So it's now 10 o'clock. Welcome to the Packet Hacking Village Talks. Thank you so much for starting your day and your morning in DEF CON with us here. So if this is where I see a lot of you folks here, this is your first time here at DEF CON. And so you may be asking, what do we do here at the Packet Hacking Village? What's our mission? Our mission here at the Packet Hacking Village is on security education. It's to inform people and to be aware on a variety of broad range of items in security. And on a personal note, for me, when I first started, as I said earlier, when I first started coming to DEF CON in 2006, the Wall Sheep and the, well, which is now the Packet Hacking Village gave me all the foundation on networking and security that I never got out of college. So that's our mission here is on security education. And for the whole duration at DEF CON, we'll have a number of events and learning out our activities at the other end of the hall. But without much ado, to kick it off our talks today, we have a fantastic talk that epitomizes the spirit of what we do in security education. And when we were actually doing the CFP, we looked at the talks and I was like, this talk got to start off, start off the Packet Hacking Village talks. And without much ado, I want to give the warmest and warmest welcome to Tom Kopchak and Dan Borges of National CP TC. So Ming, thank you so much for the opportunity and for the warm welcome. It's a privilege and an honor to be here and have the opportunity to speak to everyone. So thank you so much. And we have a lot of exciting stuff to share with you in this talk about the crazy things that we do that consume all of our lives when we're not working and a lot of our lives when we are working. So, yeah, absolutely. Without that, let's get started. All right, guys, so we have a lot to cover today. First, we're going to start with what is the National Collegiate Pen Testing Competition, CPTC, and really what makes it different from a traditional CTF. Traditional CTFs are very technically focused and you're going to see we are technically focused, but there's so much more to this competition. And then we're going to get into some of the technical details. How did we put this all together and build this amazing competition year after year? Yeah, and then we're going to go into some of the technical detail about how we hack together this competition, what we do to build the environment and make it interesting for everyone who's competing. And then we'll talk a little bit about the data that we collect and what we contribute to the research community at a whole. And we're going to end the whole thing with a call to arms. We're really trying to get a lot of people involved. This is a product of the community. Kind of like Ming said, we're trying to further education and we really want to get that feedback from the community. So what is CPTC and why is it different than a traditional CTF? Just from a mile high, a traditional CTF focuses on technical skills. There's usually an objective and a very clear challenge and you have to do some kind of hack to get through and deliver that flag or whatever. In CPTC, it's much more open-ended. We have tons of vulnerabilities and it's how you express those and communicate those to the client that makes it different. Yeah, so how many of you have done a CTF before? Okay, that's good. I know that I see some people have competed in CPTC before, so welcome. The thing that we really try to make this is different than a CTF and we're going to go into a lot of detail as the things that we do that make this more relevant. But the formula that we have on this slide is really something that I like that captures the spirit of CPTC. We take offensive security. We use pentesting as the vehicle to teach security. We build a custom environment with custom tools and custom products and even commercial products as well to replicate a business. Add in the business element, not just the technical but the non-technical aspects and then you get CPTC. So that's our formula and it's worked really well for teaching the skills that we're hoping to do. So just a little bit about us, like why are we up here talking about this? For CPTC, I'm a director of the OSINT and the World. You'll see what that means later, but we try to make this as holistic and realistic as possible. In real life, I'm a senior internal red teamer, so I have experience doing this and delivering this kind of information to clients. And then for me within CPTC, I run the white team, which is basically the rules and making the competition exist sort of group. I work with a couple other members of the advisory board as the core group to build the competition and direct how it's going to operate. And then I also run the monitoring team where we collect data for research purposes. And in real life, I direct a team of splunk implementation engineers at Hurricane Labs in Cleveland, Ohio. And the common theme that I really like between Dan and me is we both have the opportunity to work with clients in our real job. We have to be able to explain things that are technical to non-technical people and also really the things that we do in real life apply directly to what we do in the competition. Now it's not just us. There's two of us here and a much larger village that makes up the entire competition. So this is a picture of some of our advisory board that works together to make this competition happen each year. And as we've said before, there are a lot of crazies that build this together and dedicate a ton of time to make it happening. And then on the competitor side, we have tons of schools that play and every year we get more. So there's 50-plus schools that are registered right now for the 2019 season and we're actually expanding internationally. So we have some schools in Dubai registered as well. The regionals are massive. I think last year we had to host upwards to like 30 concurrent environments. So each school that plays gets their own environment. Yeah, and the other thing I'll say is as of right now, we're wait-listing pretty much every region except New England. So if you know anyone who can get to University of New Haven who wants to compete, there's still some spots available, but otherwise the wait-list is pretty much the only option. And we're looking at expanding that and handling it more better next year. But to get to the meat of the talk, at this point you're probably wondering a little bit more detail about the competition. So let's get welcomed in by the Stanford team that won last year that are pictured here on the slide. So why does CPTC exist, Dan? Go. So CPTC was actually the brainchild of Polstack Pol and Bob Kafka. And this was about what five years ago they thought this up and there was just this need in the industry to address offensive security as well as teach like more of a holistic approach to security. Yeah, and the big thing that we wanted to do is find a way to take industry experience and turn it into a relevant event that everyone can learn from. So the advisory board has been the core group in turning this into something that really reflects reality and what we deal with professionally. And then we also wanted to make this competition something that wasn't just small. We wanted it to be something that could expand. And as we've grown, including this year, we've grown internationally. So it started a couple people who showed up in Rochester in the middle of October, which is a beautiful place to be. And it's expanded to five concurrent regionals in the U.S., one in Dubai, and then an international competition of the top teams. So I know I asked how many of you have done a CTF and that was pretty much the whole group. So CPTC is different. It's not a CTF. In fact, it's a competition named only to the point where teams compete, but the goal that we want everyone to win from is to learn something and to be better prepared in the industry. So we have awards that we give out that are specifically for highlighting things that teams do well or relevant skills that we want to teach. So they don't necessarily know they're competing for that, but we like to highlight things that teams do. Additionally, when you're interacting in the competition environment, we don't want you to talk about it being a competition. In fact, if a team says something to one of us, like in the competition, we're like, what do you think? This is some kind of game? We'll talk about how in-character and out-of-character behavior happens. But our emphasis is when you're working with a client, you're not going to be referring to that as a competition because why are they competing to try to break into your domain controller? That's not appropriate. That's not how you handle it in business. Yeah, like Tom says, the things we score aren't direct, like flags or hard results in a traditional CTF. What you do is you find the technical vulnerabilities and it's how you present those to the management team that really makes the difference, which we don't normally see in CTFs. Yeah, exactly. And CPTC really should be a professional consulting engagement where you are hired by our client to perform a pentest, deliver a report to your management, and also work with them to get the problems fixed. So you're doing a security assessment for a real-ish company that we create and the important thing is it's not your smash and grab, try to score as many points as you can sort of scenario. If you find every single vulnerability, spoiler alert, you won't. But if you do, you won't win necessarily because you still have to communicate that clearly. And it's really the good analogy that we have for this is you're performing surgery on the network.   You have to try to fix the problems with the patient and make sure they still live to tell another tale the next day. So again, how are we different than a normal CTF? Our machines don't have single vulnerabilities. We put multiple vulnerabilities in each machine, and then the machines are all interconnected. So there's not one attack path that lets you own the network. There's multiple attack paths. And what really makes CPTC different is showing how the vulnerabilities in these systems not only can be used to get domain admin, for example, but can be used to leverage against the goals of the business. So you'll see we have very goal-oriented competitions. Like the business will be a voting company or a self-driving car company. And how can you impact that business model, not just take over all the machines? Yeah, exactly. And the vulnerabilities that we put in here are not necessarily always planned. And I would say we spend less time these days actually trying to come up with a tax scenario as opposed to just having realistic problems built in. So we may have weak passwords that exist. We may have configuration issues. There may be configurations issues that allow you to get access to a system that allow you to find more information that you can use somewhere else. So we build in some of that, but there is just a ton of vulnerabilities. So we guarantee that all the teams will not... Even not one specific team will be able to find everything because we won't be able to find everything. And teams need to understand the significance of the environment and what each system is doing during the event. We don't tell them what the significance is. You walk into a company, you have to figure out what's important. You know what the business does, but you don't necessarily know why each system is there. So you have to figure that out as you're doing your assessment. And then when you ultimately present to your executives and give that reasoning as to why this is important, why you should care, you do have to consider the risk to the company. And that's something that CTF doesn't often capture. And the other thing is teams have to consider that they are operating in a business environment that's doing something and is producing whatever that company is doing. So like when we did the election theme, there were elections that were running. You couldn't take down the servers that were collecting votes because then there's not going to be votes that are collected. Same thing for the autonomous vehicles. When you cause a car to crash, that's really bad for the company. So you don't want to do that. So teams have to consider their impact to the business. And that's something that you don't have to do in most CTFs. But as Dan, you can definitely say when you're doing internal red teaming, you can't break the company you're testing. It matters so much. You don't understand this stuff until you get into the real world. But the relationships between these people at these companies matters more than the vulnerabilities. That said, we do have technical vulnerabilities. We have a ton of them. The competition really is split 50-50. Half of it is technical. If you compete, you'll probably want to take a picture of this because these are like real. And you'll see, you see the host column? We have multiple ways into each system. And then these systems are all interconnected. So you might get creds from one system and then move laterally to another. And that's the goal, right? Show us how you exploit the environment. Yeah, exactly. And I see some of you are taking pictures. The CIA did get a hold of this slide ahead of time. So some of that's a little bit redacted. But it gives you a general idea of how we break this down where we have hosts that are having various vulnerabilities and services that are configured incorrectly. And a lot of this we actually build as teams are producing their reports. So we have an idea of what's messed up and what we planned out. But teams will find things that we don't necessarily plan on being there. The environment will evaluate it and make sure it's actually a real vulnerability and then add it to the scoring system just because we don't expect something to be found. Not a problem with that. So the other thing that we really find important to teach is soft skills. And as we've said, technical is not everything for this competition. The team deliverables are as important as the findings themselves. And that's the way we design the scoring absolutely by design. So the reports, we score them based on how the findings are presented, how you relate that risk to the business, and how someone who's a manager can identify this is important, these are the things that I need to present to my team, as well as how well you explain and help the technical people fix those problems. Because that's what you want in a good pentest report. And then we also do presentations. So at the national event, and even actually at the regional events now, we give a presentation to an executive team. And they need to talk about how it's, the things that they find in the environment are relevant to that team. And we think about that from the perspective of you're walking into someone that had hired you to perform a security assessment, and how do you approach that? If you do something and say like, boy, your IT team really sucks, your customer is not going to like that. And those are sorts of things that we take into account when you're giving that presentation. And I love the fact that we bring in industry professionals to do that.  So it's not even us creating the presentations. It's people from the industry that, you know, get these presentations delivered to them often. And then we look to them for feedback too. And the other thing that we added, and we'll talk about this on the next slide, but we actually have the coaches participate as well in part of the scoring. And that's one of the mechanisms to ensure that there's fairness for that, and you know, they're not skewing scores in favor of their team. But we wanted, when coach came to us and said, hey, we want to get, learn more about what teams are doing so we can teach this better in the classroom. And I'm like, absolutely let's make this work. And an hour later it was part of the competition. So like we said, education, that's our goal. I would say actually only one team can win. We understand that, but every team can learn. And that's absolutely our goal. We're here to the packet hacking village, where we all are here to learn something. And CPTC absolutely tries to do that. Yeah. And you know, we've been talking about business all this time, but we absolutely try to teach technical skills through this competition. Even the volunteers, like I learned something every year I do this. We build new tooling, and we always push ourselves and we push students. Sometimes we even have like tears of the environment. So we'll have like easy network and then it gets harder and harder. So I think there's really something that we're going to learn here, both on the soft side and the technical side. Yeah, absolutely. And really the fundamental thing, as I've been saying, is you're learning how to be a consultant and work with clients. And nothing else that we've been able to find provides that experience to people who are in a collegiate learning environment. So I've had, even walking up here on the elevator, someone who competed in CPTC stopped us and said it was the best experience that we had learning how to do this and prepared me for the real world. So I just love hearing that feedback because it means we struck a chord and we're doing something right. And we just want to keep on making this better. So to kind of move on to the next section, let's chat a little bit about what we do to build this environment, how we hack it together, and what we do to make the environment realistic and also pretty complicated. So I kind of mentioned this before, but the business goals drive a lot of the infrastructure. So in 2015, we were just kind of getting started. We had a corporate network. We had a production network and like some several web apps. 2016, we really started getting thematic. So we did healthcare and their high availability is the point of the systems. We had to maintain patient confidentiality and high availability of the systems. From there, we moved on to elections. Elections was actually pretty funny because we made a mistake and I think every team got domain admin within like the first few hours, which yeah, like that sucks for us, but that's also kind of realistic. Like sometimes that happens. Pentes team comes in and they just roll the environment in the first few hours. So the reason for that is we screwed up our build and didn't clear Bash history. But that's something that you would find in an environment and although we didn't plan on it, it was something that happened. That said, the teams that took that and did a lot with domain admin were the ones that were very successful. The teams that said, hey, we got domain admin, yay, look at us, they could have done a lot more. Yeah, it was such an interesting year because now every team had domain admin, right? The playing field was leveled and all of a sudden it became well, how can you impact the business? What can you do with all that access you have? And elections, that was very difficult because we had all kinds of cryptographic verification. So they had access to all the systems, but now they had to start analyzing crypto systems. And then last year, we did autonomous vehicles, which is the wheels company.  And the students had to figure out that kind of microservice architecture. Yeah, so now we'll get to this year. So we've been spending an insane amount of time coming up with this. In fact, we had a meeting over dinner the night of the 2018 national conclusion, where we started planning this out, debated it internally for quite some time. Almost every flight that me and some of the other advisory board members have been on, we've been writing up drafts because we can't find time to do this any other time. But we've been spending a ton of time working on this and trying to build something that's relevant and coming up with ideas that are appropriate years in advance, not necessarily years in advance, but months and months in advance. I think what we've chosen, especially given recent news, is very appropriate. Now I'd say we had nothing to do with the recent news, so don't blame us for that. But here we go. DinoBank will be our 2019 theme. In fact, we have a logo. But we'll give you a little bit of information about DinoBank, but we think this is something that's going to be incredibly relevant and expose students to an aspect that quite frankly, security needs to be improved for a lot of industries, as we've seen with some companies and some issues recently. So...  And that's the goal here, is we want to get students to this experience that dominates so much of the field. So DinoBank is going for their memorandum of understanding. They are trying to become an official bank and they need a pen test to do this and then they need to remediate their vulnerabilities and basically have a clean bill of health. That's what we are... We want to bring the students in to do that financial pen test for this bank. And we've seen incredible growth in this event. So we added an international region in Dubai in 2019 and we're looking to continue expanding that to larger opportunities and involving more schools. And we want ultimately everyone to have an opportunity to compete in this and for interested. So we're going to find a way to make that happen. That all said, we're actually already working on 2020 and planning that out and we're partnering with a major company who's dedicating people to help produce it. So this is going beyond just the crazies of us who take our experience to actual companies that are dedicating resources and full-time people to help us build the environment. So that's all I can say right now but we're planning on making it the most awesome and interactive environment yet for 2020 as well. So we're looking forward to come and it'll be exciting. So we kind of talked earlier about like technically what goes into these environments. Alex and I talked about a tool last year at B-Sides LV called LaForge. Basically these environments are so complex that we had to generate custom tooling. LaForge is a really interesting tool and you can go back to that talk but essentially what it does is it allows us to design one competition environment and then we can scale that up and then here you see not only do we have rich networks with interconnected hosts that transfer data between each other but we have apps that rely on each other and that's kind of the voting components there and you see a little bit of a microservice architecture where these apps are shooting data back and forth. And then not only do we have fake not fake but infrastructure we have people so we generate hundreds and hundreds of fake employees some of them we role play as during the competition but the majority of them are just going to be like data or employees of this company that make it look and feel real. One of the things I really liked about this 2017 voting app stack is just the layers of complexity that exist in there. Teams thought that they could modify votes by just looking at where they were initially recorded and yes that was basically a database server that was very unprotected but what they didn't necessarily dig into is some of the cryptographic signing that we did. Now it was a terrible, terrible cryptographic signing mechanism based on like RGB colors or something ridiculous but that was something that I think one team actually managed to figure that out. And that was awesome to see them dig into that and really see what we did so a lot of this stuff is something you can figure out but we want to try to make it something you just scratch the surface there's a lot more to it. And that really helps us differentiate the teams in terms of how good they are at sorting out complex problems that we throw at them. But let's just say you wanted to build a CPTC environment. To help you out we created the simple diagram to explain what goes into one of our environments. But this is actually from the Forge. The complexity here is unreal. This is a graph of all the objects at the end of a Forge build. Really at the top is where we design the competition and then the tools scale this out and this is just like at the end of the day we have hundreds of thousands of objects in AWS and they're all related and we couldn't build it without tooling. So here's an object model that the tool generated when we were done to show you the complexity of these environments.  This is a diagram from our 2017 event and you can see there's multiple networks. We have a mix of Linux and Windows hosts. They're all doing different sorts of services and they interact in different ways. And some of these networks you have to get through from openings and other hosts. So like you may only have access to the networks on the left side initially until you get a foothold in one and are able to get into the networks on the right side. Like some of my favorite techniques is a pentest or a lateral movement. So you may find a vulnerability on one system and you can't get into another system but if you could reuse creds and laterally move then all of a sudden you have white box access to that system and you may find vulnerabilities in source code or something. Yeah and then separately one of the things that we do besides the technical side is the world and Dan has done some amazing work on building this and making it something that is really a signature element of the competition I think. At that time making the company exist we have social media that we create for the company's employees just like you would if they were a real company. And then we see the environment with all types of information that can be used to help the teams out. Yeah this is my baby. The world building team started as an OSINT team where basically three months before the competition we wanted to build out all these personas and then put them online and let students in this company and start to build this idea of what they were going to be attacking and we just took that to the extreme we made these people so realistic that then we started role playing them in the competition we started adding like storylines like I think last year we had an insider threat scenario so and the pentesters discover this as they go through things they find logs like hey this isn't right there's malware on this box and then they start to put together this like story that we're building and they're like oh I was planting malware in your environment so it's really cool stuff and the other thing I'd add is we found in a lot of CTFs you might have like a wiki server that just runs media wiki without any content in there it's like so you get into wiki server but oh well our wikis have content that you can use to understand how systems operate they might have details about configurations that you won't find anywhere else and you can use that to piece together on another attack path or get some more information about context for the systems so we have a lot of things that help give teams some ideas about what to do and then they can run with that and discover some more interesting vulnerabilities or issues so like we were saying we build these stories on the left here you can see one of our OSIN stories where we set up an entire fake online forum like hacks forums or something and then we had guys basically leaking PII and intellectual property to this forum that we created kind of talking smack on the company thinking they were the brains and you know the company's no good and they could do it themselves so you start to build this story before you ever come into the competition that like hey you guys have data leaking on the internet you know something something's not right here and then on the right you can see that they do leak their API and points they do start leaking documentation and one of the other goals here is we're giving the students something to research before they get into the competition so the idea is they're not coming in blindsided they kind of know some of the technology that will be in place they kind of have a good idea how to hack it before they get there there's actually really cool I had the opportunity to stop by where stanford does their team meetings and they had on the wall like printouts of our stuff that we put out there and like lines between it was awesome to see that and I'm like yep that's right that's right you missed that one and just kind of piecing that all together so that was a good time also we sometimes produce applications with custom APIs and sometimes actually remember to document it and sometimes if we remember to document we find these weird endpoints that we put in our APIs like something that'll just arbitrarily run whatever command you want which is a nice feature but you know it's not unlike normal IOT firmware where things are just horribly broken so yeah backdoors exist and we will create them into our app sometimes and teams get to discover them and then like we were saying before these apps are all richly interconnected so here you have a database host but the database actually supports the chat for another application so you know the students have two ways to get to the information they can either log into the chat server directly access messages or they can hack the database and get to the messages that way and like in the case of the wheels environment we had databases that were full of car data that you were able to just find and like that is personal information that shouldn't be something that someone on your network can just get to likewise our emails actually contain emails and those emails have information and stories about the company that you can get some more information from and then chat I love the stuff that you do with this too yeah in in chat like again as you get access to credentials and users you will find more and more of the story it will start to unfold and then we also start to like create internal politics so you know certain users are resistant to the pen test they don't really want it to happen other users are kind of fighting for the pen test they're championing the project so that kind of matters as a pen tester who you're talking to in the company right like who has your back who really wants you there and we think that stuff matters yeah so next you want to talk a little about the role playing that we do so it's not just teams show up and they do a pen test and don't have anyone to interact with Dan me other members of the advisory board all play roles in this environment and students are expected to interact with us as if we were industry professionals or maybe not industry professionals but customers and that is something that you don't get exposure to outside of this competition but it's modeled based on what we experience in real life at our jobs so we interact with students and character throughout the event so we'll walk into students rooms like we're the director of the security or if we're I don't even remember what you've been the past couple years but director of incident response and they've triggered some alert and I come in screaming is this you or you know is this us yeah so you know what I think let's do a run through of what this looks like so you're gonna be director of whatever you want to be I'm gonna be a pen tester okay okay I'm packing away I don't have the ski mask on so hey you guys attack the dot seven system no that wasn't us are you sure it just went off line and we're just trying to make sure that you know it's it's nothing on the network no no no that's us okay okay so that's an example of a bad interaction and we've seen that from teams so let's do an example of another one okay hey what's up Dan we just had the dot seven system go offline oh yeah it's a patient system we were just wondering did you guys touch that you know let me check with him I'm not sure if that happened but is there someone on your team that's tracking that that we can talk to tell us at our normal mail when you figure out and then we can resolve the details of it okay great you know I'm gonna have some of my team work on that to try to figure out what's going on I don't know if that's us I can't say if that's anything that's happened yet but we're gonna investigate and we'll let you know what's going on so let's work together and get this resolved yeah I really appreciate that awesome thank you cool that's an example of a good interaction so we've seen examples of both so and then we also try to have like physical competitions too so in this one it was really cool we brought all the students into a room and we had kiosks and they had to kind of like break out of the kiosks which is always a fun competition and then they could take it to like ad infinitum the kiosks had a machine behind them they could shell that machine get callbacks to the room like stay persistent in the kiosk network and you know some teams didn't even realize they could break out of the kiosk yeah I really love the hands-on element of this and there were teams that you know basically took the kiosk and had them being able to execute commands on that back in their room and some teams that didn't necessarily even realize that there was this operating system there so I like the opportunity to expose students to something that's different and kind of make it a little bit more complex than just VM in the cloud somewhere so bringing in the physical element making you have to travel to on-site engagement have a little bit more experience of what that entails and how you should prepare for it so next I want to delve into a little bit of the competition data that we collect and our methodology for that and some of the research that we're driving behind that so one of the big things we've been able to conclude is that hackers like typing LS in fact 13 some percent of the commands type last year were LS you can also see some people's favorite combinations of LS like LS LA is more popular than LS AL so these are very important contributions that we're making with the data that we collect there you go we have someone who feels very strongly about that so get a team get them all the type it that way and then you'll be able to change the future so joking aside some of the monitoring is some of my favorite stuff like we run like splunk alerts and then also like we collect like LS query data and we'll have like bash history so we have this really rich monitoring in the observation room where we'll show like commands that recent teams are running not just like statistically prevalent stuff because that isn't the interesting stuff but yeah we'll do like what is the best end map command who's generating the coolest payload like all kinds of weird stuff yeah and we we actually do a ton of monitoring in the environment and it's for two purposes competition integrity and also for research so after the competition ends researchers are pulling over or pouring over the data set to get more information about how systems are attacked and what it's like to be on the attacking side and the targeting side because we collect both sides so some of the sample tools that we use we have IDS and all the hosts both on the attack side and on the defense side we have smoke universal forwarders everywhere forwarding to a central environment collecting data we use OS query sysmon monitor log files you name it we'll collect it and we try to make this entertaining so we will provide real times graphs and charts kind of like that well she does with credentials but we want to see what's going on in the environment so we use our tools to do that one of the interesting things that we found actually just analyzing IDS alerts and how many are generated by each teams the winning teams at the bottom were actually the ones that generated the fewest amounts of IDS alerts so that that speaks a lot to us where you're not just scanning and generating a lot of noise in the network you're identifying something and then you're actually digging into it yeah exactly and this is a lesson that I've seen in real world pentesting um flowing doesn't really help you in pentesting kind of wildly scanning, definitely information gathering and doing research but then you really are executing like explicit exploits very targeted specific things so throwing around tons of scans isn't going to really help you explore the environment other than recon so the data set is public anybody can download past data sets and they can do their own research we just hope that you attribute it back to us and then we are also doing research so one of the things that our research team devised is they basically found that the techniques that teams are using to access these box do map to the MITRE attack framework and they're building full kill chains to kind of show this is how a team moved through the environment um so that's ongoing research right now yeah and some of the stuff that I've seen is really awesome where they have actual log data from whatever host like the host where the attack is run so we see an attacker runs this command and then this results in this process being executed on this target system and nothing else really provides the information of what an attacker is doing using log data as well as what the target is receiving uh plans for 2019 is to expand this even more and make it closer to all of our development processes where everything that can produce a log will get logged and grabbed and then I'm hoping to make the data set that's publicly available next year actually have frozen splunk data that you can just put into a splunk instance and run your own searches on as well so that's the long term goal to make that really something that's accessible to anyone who wants to do this sort of research and make CPTC the vehicle where we can do that we've also released our tools so LeForge is open source if you want to check that out and try to build a similar competition and we've talked about releasing LeForge config files so that way teams can stand up their own environments it hasn't been something that we've gotten to yet but every year we really push for that and one of these years we're going to have like a plug and play environment that schools can stand up on their own yeah exactly and the other thing that we've done is we're trying to have teams contribute more to the just the general security community as a whole so one of the new additions in the 2019 rules is actually allowing teams to stage their own tools in a repository that we provide they have to be able to explain how these tools work they have to have them document it and they have to be able to make them something that other teams are able to use and other industry professionals are able to use but we want to remove the veil of secrecy for a lot of this we want teams to be able to make contributions to the security community and UCPTC is the vehicle to do that and if anyone wants to do any work with the data set you're definitely encouraged to do so the only thing we ask is that you at least attribute it to us as where you got the data so we're just going to cover some quick success stories this is really the point of the competition is the students and it's the people coming out of it and we've had so many amazing people come through this program so we're just going to kind of rapid fire through these and highlight some of this and again the whole point of this is for education we're trying to get more people into the field these are people that are already passionate about it and we're just trying to guide them to you know be more successful when they leave school yeah actually going just going back to that we saw a need and talking to people in industry we saw that there are opportunities that people need to have to learn the skills that employers demand and a lot of students come out of college very strong on the technical skills but they don't have an opportunity to learn the business skills especially in a lot of the technically focus programs and just having a bunch of students walk up to me and say CPTC was the best thing that I did in college that's just awesome and we hear that quite a bit and everything that we're trying to do is supporting education and make things better and make students better at what they do so we've had students land jobs through CPTC and quite a number of them have said just this alone was what I was able to say is that the big experience that got me that and then Stanford's team actually reported a zero day in a real application and they were working on getting that resolved but it's the great example of something that we definitely didn't plan and being in the environment that we were able to reproduce once they told us what they found and that's another good example of good reporting where looking at the report we were able to understand what the issue was and validated in our environment so to wrap up call for action yeah this is really only possible because of volunteers like we saw we're passionate about this stuff and we saw the need and we know there needs to be more people in the industry so we commit our time to trying to teach and make this better and really we need more people like it's Tom and I and a handful of other people and we could really use volunteers we have so much work and it's such a good cause so if anything here struck a chord with you please reach out to us and you know there's just tons of work to do yeah absolutely so call for action be an influence in helping the next wave of cyber security professionals help support us if you think that you're able to do it start a team encourage students that you know to become involved or compete we're also looking for people to help us run this year's event not only from a helping build the environment to also helping with some of the scoring that we need to do and the grading and all that because it's a pretty big undertaking and as you've seen there's a place for everybody at all levels right we have non-technical positions we have technical positions so really anybody can help and that's what it's all about is collecting that industry experience and trying to put that into the competition yep absolutely so I'll leave this last slide up with our contact info we have a form on the website for sponsors if you're interested in not sponsors but for volunteers you know sponsors too if you want but you can reach out to any of us additionally we're going to be speaking with a bigger panel of the advisory board at ethics village at four o'clock on Saturday so tomorrow and we're going to dive into some of the ethical issues that we've run into while teaching pentesting and have a wider panel discussion with our group as well as having more audience participation so if you like what you see and want to learn more stop by there if not we'll open the floor for questions I also have CPTC stickers up here if you want to grab any of those but thank you all so the question was for those of you didn't hear there's a lot of custom information and artifacts of data that exists in the environment how is it created a good amount of it is hand generated right now we set up the systems in advance and then we kind of enter the data and then we scale that across all the teams but we do clone like a bunch of pages or documentation if we're trying to build documentation very fast and then things we're getting into this year on the world in osan team is we're starting to get into like deepfakes and creating images of people putting those like totally like normally we go and we steal images or whatever but totally unique creative images and then putting those like in places with other people and then same if we could ever do that with docs and generate real ish enough docs that are relevant because what I don't want to do is just have tons of red herrings right I want it to be relevant but great question great question thank you and the other thing we have to sort of kind of deal with is there are personas that we create for us so like I have an identity in the environment that's not my real identity but it still is a version of Tom for example and Dan has the same sort of thing so we have to create a separate persona that we can use in the environment and play that in character but we don't want you to also be like confused by our real job so to speak so the question there was how do students land jobs through CPTC so we have a lot of industry sponsors that help us either through providing expertise volunteers or dollars and they have opportunities to interact with the students as part of the competition so they some of them will have the opportunity to interact as a role player in the environment and they actually get to see the students operating professionally or watching presentations but we also have career fair type things where teams have a couple hours to meet with the sponsors and have conversations like that it's not like it's not a competition in the sense that that's why we throw it we throw it for education but man the winning teams like the second they get off that like podium and in the announcement the sponsors come up to them offering them jobs it's pretty insane so the question there was have we thought about deploying a version of this as a honeypot so it's a great idea now we have that's a really good idea and especially with the data that we're collecting I think that could be really awesome it's very expensive to run all the infrastructure you have like our daily burn rate so we have had to secure so our cloud provider that we use is very much dependent on what cloud provider gives us enough money so we switched between Amazon and Google and other just depending on what's available but I think actually Lucas you could probably tell us an answer on this but it's probably like five to ten thousand dollars a day for a region so obviously that's if it's sponsor money it's monopoly money but we still gotta be responsible about that so but we're also looking at the ability to take this and maybe you throw it on your own ESX server and use LaForge to build it so you don't have that cloud cost yeah yeah it would be if anyone you know cloud providers that can give us a lot more dollars you know we can make that happen so the question there was when should teams start OSINT and when should they stop so OSINT hasn't started yet this year it will probably start around mid August I usually start after DEF CON and basically you start stop probably the week before the competition I like to have everything leaked the week before but you know if we run late it could be up to and there will always be some kind of technical finding so there will always be something you can use in the environment and it may even be a case that you don't necessarily know what a thing is called in the environment like a custom tool but you'll see something like that in a server you'll see a web page for something and then you can potentially Google that and get documentation for it or there might be another path to get that through social media as well so the question for that was have we had any success stories scaling the data set down to a high school or a non-profit level and I would say a lot of the research has been more generic right now in terms of like business miter framework type stuff that's a really interesting point the thing I would say is probably a little bit more challenging is it's not necessarily designed to show a certain thing where like some of the other exercises there's a clear path you know something exists in the log file a lot of times our researchers are taking a team's report knowing they discovered something and then trying to find that based on a much wider data set so it's probably more sophisticated than a lot of that but I think once we identify examples and then maybe even write it up in a way like you can download this and find this sort of thing that'll make it a little bit more accessible but it's a lot of data right now so I think last year the raw data collected was like 350 gigabytes of data in like 8 hours of competing time so it's quite a bit and we're probably going to be seeing more than that this coming year and then even analyzing that you have to stand up huge Splunk instances yeah so we do use Splunk for analyzing the data that makes it pretty easy but we're trying to make that more accessible in where if you only want to look at a certain like windows logs for example we want to make it so you can just download that throw it into Splunk let it churn away and then do something with it so I think that approach is going to make it easier for like what you're saying high school level, college level because if you're a college professor and you want to look at teach students how to work with windows logs when an attack is going on you can download the CPTC windows log index index that into Splunk run searches on that do reporting all that kind of stuff so that's kind of my long term vision for what we want to do this coming year but I think that will probably be something that could help for what you're looking to achieve but yeah hit us up or grab contact info here and we can chat about maybe some ideas about that too the question on that was what kind of resources do universities provide and also how do they get involved with this so a lot of it's actually been word of mouth initially so this started out with a couple schools in the Greater Rochester area or upstate New York and then as people have talked about this experience it has grown and actually part of the reason we're talking here is to just get the word out there about what we're doing and as more teams learn about that and have the opportunity to compete or at least know this exists they're signing up and we're looking at ways to make sure we handle that demand yeah and in terms of resources we've partnered with numerous universities specifically five in the US and one in Dubai to host our regional events and they provide space for a weekend for a regional event they provide meals and they help teams out not necessarily financially but at least getting them arrangements to show up and stay a weekend and compete they provide us with people who can talk or give presentations in the industry and they also provide us with volunteers to staff the rooms make sure teams know where to go make sure that it all operates smoothly and then on the national CPTC side we provide representatives from our organization to show up they basically run the event for the school so they don't need to provide any of the setting up the environment sort of thing they just need to provide labs and they also we also provide all the infrastructure all the scoring and all of that to make it happen so from a university perspective that's hosting it yes they have a lot of things that they need to do to make it happen but it's not as serious as where they have to build infrastructure and all that and they use their lab space they use their classroom space and they provide food more or less and then the students that are competing they provide the willing and able bodies to stay up all night and write reports so the question was what tools do we provide to deploy this environment on its own so we have a tool on github.genocide with a zero instead of the O and then LaForge and there's a b-side talk about it last year but basically the idea is you can use that to build the environments it takes YAML configuration files and an API key for a crowd provider unfortunately we don't have any of those YAMLs like the example environments because we reuse them so we just haven't put out templates yet but that is the dream we've been talking about it for a few years and then maybe this year we're going to retire a subset of systems and we can publish those and we want to get to the point where we're providing a lot of information about the 2017 environment because that's well past at this point we want to get to the point where we can release older environments and teams can use that for practice or qualifying type environments but right now the question was do we is there a reason we use LaForge versus Terraform and we actually do use Terraform though so LaForge is just a custom Terraform wrapper basically except it's like way complex and fancy and has a bunch of bells and whistles but it's a Terraform wrapper it's custom designed to write Terraform in the way that we need a write Terraform to build this environment oh we screw up things all the time so the question was have we made other mistakes that have affected the competition we are we're human we do make mistakes and kind of think of some notable yeah we actually last year announced the wrong winners yeah they wanted me to score so the way our scoring system was set up is you have teams one through whatever in each region one through ten and for whatever reason there was a dependency between the way it was presented on one page in the scoring system versus how it was on the main page and if you like updated the URL as opposed to going to web UI you put the score in the wrong section and there were teams that the score was good enough that it didn't look like they had a zero for part of the score when we sanity checked it and then we realized when we started putting in the later time zone scores that they had scores already and something really bad happened so we actually before we figured out exactly what we were going to do about it we decided and this is actually going to play you should go to ethics village we're going to talk about this stuff too but we decided that we were going to do the right thing and whatever team actually won would be what we announced even if it changed of course the event completely and then we figured out how that affected individual teams so and we there's a couple series of tweets that we have about this where we explain what happened and how we fixed it but our emphasis is we are transparent about what we do if we make mistakes we admit it and we don't want to hide anything about what we do so that we do stuff like that happens and that's what you deal with professionally and we think that it's not making the mistake that's the thing it's how you handle it so that's very important for what we do so thank you so much Ming we appreciate it and thank you for all and stickers


We'll call the fifth regular meeting of the common council the order Madam clerk, would you please read the quote of the day? Thank you. The only way to do great work is to love what you do Very good, please call the roll There are twelve present all the person down in you van Akron Berg and van de Wiel are excused Next would be the approval of the minutes other than Ballinger Thank You mr. President. I move to stand down Pledge of Allegiance my bad. Okay. I'm a rookie the flowers are cloudy my judgment Please join me in the pledge Allegiance is a flag of the United States of America and to the republic for which it stands One nation under God Indivisible with liberty and justice for all the pollen counts too high up here All right, all the person Ballinger. Thank you move to approve the minutes second It's a motion a second any discussions Hearing those all those in favor say aye. Hi post Next resignations city attorney Adams. We do have one resignation from all the person Eldenburg Effective June two Thank you very much Mayor's appointments. I believe there are none. There is a there is a mayor's appointment as well Do a motion for the resignation? Thank you, mr. President move to accept and file motion to accept and file any discussion Hearing none all those in favor say aye. Aye post Mayor's appointments as for mayor's appointment The mayor submits Cindy dross to be considered for an appointment to the joint review board as the LTC Representative with the term expiring April 30 of 2016 that will lie over Next we have a presentation from Amy Wilson of the Sheboygan tourism As you know, we generally get the numbers from the year before and in May during National Tourism Week the first week of May So we'll just review how 2014 went across the state and for our local area in 2014 across Wisconsin visits to ship or visits grew by 2% over 2013 hotel room demand is up by 3.5 percent the occupancy rates increased over 56 percent Average daily rate is also up over 3 percent and overall hotel revenues are up 7.4 percent across the state Please your travel comprises 88 percent of visitor spending. That's generally very consistent overnight visitors comprise about 67 percent of that Day trips and I'm sorry overnight visitors spend about 7.7 billion across the state day visitors spend about 3.8 8 billion There were 102 point million visitors to the state spending 11.4 billion in 2014 So visitors spent about 2.3 billion on lodging. That's an increase of over 7 percent More than 2.9 was spent on food and beverage That's an increase of 6.4 percent and the first time that food and beverage has surpassed lodging spending Retail captured almost 2.3 billion in visitor spending. That's an increase of 2.4 percent and Visitors spending on recreation increased 7.8 percent to more than 1.5 billion and Just to let you know recreation increases at a greater rate right now for the last four years than all the other categories and That's pretty much where we focus all our marketing efforts on in waterfront recreational assets So visitor spending Since 2010 has increased 38.6 million In in our county. This is visitor spending for our county. So in 2014 visitors spent 207.8 million So in a five years, that's almost a well little over 38 million dollar increase in visitor spending For room tax revenues just for the city of Sheboygan and this chart that you're looking at this actually What those numbers are are the 70% of room taxes collected that comprise? Just the tourism budget. It's not the 30% that goes to the general The general fund and it doesn't include blue Harbor So room tax revenues over the last five years have increased 49 percent 2014 we had a record-breaking year room tax collections and today is the fifth anniversary June 1st since the tourism Open office in the chamber since it opened So the city of Sheboygan collects about 40% of all room tax when blue Harbor is included about 40% across the county We go to the next chart. You'll see 2014 Every year we highlight in yellow What quarters are the record-breaking quarters in history and in 2014 every one of them were? so However, we just received today the quarter one room tax for 2015 and that broke the quarter one record for 2014 So hopefully we're on another good revenue increasing trend So the projections For the room tax projections that we turn in for the budgets every year usually ours come in in August But in 2015 and as always we project conservatively to avoid any risk and things we can't control natural disaster Hotel studying on fire, etc. Etc. So in 2015 we projected about 370,000 remember we have to project these before we know how we do in the year about 370,000 to come into the tourism budget Following a three-year pattern that showed a mitigated average of 396,000 But we will well be over that So that's the update if there are no questions Great. Thank you All right. Thank you Somebody's buzzing in who all them and born Thank You mr. President Amy with anything that's going on in Madison right now with the state budget I read some things that are possibly pending with how Municipalities can spend their room tax dollars is that possibly going to have an adverse effect on us or are we looking okay? It shouldn't affect us at all because the way our our tours and board in our system has set up already complies with the state statute And we're already following the law that they're trying to improve. Okay. Thanks Thank you very much Public forum madam clerk Okay, this evening first on the list is Jason Peters Jason if you could come on up And I need your home address, please Jason. It's a 1225 Cough minute. Okay, you will have five minutes. All right. Good evening. I would like to give an update to the Common Council the progress of the Army Foundation We have been working very well with the finance committee. They've given us some great advice I would like to personally thank Alderman Carlson At the last extort committee meeting he brought to light some miscommunication We had with another person and following our 501 see papers They will be filed shortly and I really want to thank him for this help It's kind of it's been a very nice experience working together But tonight you will be voting on whether to follow the historic committee recommendation to place the armory as a historical structure Landmarking locally protects the exterior and condition of the building. I want to stress It does not guarantee that the building cannot come down in the future For us, this is the first step in a process of setting up precedent that the armory is an important part of shaboy against past But more importantly its future Our hopefully goal is the next step. It will be state and national landmark which will help us with grant money and tax credits last month Alderman Theo and Alderman Damrell took a tour with me and Colin through the armory and Last week Colin and Jason Smith as a shaboy impressed along with Jim Drugger Drager The head of Wisconsin State Historical Society took a tour Mr. Drager said essentially nothing majority is wrong except the building has been neglected and needs cosmic fixes I really personally feel the condition of the building Through a lot of hearsay has been blown off proportion If you talk to two alderman that were there, it's a lot of cosmetic fixes But again tonight you will be voting on a recommendation from a committee that the mayor appointed I'm learning a lot in his last 18 months coming here and to me Going through all these different committees the finance committee historical committee the parks committee these people put in a lot of time just like yourselves and And to me it would be a no-brainer for you when you have four to two recommendation to landmark it If you don't it's a slap in the face of all the members of the historical committee Thank You Jason and Next on our list is Deborah is it Yochus? Sorry, if I didn't pronounce it right Close okay good and Deborah. I need your home address, please 1633 humble to have an inch for you. Okay, and you will have five minutes My name is Deborah. I have a Company Company called three of life properties recently acquired a property On north 11th Street that we would like to use for transitional housing a faith-based program We also are looking at another property that is coming for sale on north 11th Street Which is a five bedroom home? That we would be putting Male non-offender or non-violent offenders in People need Sorry, I'm very nervous. I Do jail ministry and I've done it for a year and a half and these people come out They have nowhere to go And they need people to walk alongside them and guide them and this is our mission is to just provide faith-based housing We have a curriculum And if you want to know more of that structured detail, I Have someone here that can explain that I don't know if anybody has questions for me. I'm pretty nervous Is there any I mean that the house that we would like to purchase is not currently on the market it is Set to go up any day now and we would like to Purchase that and use that for a transitional living program for males I don't know if there's objections Thanks, Debra. Thank you fine. I did great Anybody else? That's it. All right next on our mayor's announcements on board docs He saw the resignation of Alderperson Berg First I'd like to thank him for his past and current service We wish him the very best in his recovery and would ask that you keep him in your thoughts and prayers as we as he goes forward Unfortunately, that means that we have a vacancy in district one Wards one two and three Anyone interested in putting their name in for this position should submit a letter and resume to the city clerk at 828 Center Avenue or by email at Susan Richards at Sheboygan wi.gov you can also find that email address on our website By Friday June 12th council be voting on the new Alderperson at our next meeting on June 15th And there will be time allotted for any interested parties to Speak at the council to the council before the vote. So if you have any questions, please contact city clerk Richards Thank you. Next we'll move on to the consent agenda Like Alderperson Bellinger Thank You mr. President Like to make a motion to accept and file all all RO's accept and adopt all our C's and pass all resolute Resolutions and ordinances So motion in a second any discussion Hearing none will the clerk please call the roll He'll have an eyes All right motion passes Next move on to reports of officers 3.1 an RO by the historic preservation housing rehab Commission to whom was referred RO number 294 15 by the city clerk submitting a historical designation Application Sheboygan municipal auditorium and armory recommends that the auditorium and the armory be designated as a historical structure and directs the historic preservation Slash housing rehab Commission to start the process per the ordinance for officially designating the property historic all the person deal I make a motion that we accept File the arrow motion in second under discussion. These aren't labeled right all the person Carlson president I Would I'm gonna be opposing this Process and I hope that everybody else joins me for one main reason I don't think we need to put any unnecessary burdens on the future of the armory this committee The committee historic preservation already placed a 90-day hold on it and it actually Killed the development the only development deal that we had For this armory the bid process went out for 10 months We've all known that there have been issues here for at least two years now We put out like I said that 10 month bid process We only got one viable option and then this committee Effectively killed that Project luckily that project is still staying within the city However, it didn't solve the armory problem for the city This this process would place some restrictions on the building I'll be it it would be restrictions that we're putting on ourselves But once again, I don't think we need to do that because he's in development deals We all know that time is of the essence So whether it's five days a week or a month or two months or even 90 days It could kill something and I don't think we need to do that. We haven't gotten any real Other options for this project. So I want to be able to just keep our options open and this will not allow Thank you. Thank you for your comments all the person deal Thank You mr. President As mr. Peters mentioned, I went to the tour of the armory I haven't been in there in many many years. I was expecting just from what I heard from Everybody else that this is a complete disaster inside. It's a mess Doesn't need some work. Yes, but I was surprised that it wasn't as bad as I actually really anticipated Is there some areas inside there that are are bad? Absolutely, I think with some if the right group could find the right funding It can actually get back to what it was I know some some other people them persons haven't Lived here all their lives don't know the history of the of the armory. I have lived here all my life This is my hometown and I have some great memories there I think by Making this a historical landmark or whatever Classification it's called. I think we're showing that we do value the historical areas In our city and I know Alderman Collison said that we we killed the deal Why I think we didn't really kill anything. I think we saved the building is what we did This destination artist does a nation protects the exterior of the building Like he said it doesn't Say that somewhere down the line. We don't get any offers or this group can't put something together or funding or whatever Doesn't mean that somewhere down the line. We couldn't vote where it would get taken down. It doesn't Doesn't do that. It just protects the exterior of the building and may help them get some type of grants down the line And help for some other destinations So I'm obviously in favor of this and I hope everybody else is also thank you Thank you, all the person feel Alderman bitters Sponsored to her I also tour the I'll let my inner engineer side speak out for the moment It's not just cosmetic the problems that building are profound that it outside of the leaking The trash to roof There are things a The moment you try to do anything with that building is it ADA compliant? No Is it ain't close to me to that? No, is there a sprinkler system inside? No Is there a Is there a working HVAC system? Yeah, but it only does heat and It's steam boilers and I actually looked at the two boilers only one of them is Converting to a modern fuel the other one's still coal that Anyone who thinks well some cuz my cosmetic changes and a little bit of money will whip this thing back in the shape Not true. It's not gonna happen that way You're gonna end up Somewhere probably between five and ten million dollars to get this back to a viable Public building and I don't see us putting that on the backs of the people who got to pay it for this our local taxpayers I Someone proved to me wrong, but I don't see it and Actually, the exterior of the building is part of what's causing the problems inside There's leaking and there's water running through the exterior walls Trashing the interior You know I respect the All they're trying to do but it's not as rosy I Think thank you alderman bitters alderman bellinger Thank You mr. President during my last Feeding on the finance committee the Armory foundation came before us at that point in time and it was agreed that they would take a tour and hire a Architect and go through that facility with them and get a report back from an architect It's easy, you know for any one of us alderman or in somebody with an untrained eye to go and look at something and You know whether it's cosmetic or it's major structural or you know significant issues It's not as easy to see with an untrained eye So I would like to ask the question has an architect gone through it and has there been a report developed as to what The issues are of that building. Thank you Not sure who would know the answer to that Miss Lurkey motion to open the floor to miss Lurkey second Second all those in favor say hi Please my name is Jennifer Lurkey. I'm owner of legacy architecture here in Chicago. Again. I'm a historic preservation And we do preservation work across the state I've been in the building twice Once most recently this past Friday And I was also in the building last February February 14 not February 15 On both occasions. I was there with representatives from the Wisconsin Historical Society and they were there on my invitation The first visit in February 14. I was there with a potential client who was considering responding to the RFP and Most recently I was in the building I Do have to say the building is very structurally sound Yes, the roof is leaking. I saw no evidence of the walls leaking There's one major roof leak on the southeast corner of the building That's causing the water to basically filter down through the entire building I've heard rumors that the roof is collapsing which does not appear to be a case There's some plaster that has come down a very small amount of it due to the roof leaks Roof leak is the primary concern with the building as far as I'm concerned I have not been hired by anybody to do a report. I don't have any proposals out to do a report for anybody I certainly have those capabilities and I've done those on numerous buildings But I have not seen any structural problems And the major cause of the deterioration right now is the roof leaks Two of which I am aware of There is some concern with the stairs on the northwest corner of the building the foundation Has settled it's caused some crack with the concrete, but it's not building itself It's just the exterior stairs on the north side of the building As far as the landmark designation is concerned Several years ago we Work called an intensive survey report I don't know if you guys have access to it or have seen it The first edition of the report was issued in 2002 Paid for by the city. I was the primary investigator of it And the armory was identified as being potentially eligible for the state national register Therefore making it eligible for tax credits This building is eligible for quite some time Landmarking is different from eligibility though and tonight. We're here to talk about landmarking. So I Did write a letter of support to have this property In the intensive survey report Landmarking is not going to prevent you from bulldozing it in the future That 90-day stay is still going to be in place whether it's landmarked or not. So I really see no There are relatively few restrictions placed on this building if it's landmarked or not I don't know if anybody has any further questions. Any questions on the architectural Oliver, excuse me, I'll the person Belanger Thank You President Hammond Would you feel comfortable giving a ballpark? Dollar figure as to what it would cost to redo the roof and get an ADA compliant and Sprinklers and get everything I should Sprinklers issues too for existing buildings that are eligible for the national register You can use the international existing building code that is the building code that we use here in Wisconsin That would not depending on future use of the building it would not force you to make that building ADA compliant There is a ramp that leads to the first floor and the entire first floor is accessible That's usually the baseline minimum for ADA accessibility in all public buildings and places of work So as of right now the building meets all compliance standards As far as depending upon what the usage would be Depending on what the future use of the building there would be some if the building would stay Relatively in a similar use to what it's being used now. There would be nothing that would trigger Let's say elevators to be installed so that there would be accessibility to basement or the upper butcher level There are provisions in our building code. We use them all the time And there are all kinds of public buildings in the city that are not accessible right now As far as sprinklers are concerned, it's an existing building its grandfathered in unless there was some major change of use That would happen to the building nothing would trigger sprinkler systems So as it stands right now, you wouldn't have to worry about that the numbers that I have seen from other Contractors in town who have taken a stab at putting numbers together for this building have been in like a give-or-take That was also for Spaceport years ago. They were putting massive additions on the rare So I personally have not put any numbers together for it. I haven't looked at Detail whatsoever, but that is a number that I have seen Thank you any other questions for miss Lurkey Before we move on. Okay. Thank you very much Alderman Carlson Thank you. One of the bigger issues that I have with this is the fact that the I Think we're putting the cart before the horse here the Armory Foundation doesn't exist on paper It's not a legal entity and that's who filed this motion. There is no plan There is no Plan that has been presented to the city as of yet and like I said, it's almost been a two-year process Once again, I don't think we need to go through this process because there is no plan out there it's been almost two years and I guess according to a miscommunication.  Thank you Thank you. Lemon Carlson all the men who say I am the senior water Rain Said the lodge does not have Somebody comes as a wedding there I think it's a good move like it's been said here Okay, thank you Older men born you're next Thank You mr. President Question if this building is not designated a historical structure that does not preclude Mr. Peters group from coming through with proposal to the finance committee doesn't know and it doesn't preclude them From getting their 501 designation. That's historical structure has nothing to do with that. No, thank you All the men bitters Thank you again, mr. President with all due respect to all the men who say and our architect speaker the When in her in her comments she she mentions well You'd be grandfathered if it wasn't a Changing purpose of the building Well the Armory Foundation whether they're recognized as an actual foundation or not their plan that The last plan I saw Coming to the city Talked about radical reuses for the for the building that As soon as you start remodeling rooms on the different floors And repurposing the main floor Entirely could be Suddenly not grandfathered anymore There there's a lot of other deeper issues In whether this could be used in the way that we're talking about if you're gonna keep it a basketball court Okay, but anything that you were gonna do upstairs it calls into question whether or not This that the plan that they came up was so far Is any good or not? And I go back to Alderman Alderman Carlson's comments that you know he had two years of Get anybody in here with a viable plan that we could act on That hasn't happened So I don't I Don't have any problem with the nostalgia and whether we should keep this as historic building Just realize what you're getting into if we pursue down the Let's make this historic it adds an extra hurdle if we ever did decide to do something different That's all I have Thank you. Okay. Thank you. I'll I'm in teal Thank you, mr. President. I just want to mention that what we're voting on here today is landmarking a building This isn't any discussion about if the shaboy foundation is gonna go in there Whether or something else is gonna go in there. What we're here to do is landmark a building. I think we need to remember that And Personless art Thank You President Hammond, and we have a question for attorney Adams By landmarking this building what restrictions does it have on the property and on us? You know in short It adds another layer is what it does I think earlier during public forum the comet was made that it doesn't prevent this The demolition of the property and that is correct as it is but it does Basically add another layer of there's a time frame There's a holding period during which no action could be taken and the historic commission takes a look at that That's it to put it into a nutshell. That's what it does Is it adds another layer of let's look at this before we make that a decision to do these a Major demolition or a major project on the outside Any other discussion we're gonna have to Any other discussion from the other person It was a motion in a second to accept and file Recommendation of the committee to designate it a historic landmark so By voting I you're accepting that it's a accepting the Resolution to make it a historic landmark You're not everybody understand what they're going on five eyes six nose Motion fails 3.2 through 3.9 will be referred to various committees for resolutions 4.1's a resolution by Myself authorizing entering into an agreement with Donahue and associates for engineering services for the reconstruction of Pennsylvania Avenue From North 7th Street to North 5th Street All the person bellinger. Thank you, mr. President move to suspend the rules Second some motion in a second to suspend any objections Rules are suspended alderman bellinger. Thank you move to pass the resolution I get right motion is second to put the resolution upon its passage under discussion nearing none will the clerk please call the roll eleven eyes motion carries 4.2 resolution by myself authorizing the continuation of the self-insured workers compensation program all the person bellinger Thank you and move to suspend the rules Any objections to suspending the rules Hearing none, please continue. Thank you make a motion to pass the resolution It's most in a second to put the resolution upon its passage under discussion Hearing none, please call the roll 11 eyes motion carries 4.3 a resolution by myself authorizing submittal of an Office of Healthy Homes and Lead Hazard control grant and approving the memorandum of understanding between the city county and housing authority Alderman bellinger Thank You mr. President motion to suspend any objections to suspending the rules Please continue. Thank you, then move to pass the resolution Motion is second to put the resolution upon its passage under discussion Hearing none will the clerk please call the roll Ten eyes one no motion carries 4.3 4 through 4.1 1 will be referred to various committees And the reports of committees 5 1 and RC by law and licensing to whom was referred RO number 10 15 16 by the city clerk Submitting various license applications Recommends that the taxi cab driver's license application number 68 68 be denied based on his failure to accurately reveal all relevant convictions on his Application is record of violations related to the license of Fent or activity and his record as a repeat law Violator other person Lissard. Thank You president Hammond. I move that the report of committee be accepted and adopted Motion in multiple seconds Under discussion He came before our committee and there was a number of citations that he failed to put on his application One Standing out the most is he had a felony eluding that took two months for him to turn himself in and the police department did not recommend us approving this application so I Am asking for the support of this court All the personal sorry Sorry, I apologize is been cleansing here Please continue Any under discussion? We know where the clerk. Please call the roll 11 eyes Motion carries five two and five three will be re-referred to public protection and safety Six one under ordinances six one through six four will be revered referred to various committees Which takes us to other matters City Attorney Adams, we have three the first one seven point one is a resolution accepting two hundred and thirty nine thousand four hundred fifty nine dollars in grant monies from the US Environmental Protection Agency for green infrastructure implementation at the land in King parks that will be referred to finance 7.2 is an RO submitting various license applications for the period and in December 31st 2015 and June 30th 2017 that'll be referred to lawn licensing 7.3 is an RO submitting various license applications for the period ending June 30 2016 that'll be referred to lawn licensing that said we have Concluded all the person bellinger move to adjourn the most in a second to adjourn All those in favor say aye aye post your adjourned. Thank you


Hello everyone, welcome to this session. I am Deepali Vardhakar working as an assistant professor at WIT Solapur. In this session, we are going to discuss the basic operations on continuous time signal and the numericals related to this basic operation. At the end of this session, student will be able to apply the basic operations on continuous time signal. So, these are the contents. In this, we will see the numericals which are related to the time shifting operations, numericals related to time reversal and time scaling operations. So, before moving ahead, please recall the time shifting property. So, it is and the name suggests the shifting of the signal in a time. So, in case of time shifting property, the mathematical it is represented as y of t is equal to x of t minus t. So, here suppose the x of t signal, if the capital T value here if it is the negative, then this will lead to the shifting this signal towards the left side means advance the signal. If the capital T is a positive value means if t minus capital T and t is a positive, then which will leads to the shifting this signal towards the right side means delays this signal. So, this is the time shifting property. Then the second is a time reversal property. So, please recall the time reversal property. So, this time reversal of the signal is obtained by folding the signal about t is equal to 0. So, this mathematical it is represented as y of t is equal to x of minus t. If the x of t input, then the time reversal version of that signal is a y of t which is equal to x of minus t. So, suppose the x 1 of t the signal is given, x time reversal signal x 1 of minus t it is nothing but reflection about this t is equal to 0 or reflection about this y axis. So, this is the mirror image of this input signal x 1 of t. Then recall the time scaling property it is obtained by replacing t by alpha t in that signal x of t. So, mathematically it is represented as y of t is equal to x of alpha t. Now, let us see suppose this is the x of t input signal if you apply the time scaling property and if the alpha is greater than 1. So, it will lead to the compression of this signal. So, y of t is equal to x of 2 t suppose then it will lead to the compression of the signal by factor 2. And if the alpha value is in between 0 and 1. So, it will lead to the expansion of the signal and here x of half of t means it will lead to the expansion of the signal by factor this 2. Now, let us see the examples which are related to these basic operations of city signals. Sketch the signal y of t is equal to x of 2 minus t by 3. So, in this and here the x of t signal is given. Now, let us see the steps to solve this signal. The first step we have to apply the time shifting property on this x of t first. So, time shifting property in that case we required x of 2 plus t first. So, we will shift this signal towards the left side by 2 units. Then the second step we are going to apply the time reversing property on the step 1 signal output. So, if you apply the time reversing property then this x of 2 plus t signal becomes x of 2 minus t. And the steps 3 we are going to apply the time scaling property on the second steps output. So, here we are expanding the signal by factor 3. So, which is nothing but x of 2 minus t by 3. So, let us see one by one all steps. So, this is the x of t. Apply the time shifting property towards the left side by 2 units this gives the x of 2 plus t. So, we are shifting this signal x of t towards the left side by 2 unit. So, here the point A in x of t is at t is equal to minus 1. Now, in x of t plus 1 t plus 2 the point A will shift towards at t is equal to minus 3. Similarly, point B in a x of t is at t is equal to 0. So, if we shift this signal towards the left side then the point B is at t is equal to minus 2. Then the point C in a x of t is at t is equal to 1. So, if we shift this signal towards the left side then the x of t plus 2 the points C will be shift at t is equal to minus 1. Similarly, point D in a x of t is at t is equal to 2 and if we shift this signal towards the left side then the output at that point the D point will be at t is equal to 0 and E point in the new signal E point is at t is equal to 1. Now, the next is a we need this minus t here. So, for that we have to apply the time reversing property to get the 2 minus t. So, fold this signal about t is equal to 0. So, take the mirror image of the signal about this t is equal to 0. So, this is the time reversing property and then we have to apply the time scaling to get 2 x of 2 minus t by 3. So, here the time scaling factor is a 1 by 3. So, this signal is get expanded by factor 3 means at the initial the point is at a point is at 3. So, 3 into 3 this a point will be at t is equal to 9. Similarly, all points are get expanded by the factor 3. So, this is the required output resultant sketch. We can verify our answer. Suppose the point a in x of t is at t is equal to minus 1 then in x of 2 minus t by 3 at 2 minus t by 3 which is equal to minus 1 hence t is equal to 9. So, you can check whether your point a point is at 9. Similarly, for b you can verify your answer in x of t b point is at t is equal to 0 and in the x of 2 minus t by 3 this point will be at t is equal to 6. The point c in x of t is at t is equal to 1 then in x of 2 minus t by 3 it will be at t is equal to 3. Similarly, point d will be at t is equal to 0 and point e will be at t is equal to minus 3. So, in this way you can verify your answer. Then let us see the second example sketch the signal y of t is equal to x of 3 t minus 5 x of t is given. So, the step one we have to apply the time shifting towards the right side here we want x of t minus 5. So, shift this signal towards the right side by 5 units. Then the second step here the time we have to apply the time scaling to get this x of 3 t minus 5 and the scaling factor is the 3. So, let us see these two steps this is the x of t apply the time shifting by 5 towards the right side then we get the x of t minus 5. So, this x of t signal will shift to towards the right side then at this point the a point will be at 4 plus 5 means the a point will be at 9. Then the b point will be at 2 plus 5 this b point will be at t is equal to 7 like that all the signals are get shifted towards the right side by 5 units. So, you can verify this the point a in x of t is at t is equal to 4 then in this shifted signal the point a will be at t is equal to 9 the point b in a x of t is at t is equal to 2. So, in the shifted signal the point b is at t is equal to 7 then point c in a x of t is at t is equal to 0 then in the shifted signal the point c is at t is equal to 5 point d in x of t this signal is at t is equal to minus 2 in the shifted signal the point d is at t is equal to 3. So, you can verify your answer then the second step here we need x of 3 t minus 5. So, we have to apply the time scaling for the first step signal. So, here we have to apply the compression by factor 3. So, if we apply the compression by factor 3 means the point a at t is equal to 9 here this is get compressed means 9 by 3 it will comes at t is equal to 3. Similarly, point b here is at t is equal to 7 if we do the 7 by 3 then that value is for point b. So, in this way this signal is compressed here by factor 3. Now, you can verify this the point a in a x of t is at t is equal to 4 in x of 3 t minus 5 at 3 t minus 5 is equal to 4 hence t is equal to 3. So, point a is at 3 is equal to 3 correct then the point b in a x of t is at t is equal to 2 then in x of t 3 t minus 5 at 3 t minus 5 is equal to 2 hence the t is equal to 2.5. So, point b will be at 2.5. Similarly, you can verify for point c point c in a x of t is at t is equal to 0, but in x of 3 t minus 5 3 t minus 5 is equal to 0. So, the t value we get is it is equal to 1.6. So, point c will be at 1.6 t is equal to 1.6 then the point d in the x of t it is at t is equal to minus 2. So, in x of 3 t minus 5 at 3 t is minus 5 is equal to minus 2 hence t is equal to 1. So, the point t will be here in modified signals the point t d will be at t is equal to 1. So, this is our output. So, we can verify in this way whether our output is correct or not. These are the references. Thank you.


Upon this river, I surrender to this very moment. I hear the boat song of Tyagaraja, of the Kakarla clan. He takes his form, enchanting them as they seek him in their thoughts, longing to cross the river, only to be lost forever to him. But when the storm crosses the river, they are reminded that he is the one and only protector. And even a blade of grass move without his will. Surrender, eternal traveler, and you will no longer wander in exile. Me and I met on 30th June, 1936. We got married on the 10th of July, 1940. The marriage was in the temple premises, Thirnir Malay. A friend gave us a van and we went to Thirnir Malay temple with the 12 friends. Including lunch for the 12 friends, the wedding costed us as much as 150 rupees. It was in the year 1947, we had a message to say that Gandhiji, rather, Bapu was very keen on hearing Hari Tumaharo Janaki Bheem. That is, O Lord, take away pain from mankind. Those were days when really we lived in a paradise on earth. The Lord died, O Lord. It is, had you in concert, that put her on the map of the world, the same way that the Hindi Meera put her on the map of India. The last scene was taken in Dwarka. In the picture Meera, you will see Meera becoming one with the Lord in Dwarka. Then the sky and the earth become one. Is the answer in the experience that Subalakshmi had with the great sage of Kanchipuram? I see a childhood of dreams and passages, the roots of the vast Tamil country outside. And I feel it is for this I have been waiting for long. Kanchipuram is a very special region in seven regions. There are a lot of villages in Kanchipuram, as well as temples. There are three temples in that temple. Kamakshiaman temple, Varadarajar temple, Ekambureshwara temple. Three temples are very special. When I was four years old in Kanchipuram, my father gave me praise. He gave me a lot of praise, like Lalithapacharatharam, Peenakshiapacharatharam. He gave me a lot of praise. He gave me a lot of praise. He gave me a lot of praise. Sometimes the sky and earth have to sing. I was very young. I was in school. In school, I had a huge drama. I was a pansler. And I read the photos on paper. When I got the photo, I had a drama. My father felt a little changing. My father was not that famous, but he was happy. My father was very successful. When I heard that, I saw this photo of Kanchi in Madras and asked her if she wanted to record it. I asked her if she wanted to record it. I asked her if she wanted to record it at home. I told her that this photo was very dangerous. I was worried that she was looking for a house in Madras. I asked her if she wanted to record it. I asked her if she wanted to record it at the tea shop or in the cellar. She said that she shouldn't sing. My head is very... I told her that she shouldn't sing. I told her that she shouldn't sing. I told her that she shouldn't sing. I told my father that my mother would like to send this child to the Government Technical Examination. I was very eager to send it to my child. I told him that I would like to send it to him. I asked him who the examiner was. I asked him if he was Tiger Varunacharyan. He was a great Udhvan. His name was Ambi Dixitur. He was a great professor. Everyone was great. I was 9 years old. I went to the exam. Ambi Dixitur. When I finished the exam, my father sent me home. He sent me to the hospital. I wanted to send this child to the Government Technical Examination. He sent me to the Government Technical Examination. I wanted to send him to the Government Technical Examination. I gave him this child's name. He would tell me that he was a Udhvan. I would sing a line at that time. He would tell me that he was a Udhvan. I couldn't fall in love with him. He would tell me that he was a Udhvan. He told me that he was going to come to me in this blue sky. I asked him if he was going to sing. I asked him if he was going to sing. He told me that he was going to come to me in this blue sky. He told me that he was going to come to me in this blue sky. I was not in that age. We were going to go to the village. We did not want to go. We were all selected. It was only at 6 o'clock. It was 8 o'clock. We were going to go to the village. We were going to go to the village. We were all going to go to the village. We were all selected. We were all selected. It would be good to be selected at 8 o'clock. He told me to sing from my mind. He told me to sing from my mind. I told him that I was going to sing at 6.30 O'clock. I was very young, but my style was different from mine. When I was 8 years old, I started singing when I was 5 or 9 years old. When I was 13 or 14 years old, I started singing. When I was young, I was very young. My parents were very young. But I was a kid. I wanted to improve and study music. There were many things that I wanted to learn. There is no singing in our tradition. There is no singing. There are so many songs, such as Tamil songs, Javidi, Slocum, all these are the songs I sing. There is no singing in their tradition. There are so many songs. There are so many songs. There are so many songs. When I was 8 years old, I had a very young child. He was born with my grandfather. My grandfather. He used to be a farmer. That was at 4 o'clock. When I was 8 years old, he would not believe me. When I was 8 years old, I would wake up at 4 o'clock. I would sleep for 3 days. Not until dawn. I would come to Chitraparan and sing. I would pay half the time to change songs. He would sing in various ways. I could not sing in this way. He said, there is no singing in this style. That sadden me. The time that my journey takes is long. Yet, I have to go through it. I have to go through it. I have to go through it. I have to go through it. The time that my journey takes is long. Yet, in the unfathomed stillness of the soul, I stand inside, silent, still searching, still searching.