisions of section 66.0101 of Wisconsin state statutes providing for the appointment of the city attorney in lieu of current method of election by the voters to such office under Wisconsin statute 62.09 subsection 3b4 recommends filing the documents. Alderman Dassler. Thank you, Mayor. I make a motion to accept and adopt and file the document. Second. Thank you for that motion and support. All those in favor of the motion, is there any discussion first of all? All those in favor of the motion, please signify by saying aye. Aye. Opposed? Motion passes. I'm sorry. Nay. I heard a nay. Item 6.3 is an RC by salary and grievances to whom was referred charter ordinance number one of 1415 being subject to the home rule provisions of section 66.0101 of the Wisconsin statutes providing for the appointment of the city attorney in lieu of the current method of election by the voters to such office under Wisconsin statute 62.09 subsections 3b4 and resolution number 43 of 1415 providing for the submittal of substitutes of charter ordinance number one of 1415 to a referendum of the voters recommends that resolution number 43 of 1415 be passed incorporating the attached subs of charter ordinance number one of 1415. The change in subs of charter ordinance number one of 1415 makes two changes to the original proposed charter ordinance. First, it increases the municipal experience from two years to three. Alderman Dassler. Thank you, Mayor. I move we accept and adopt and pass resolution incorporating the subs of charter ordinance 1-1415. Second. Thank you for that motion and support that's on the floor for discussion. Alderman Coss. Thank you, Mayor. I'm going to be a no on this resolution also. I feel as Alderman we're elected to make the most important decisions at City Hall. I feel this is a decision that we can make as a body. Thank you for those comments. Alderman Coss. Alderman Carlson. Thank you, Mayor. I also will be voting against this. I think it's quite ridiculous that this council can't make a decision on this. There is no outcry for a referendum. It's a pretty easy decision. It's pretty common across the state and across the country. We do get paid the big bucks and I kind of say that tongue in cheek, but we are here to make decisions on behalf of the city.  Thank you for those comments. Any other discussion? Seeing none, will the clerk please call the roll on passage. Ayes, 8 noes. A motion fails. Item 4.6 is an RC by the finance committee who has referred RO number 75 of 1415 and recommends referral of a claim from Wallace Hahn for alleged damages to his vehicle when a rock flew from the parking utility lawnmower into his windshield. Alderman Hammond. Mr. Mayor, that's just a referral to parking in transit. Next is item 6.5 an RC by salary and grievances to whom was referred RO number 27 of 1415 submitting a notice of claim filed on behalf of Jeffrey Herman and recommends that the claim be denied and to direct the city attorney to send a notice of disallowance. Alderman Dassler. Thank you, Mayor. I move that we accept and adopt. Second. Thank you for that motion and support. Is there any discussion on that motion? Seeing none, all those in favor, please signify by saying aye. Aye. Opposed? Motion passes. It's laid over. Resolution 44 of 1415 by Alderman Heidemann, Boren, Bellinger, Thiel and Van Akron being a relocation order of the city of Sheboygan, Sheboygan County, Wisconsin. Alderman Heidemann. Thank you, Mayor. I put the resolution upon his passage. Second. Thank you for that motion and support. Under discussion. Okay, what this resolution has to deal with is putting sidewalk in places where previously there was a sidewalk. Thank you for that explanation, Alderman Heidemann. Any other discussion? Seeing none, all those in favor, let's see we're now have to do a roll call vote on that. 13 ayes. Motion passes. Next is other matters, city attorney. Thank you, Your Honor. 8.1 is an RO by the city clerk submitting communication from Ryan Noel Zimmerman requesting a waiver for the sex offender residency restrictions in order to live at 1032B Lincoln Avenue. That will be referred to public protection and safety. And 8.2 is an RO by the city clerk submitting various license applications for the period ending June 30, 2015 and June 30, 2016. That will be referred to the law and licensing committee. Next item we have on the agenda is a closed session. Alderman Hammond. Thank you, Mr. Mayor. I move to convene in closed session under exemption provided in section 1985 1G of the Wisconsin statutes for the purpose of conferring with the city's legal counsel who is rendering oral advice concerning strategy to be adopted by the city with respect to litigation in which it is likely to become involved. Re-claim of Jeff Herman. Second. Thank you for that motion and support. Would the clerk please call the roll? Your Honor. I'm sorry. Go ahead, city attorney. Yes, council. This was put on in the event the council wished to discuss claim 6.5 and the claim of Jeff Herman, the recommendation from the salary grievance was to deny the claim and file the notice of disallowance which passed all eyes. So it's up to you whether you still want to go into closed session, but that was what the purpose of this discussion was for. Alderman Hammond. I would move to withdraw my motion. Second. Okay, motion has been withdrawn. Next on the item is adjournment. Alderman Hammond. Move to adjourn. Second. Moved and seconded. All those in favor of adjourning, please signify by saying aye. Aye. Opposed? We stand adjourned. Thank you very much. We've heard. We're about doing everything.