Hi, welcome. I hope you're going to have to readjust this.  But we're welcoming up. I can't pronounce his name, but he assures me that that's common. So you can call him Scooby. That's what he goes by. And Scooby is a senior security architect, adversary detection team lead, and threat hunting team lead for Belk Canada, one of Canada's largest carriers. The talk that he's going to give is really cool because Bloodhound started out as a red teaming tool, right? But we've learned through using the tool that it's really, really useful for blue teamers to discover the attack paths in your active directory. So Scooby is going to give us some information on that and how you can use this tool on the blue side to understand your active directory and the attack paths better. Hello everybody. Welcome to this talk called Bloodhound from Red to Blue. I'm Scooby. You can find me on Twitter at ScoobyMTL. I was mentioned I'm a senior security architect at Belk Canada, adversary team lead detection, and threat hunting team lead as well. This talk was first presented at Beside Charm a few months ago, so if there's some parts that I need to skip, I will refer you to that talk. I might have to go a bit faster because I've added a few things. At this point of the talk, you might wonder, is this guy mentally challenged or does he have an accent? Well, according to my doctors, because I'm French-Canadian, that I speak like this. Canadian, we're usually nice people until hockey comes along, then if you're not on our team, well, you best STF you. Because I'm French-Canadian, you will probably notice I won't pronounce S's at the end of words, or H's, or I might have them where they don't belong, but don't worry, just bear with me. With this talk, I have a few unlock achievements. First of all, I'm giving a talk at Defcon. Secondly, I'm giving a talk with Mohawk. As I mentioned, this is my second talk here at Aker Summer Camp, so that makes me equal with Pyrotec. He gave also two talks. That's one more talk than sub-T, and that's two more talk than Matt Graber. Matt mentioned that I had to talk about quality over quantity. I don't know what he meant. No security researcher, ego was arm and the making of this slide, so rest assured. So here's your agenda for today. We're going to talk about what blood-own is, the basic usage of blood-own. We're going to do an introduction to the Cypher language, and then we're going to set to destroy paths. And then I'm going to talk about report and automation. By show of hands, who here have used blood-own before? Okay, and who have built their own Cypher queries? Okay, awesome. Defenders, thinking list, attackers, thinking graphs, as long as this is true, attacker wins. You probably all of this before, it's a very common saying from John Lambert, and it comes with a whole blog. What it really means is when an adversary lands in your networks, it doesn't land in a list that you have. It lands in a graph, which is a complex set of relationship between objects. Blood-own is one of the tools that will actually show you the relationship between those objects, and they are actually linked together. So when we talk about a list, this is what we think about. We think about a list of assets, a list of server names, a list of group, a list of serial numbers. Then we go deeper, and we have even more lists. A list of open port, a list of installed software, compliant CBOX. But what all those lists won't tell you that a graph will is how are those things actually connected together? What is the relationship that exists that you know of, and especially that you do not know of, between all of those objects and all of your assets? So for those who are not familiar with graphs, it's not a security concept per se. So here's an example in real life. So you and Alexis are going to a restaurant, comes along Taylor and Jordan, and you become infactuated with Jordan. So you're going to leverage relationship in order to get what you want.  By the icon I choose for the phone, you might guess roughly how old I am. So you can see here, I've made a big effort to stay gender neutral in my names and my relations. I'm really proud of that. In Active Directory, it will look a little bit more like this. So an attacker will land somewhere in the network by compromising an account via phishing or password spraying, because my password is always summer 2019. And there he is. And then he's going to leverage the fact that this user is admin to his workstation, a bad info set practice, but it does happen way more than we want. And then that machine can RDP to a terminal server, for example, in your environment, and depending how much employee you have, this might be between 1,000 or 100 to 1,000 people. Then on that machine, there's a user who has a session, and he has a little crown, because he's a member of a high-value group. I see people with phones. Last slide of the deck will contain the link where you can download the whole slide so you don't need to take pictures of every slide. Now let's go over an overview of Bloodhound. I want to go quickly as more than half of the people seems to have used the tool before. But first of all, what is Bloodhound? Rest assured there's lots of word, but it's the only slide with so many words. So Bloodhound uses graph theory to reveal the hidden and often unintended relationship within an active directory environment. Both attackers and defenders can use those paths. Red teamer to exploit them, and of course blue teamer to destroy them before they are being exploited. Here's a very quick history of Bloodhound. It was released at Bloodhound 24 in a talk called 6 degree of domain admin. If you go to that link, you'll see Rowan actually unlocking his password manager and making the repo live. I was personally introduced to Bloodhound a year after that at Black Hat 2007 in a talk called Industrial Revolution of Lateral Movement from Tal Mahar and Tal Berry. It's an excellent talk where they explain how they can use a path generated by Bloodhound and through PowerShell, they just exploit and get the credential automatically. And then last year at Bloodhound, at Black Hat, sorry, 2018, the team released Bloodhound 2.0 and Bloodhound is developed by Waldo, Captain Jesus and Armjoy, three people that I'm sure you're familiar with. So what does Bloodhound do exactly? Well, there's three simple things. It queries active directory, it imports the data in the Neo4j database and then it shows the relationship between the objects. So why should you use Bloodhound? Well, for red teamers, you can use the UI to build complex attack path offline and this reduced the noise on the network a lot. So every time you jump on a machine, you already know which credentials you need to steal and which attack path you need to follow to get to the next. You don't need to re-scan the network every time you land on a new machine. For Bulu teamer, we can use Query to find the busiest attack path. We can test the relationship of deleting or removing a relationship or remediating would be the right term on your graph.  So it's now time to talk about the basic or what I like to call the first steps. So first of all, you need an ingester. There's three ingesters. There's Bloodhound, which is a C-sharp tool. There's Invoke Bloodhound, which is a power shell that loads Bloodhound reflectively. And then there's Bloodhound Python that was built by Dirk Jen from Foxit. So if you land in a Linux machine, you can still leverage the goodness of Bloodhound. On the right, I've put some comment. I'm going to go very quickly through them. I just want to mention that collection method all does not include logged on anymore because starting in Windows 10, 10th anniversary and Windows Server 2016, you need to be local admin in order to list the session. So now you need to add that if you want to have everything. DC only is something that is less quiet, makes a lot less noise on the network. But as a defender, you should still run that in order to make sure that you can detect it. Max loop time goes with session loop. By default, Bloodhound will loop for session for two hours. As we're a defender, we don't really care about being detected. So we should run that as long as possible.   And you should also shift the days that you're running it, because some activities might happen only a day a week. Search forest, yeah, whatever. If you have more than one forest, Sharpawn-H4-ELP could be useful. This is a screenshot of the GUI, but there's nothing like a live demo. So let's jump into the UI. This is the screen that you're going to see when you get here. Because I'm a bit short on time, I'm going to make it as quick as possible. I'm just going to turn like this. So the thing I wanted to show you guys is... I'm going to skip a few things, but query. Most people, when they land here, they will use the fine administrative, fine shortest path to domain admin and the domain. So I'm going to let the little doggie do his thing while I just show you here the filtering option. So these are all the edges that you have available for you. This is not the latest version. There's a few more now, but it was working for the presentation, and I didn't dare to try the new version. So you can remove any of those edge and recreate the graph, and it's just going to be gone. So from here, what I wanted to show, but I can't really not read, but if you don't know how to... Yeah, anyway, I cannot see the thing, but you can right-click on any edge and get help and information about how you can abuse that type of relationship. So this is really useful, and it's not really well documented. You have some upset consideration and, of course, lots of reference as well for any type of link. Another interesting thing is that if you right-click on any of the nodes, you have a few little menu here and you have edit nodes. So if you go there, you can see all the property of that node, and you can also add properties using the little add button right here. There's a few undocumented shortcut as well that I want to point out today.  Here you'll have all the elements of your graph, so you can click on anything and it's going to zoom in on your element and put it in the directory here. So here you have... If you have a user that is called Matt, you can click on it, and if you want to know if he has a path to domain admin, you just use a little road here and you type domain admin. And just like Google Map, it will show you if the user has a path to the domain admin. So here's the path for that user. Beside that, a few other maybe keywords. You can use shift, command and I to bring a console. So if there's any error message that you want to read, they will be here. Lastly here in the settings, there's two... Yeah, two interesting things. First of all, the debug query mode that goes with the rock query here. So when you activate that, every time you click somewhere, you will actually have the query in Cypher at the bottom in the rock query bar, and this is really helpful if you want to learn Cypher. And last but not least, there is the dark mode, which is probably the most important part of Bloodhound. So let's get back to the presentation. By the way, every time I say dark team in this presentation, there's a fairy that is born. So here it is. Why fairies? Because I have two daughters and they love fairies. Here are the undocumented features that I talked about. So using the right click on an edge to show contextual help, using control to toggle on or off the labels, control shift I for the console space bar, and you can also search for GPO or OU right in the bar and also domains. So if you want to know what's been enumerated, you can use those keywords. So graph database. As I mentioned, you load the data in Neo4j. This is where you can download the community edition, which is free. And then you start it like you would start any other Linux services just by using the start. Once it's installed, you can go to a web console on port 74.74. So some people might ask why use the web console when Bloodhound comes with a UI. Well, there's a few reasons for that, especially when you start writing your own query. If you make a mistake in your query in the console, you'll quickly know that your query is wrong and it will point you what is wrong in your query. So right here, you'll see that equal is not the right symbol. You need to put a semicolon. So when you fix that, you get the result of your query. Also, you can see that if you're not returning a path but you're returning a property, it will actually list in a table which doesn't happen in the GUI, but we're going to come back to that. The last reason to use the web GUI, the web console, sorry, it's because it also has a dark theme. Hey, another fairy. Let's go through an introduction of Cypher or what I like to call learning to run. So a basic Cypher query will have a few objects, a few elements, so we have a match statement. Then you have to declare some objects or variables. So here you can see that we are declaring a variable U of the type user and if you want to access the attributes, you need to put a dot with the attribute's name. Then you'll likely want to find some relation, so that says two dash and an arrow pointing in the direction that you want and in brackets, you can put the relation type. After that, you'll probably want to find paths, so you have shortest path or all shortest paths from one variable towards another one. And then you have where if you want to make some filtering. And then you need a return function to say exactly what you want to return. So there's two methods for doing the filtering. There's the explicit methods and there's the where clause. So I'll show you the difference between the two. Here is with an explicit function, so you can see that I'm declaring a variable called n and it's type of a group and the name must be equal to a domain user at testlab.local. And then they're finding another variable m which is a group and this one is domain admin at testlab.local and then I'm looking for a shortest path between those two groups and I don't care how many ops there is and I want to return the path. With the where clause it will look at it with more like this, so we have the match shortest path n towards mgroup and then we say what we want for those variable. So the first one is we wanted to start with domain user whereas the other one is we wanted to contain something. There's also end widths that exist and then we return the path. Here are the two queries side by side. When you run them, not surprisingly you get the exact same result. So why use one instead of the other? First of all the time, it is way faster to use explicit when you can versus a where clause. On the other end, if you're a consultant or if you have multiple domains and you use specific, you'll have to make your query for all the domains to change your query all the time. So depending on the situation one might be more suited than the other. Also when you're using the web UI it will help you improve your query. So when your query works but it's not optimal you'll get those little exclamation mark and when you click on them the UI will tell you how you can actually improve them. So here's the query that we have improved. So if we put them side by side you can see that in the first one they're variable and then we do the shortest path whereas in the second one we do the shortest path and we declare our variable right inside the function which is now the preferred way to do it in Cypher. This is pro tip number one of the talk. So using appending, explain or profile in front of your query will help you understand what's actually happening under the hood. So explain will do the execution plan but will not run the statement whereas the run, the profile will tell you exactly which operator is taking more doing most of the work. So here's how it works. So here's a complex query that returns pretty much all the object in the graph and you do match. So when you do explain match just put explain and before you'll get this. So you know this is explain so you can see here we have 1600 it's estimated when we run it with profile we see that it's actually 16,000 so you can see that it's actually more precise than the other one. Here are some useful query and I'll just put also my github link here so if you want to download it all the custom queries that I did not show you in the UI, they are there. Domain user those are the first thing that I like to do when I start an engagement or go on a new domain looking where domain user are local admins if they have a shortest path to high value target if there are any places that they can RDP to and then all the other bad writes that they might have then I like to look into Kerber hosting if you have no idea what Kerber hosting in is in a nutshell it's it's an attack where you request a weak password a weak cipher of a password in RC4 and then you crack it offline if you want more information adsecurity.org the site by Sean Macal and then I also brought back the top 10 that were removed from version 1 to 10 because I believe as a blue teamer it's a good place to start exploring your graph so I just put them back here's an example of some advanced query that we're sharing the bloodhound cipher query slack channel I believe both of them were built by Waldo it's just to show you that you can start doing optional match you can start collecting variables you can add them together you can unwind you can count stuff and if you look at the second one you can extract labels you can extract variables you can filter things you can do average length and lots of mathematical things also in there if you want to learn more about cipher there is a good cheat cheat from Neo4j and this is the link now that we know a little bit how to build cipher queries it's time to destroy paths so what are we trying to do when we're destroying paths well we're trying to find the busiest path and then we're trying to find to test the effect of the proposed remediation so when you have the whole path sometimes you it might seem obvious that if you remove a link you'll destroy the path and domain user won't have access won't have a path anymore to domain admin but we'll see that this is not always the case and then when we know exactly which path should be removed then we can inform our domain admins and have them make the change let's try this in a control environment first of all we're going to create a problem so I'm going to merge the domain user and I'm going to give them admin rights to the computer 673 when I run that in a console I get that one relation was created and I'm very happy after that we're going to test our relationship so we're going to ask for a path between domain user and the computer 673 and we're going to ask to return the path not surprisingly our path is there now we have two options that we can use we can filter out the relationship this is to be used when there's only one relationship type in that path or you can delete the relationship in one relation I'll show you how to do both so first of all filtering out the relationship so here's the same beginning of the query we're looking for a path between domain user and computer 673 and we want to filter a relationship where the type of relationship is not admin 2 and we want to return the path if we do it with a delete it will look like this so pretty much the same query again but then we just delete the relation and then delete it so same thing but you return the path and those are the three query side by side when you run them again not surprisingly you have no data the thing is everything I just said was wrong so you're like ok everything was wrong so why are we here are we losing our time I'll take you to what happened in my head in the last 36 hours and remember that I've presented this at beside charm and this part was not in beside charm so let's do it against real data so we're going to do the same thing we're going to find our target so we're going to do the shortest path between domain user and domain admin and we're going to get a path that looks like this at the top here is executed.com and it's the only executed.com in the path so this should be a prime target for a filter out so here how you would do that you would say shortest path between domain admin and domain admin where the path is not executed.com and if the fix is right and if this is the fix that we want to send to our sysadmin we should not have a path to domain admin anymore now we have a problem we still have a path but it's much longer so this the executed.com is not the right thing that we want to execute we want to exclude but why filtering is wrong I'll show you right here instead of shortest path to domain admin this is all shortest path to domain admin so as you can see there's two paths with the same length that lends to domain admin this is the first one that we excluded with the executed.com but right here there's another executed.com and that link was also removed from our view so not only did we still have a path to domain admin when we excluded executed.com but we removed every executed.com from every path of the graph so that's why filtering out is actually a bad idea now I was like ok but at least I can delete relationship right so here's the same shortest path but then I print the label and you can see that in between group 4574 and computer 652 there's our executed.com so we're going to target that link and we're going to say take the path I want a path between and then assign it to variable r and then we're going to delete the relationship and then this happened and then I was like well shit now I've deleted two relationships when I wanted to only delete executed.com and I was like ok now what do I do my talk is in 36 hours and none of my techniques actually work and I'm going to look like ok but the solution was quite easy I googled how to target a single link and the first result was actually there so it's very easy the same query but you can see that here I've actually tell it exactly which relation I wanted to target and delete only one relationship and then I was partying like Dave Vader was not there that's pretty much what I looked like in my room yesterday so now we get something that looks like this when you're using the filter out to this path which is actually the path that we saw on the top and our executed.com is right there so that brings me to this part so when you do the same query in the web UI you get the picture on the left which you can see all the all the links when you do it in blood down you only have one link so I looked a little bit I asked the guys from blood down one is when you do a query to Neo4j it returns only one link but then the GUI somehow add them back when the query is done so that's why on the blood down GUI they only get the one link that is returned by the query and it's by alphabetical order so let's talk about what exactly happened here so a graph is like a map so imagine that you want to find all the routes between Chicago and New York City for example maybe you'll be shown one or two routes on the map but that's it's not all the paths that exist by any stretch of the imagination you can turn left on the street, right, whatever so that's exactly what's happening here blood down well blood down will only show you one relationship so you might think that there's only one when there's many and it is possible to delete a very specific relationship using this comment so assigning the name of the relationship that you want to delete before now let's get back to our regular scheduled programming this is the pro tip number two of the talk by default there's five groups that are high value in blood down but in your environment it's probably not the case probably have way more groups that are very important so this is a query that will help you find all the group that contains admin and that their high value attributes is not set to true you're going to return those names and we have Asia admins, Europe admins and North America admins now what we're going to do is that we're going to run the same query but we're going to set those group high value property to true so we go from the five original ones to eight groups that are high value pro tip number three what about the user inside of those groups so here's a query that's going to help you find all the high value groups that you have and all the user that belongs to those group and then you're going to set the property of those user to true if you have a good eye you might have noticed that this relationship is in the other direction and this is just to show you how flexible Cypher can be so what it's going to do is going to change something like this where you have domain admins with a diamond meaning that it's a high value a group and the user are not high value to this it will also change your shortest all shortest path to this from this to this so you see that in reality you have a lot more path than you actually thought at the beginning pro tip number four I know I know it's not Christmas and I keep on giving so here is in the shell CLI where you can use Cypher shell and I'm going to talk about that a little bit later but basically here we see that the first one is longer to execute than the second one and the reason is very simple in the first one we are returning a path where on the second one we are returning a attribute so it's a lot faster to return attributes if you don't have to send a path pro tip number five another way to accelerate your query or make them faster is to remove the relationship variable if you don't need them here the difference seems very small but bear in mind that my database is very short if you want to learn more things about you can use blood down as a defender you can watch a professionalizing blood down attack graph for defenders there's also sad processor who did quite a lot of research you also present another methodology where you actually whitelist or whitelist the nodes themselves by adding a properties and then of course there's a blood down slack the Cypher query channel where there's lots of people there including myself that will try to help you with your Cypher query if you have any problems now we're going to talk about reporting because attackers thinks in graph management thinks in metrics and as long as this is true ops will suffer so here's an example of a very simple report that we can have at the top you can put say in January 100% of our user had a path to domain admin now in February 7 is 57 and then in March 12 and we're trying to get to as low as possible of course if this is not visual enough for your management you can always use gauges those one were built in Google Doc for example very easily and if they don't understand this well honestly at this point I cannot help you anymore here's a query about how you can find a percentage of user with a path to domain admin so what you're doing here is you're looking for a shortest path between domain user and sorry, sort of path to DA so here you're looking for a path from user to domain admin and then you're going to count the number of user you have in your path and then how many user have a path and then you're going to do some maths right in the return function so user that has a path divided by the total of user multiplied by 100 this will give you your percent and when you run this you get 100% in this case now when you're done with the low-hanging fruit you can start looking at things that are a bit more funky like do I have any domain admins that have session to non DC machines this is a bad practice your domain admin should only log in into the domain controller so what we're doing here is that we're looking for computers that are not part of the domain controller group and we assign them a variable called non DC then we're looking for non DC that has a session to a user and the user must be a member of domain admin and then we return the name username and we count the connection again here there's something special about this query we have a double relationship it's also to show you how powerful Cypher can be and I'm very proud of this I worked really hard on this one I got another version from Waldo on the Slack channel but he was using SID and it was not working with this ID in the test database so this will give you something like this so you see all of your admins and how many connections they have to non DC machine if these names are too cryptic in your environment you can do a little modification right here and in bracket you can put all the fields that you actually want to display and it's going to look like this so here you have the username and also the display name so it might be easier for you to find who this account belongs to so here's another way of representing the same graph the same excel fight here is logarithmic and you're aiming for your data to go down down down down probably not the best way to show it but at least there's a dark team and that gives me my third fairy for the talk so now let's talk about automation so as I mentioned earlier there's a CLI command sorry in the bend directory of Neo4j so you can go there you export your username password and then using cipher shell you can paste your query directly there you just need to enclose them with single quotes so another pro tip would be every time you build a custom query in cipher always use double quotes and when you go in your shell you can use a single quotes if you do mix and match it's going to be very difficult to automate things so this query is we're looking for the Kerberos table high value accounts for Kerberos table so that's why we as SPN attributes to true and high value group set to true when you run that you'll get this in the shell but you can also pipe it in a CSV file and it's going to look like this Q8 is only because that was my eighth query in the graph CSV is very easy to open I mean you can send that to your manager or your sysadmins they will be able to open it in their favorite spreadsheet now alerting so when you have your query you can start comparing the current month result with the last month result and you just send an alert if the number increase and I went very fast because we're already at the conclusion here are the key takeaways for today defender can think in graph 2 using tool like blood down cipher is a very flexible language and you can do a lot of things if you put the effort in it it's also important to test the real impact of a remediation before you send it to your sysadmin otherwise they'll lose faith in blood down they'll lose faith in your process and they'll probably lose faith in you but it's easy to do as I demonstrated not all query are work automating what I mean by that is that yes you can see all the domain, all the users in admin for example and you probably want to be alerted if there's new user in that group but you'll run blood down maybe once a quarter once a month if you're lucky maybe once a week that's not fast enough to be alerted if there's a new domain admin so you're way better off looking for event ID 4728 in your logs to be alerted in near real time finally I want to give a big thank you to the blue team village for having me today I want to thank pyrotech grifter I'm here because of these people and especially grifter last year in Toronto said that if you have something that you want to share with the community don't be shy do it, do CFPs and you might get accepted and that's what happened to me so I'm very happy and you learn a lot more about what you want to talk about or about your subject when you make a talk because it's a second talk and as you saw lots of things have changed since the first version I want to thank Waldo and Captain Jesus who created the tool and who are helping everybody in the Slack channel when they have questions so as promised here's the link to the whole deck and the second link is the talk for the same talk but that I gave at b-side charm where I gave a more in-depth tour of the GUI and I go a little bit well less fast let's say slower so if you have any questions I have a few minutes so the question is is there a training or environment you can practice on yes there is an open database I don't have the link with me but if you go to the blood-down Slack or if you send me a text or something I will give it to you it exists the SpecterOps team has built and put online database and you can also generate your own there's a DB generator that comes with blood-down that you can run and you just specify how many user and computer you want and it's going to build everything that's what I use for this presentation so this is all fake data yes so is iValue a blood-down term yes it is it's an attribute that is collected and you can activate it in the GUI or manually using Cypher so it's one of the properties well everything is open source so you can probably change but I don't know how to do that but I'm pretty sure you can any other question yes so the question was if you run blood-down multiple time can you just import data over it or should you kind of clean your database the best way usually is you save your old database and you create then you save it then you clear it and you re-import so you can see yeah it's better because otherwise if your admins have made changes they will still be there in your environment and they will still when you do your query it's not going to be a real representation of your environment if you don't clean it yes sir the question was is there a reason why I did the deleting the relationship between looking for for for the percentage because I believe it's easier to find to break the most path at the beginning but you can do it the other way around also but if you have something from domain user that goes to domain admin it's probably the first thing you want to remove and that will give you a high win rate or a big drop in your percentage if you have a path from domain user to DA that means 100% of your user of a path and it's going to be hard to find which one to if you're not doing the query yes sir okay is there a difference between the tree and jester the sharp the sharp on the power shell one and then the python so python should be mostly used if you land in a linux environment or if you don't have any credentials and then you go to the first machine and you rerun sharp on from there so sharp on is really the preferred methods to run it you'll see that now since a few months a lot of antivirus as I started categorizing it as a virus which is a bit sad but you can kind of understand why so power shell is a way to actually load a sharp on reflectively so if you have application white listing for example you might be able to run a script or but the preferred methods especially for blue teamer would be to allow sharp on to be executed in one machine in one directory and then you do it this way as a as a red teamer I'll let other people and serve but as a blue teamer you should just white list in for a very specific place any other questions yes so the question was is there any tools in Neo4j to see the difference between different graphs I don't know of any but my friend is sitting right there give me a good idea and I'm going to work on that for next year the question was did I test it in any azure environment or any other cloud no I did not any other questions thank you very much everybody


How can you have a positive influence on others? Stick around to find out. Welcome back and congratulations on taking one more step towards becoming one of the great leaders of tomorrow. We've heard a lot the last few years about influencers and thought leaders. We may think some of these people are great leaders and aspire to be like them, but we say to ourselves, I don't have that kind of reach, or nobody wants to listen to me talk about something. But being an influencer is as simple as finding topics and ideas that we're passionate about and sharing our thoughts on them with others. Influencing thought in a positive way is one of our key responsibilities as leaders. Sometimes it could be difficult to believe that other people might want to hear what we have to say, or we think we don't know enough about a topic to speak about it. But the truth is people who care about their professions and organizations are open to new ideas, debate and discussion about the things that are important to them. There may be some haters out there, but let's not worry about them. Let's focus on finding people who share our values and ideas and connecting with them. If we sit down and think about it, we all probably have one or two areas in our life where we have some valuable expertise or life experience that we can share to help someone else out. If we keep this expertise and experience to ourselves, someone who could really use some advice might not get it. Here are a few tips to help you be an influencer in a positive and productive way. First, figure out what you're good at. This is where you sit down and say, what is the unique expertise and experience I have that no one else has? Then find your audience. Figure out who are the people who could benefit most from the expertise and experience you have to share or find a group of people who share your passion for this topic and share your ideas with them. It's important that you tell your own story. Use examples and experiences to emphasize the points you're trying to make. People enjoy and remember stories, especially if they're well-told, much more than they remember a list of bulletized points. You also have to make sure you've picked your moments wisely. When you choose to share what you have to offer is often more important than what you share. An informal discussion in the office can be more effective than trying to wedge a story into an already packed agenda for a staff meeting. Here at Evil Genius Leadership, we talk about getting the right mindset for various activities a lot and preparing to be an influencer is no different. If we come to these kinds of conversations with a mindset of helping others be successful by sharing our experience and expertise with them, we usually have a lot better results than if we're trying to be considered an expert or to get our own way. Also, if we come to these discussions with an open mind, it allows others to share their experience and expertise and helps the group grow together. We also might learn a little something as a result. If you found this helpful, don't forget to follow us on Twitter and Facebook. And remember, you can join us every Friday at 10 a.m. for an interactive leadership discussion live on Blab. You can also click off to that globe on the right and that'll get you subscribed to our email list and bring all of our content direct to your inbox. I want to thank you for watching. I appreciate it as always. And remember, the future is out there. Lead the way.


Thank you. It is now time for Member Statements, the Member from Wellington, Halton Hills. Mr. Speaker, as the government begins preparations for next year's budget, I rise in this House once again to underscore the need for a new courthouse in Halton Region. The current Halton courthouse, which was built more than 50 years ago, is aging, overcrowded, unsafe, and inadequate to meet the needs of our rapidly growing region. I toured the courthouse on September 10th, 2014, and participated in a town hall meeting with lawyers, judges, and other courthouse users later on that day. I told them I would do what I could to help. I've raised this issue in debate in this House and in question period. I've written to the Attorney General and have spoken to her many times. I even initiated a meeting with the Attorney General and all the Halton Area MPPs on September 8th. I also discussed the need with the Minister of Finance and the President of the Treasury Board last month, asking for their support. The Attorney General assures us that a new courthouse for Halton Region is a priority for her ministry. I thank her for the interest she has shown to date and urge her to keep pushing. The fall economic statements show that the government has allocated $243 million for justice infrastructure for this year. That's up almost $100 million from last year. Where is the Halton courthouse in their long-term infrastructure plan? Halton Region needs a new courthouse. I am prepared to reach across the aisle and work with the other Halton Area MPPs. Let's work together and get this done. Thank you very much, Mr. Speaker. Thank you. Further member statements? The member from Windsor to come see. Thank you, Speaker. As you know, many members are signing Christmas cards this week. I didn't do that, so I'll have to make do with this. Twas Christmas week and the members were busy in the writings as always. Only security and the legislative ghost walked the Queens Park hallways. Spirits which were seen were captured for clerk dollar and locked back up in the attic or down in the cellar. This month, the time seems to go by pretty fast, but there has been a sighting of a ghost of Christmas past. Dalton's been making a difference. At least that's the title of a book he's been hawking. Might be better than a lump of coal in a liberal stocking. Patrick, north of Simcoe, has no time to dally. As west of Don Valley, Kathleen was seen at a Whitby Oshawa rally. No, wait, please wait. I'm not done yet. I want to get in a plug for a poet laureate. And I would like the final thought or two to be entered before I get the hook by my leader Andrea from Hamilton Center. Obviously as a wordsmith, I'm no skilled artisan, but this message is non-political, non-partisan. Happy Hanukkah to some. Season's greetings to all. It shouldn't be hard speaker as in this hall you can plainly see. This has been your Christmas card from the member from Windsor to come see. No truth to the rumor that you're applying for the poet laureate. The member from Mrs. Sucker Pratt itself. Mr. Speaker, on November 25th, the Minister of Natural Resources and Forestry, Honorable Bill Morrow, and I had the opportunity to attend the Gurprep, Guru Nanak Devji's birth celebrations at the Ontario Khalsa Darbar Sikh Temple in my great riding of Ms. Sucker Pemkin South. Born in 1469, Guru Nanak Devji was ahead of his time and he had an extraordinary insight. He proclaimed there is but one God, the supreme truth, the ultimate reality, the creator without fear, without enemies. Timeless in his image, self created by his grace, revealed. He believed in justice for all and values such as equality, compassion, tolerance and universal love and respect. He rejected dreaded caste system and advocated for an inclusive and just society. Mr. Speaker, today we talk about gender parity. More than 500 years ago, Guru Nanak Devji said, Soko Minda Akiye Jit Jame Rajan. Why should we call a woman inferior when it is she who gives birth to kings? Mr. Speaker, Guru Nanak Devji's teachings and philosophy are more relevant in the times we live in. Thank you, Mr. Speaker. Thank you. The member from Kitchener, Conestoga. Thank you, Speaker. When is a Liberal government pocket-fleecing tax, not a tax? Well, when it's met, head on with a wall of opposition and inbox exploding email campaigns that awaken government to the absurdity of their dream-crushing tax plans. Speaker, this week we saw one of the quickest U-turns in history when the municipal affairs minister bowed to demands of the municipal land transfer tax opposition motion tabled by my colleague from Leeds Groundville just two days before it was debated. It took a massive wave of e-opposition and weeks of pushing in this house to break through, but in the end the minister simply couldn't stand up to the outcry against the expansion of the municipal land transfer tax. The about faced by the minister was a testament to the true democratic power of the people in rising up to oppose wrong-headed proposals that would crush the dreams of those looking to buy a home. It was a victory for all of those who stood against a proposal that would have seen people in my area of Kitchener Waterloo forced to pay up to $10,000 to realize their dream. After refusing my colleague's repeated request to shelve any plan to expand the municipal land transfer tax it was heartening to see the united voices of the people finally being heard when the minister climbed down only days before he would have been forced to defend what he obviously realized was a simply bad policy. So Speaker, I want to recognize all who refuse to sit silently while government dug further into our pockets to the home builders, the real estate agents and those who raised their voices in an MPP email box. Thank you. Member Stevens and Member from Nicobelt. Well we all know that Christmas is right around the corner so I want to share with you my Christmas wish list for Nicobelt. First, I wish that no train will derail, explode and spew hundreds of litres of crude into any river like happened in March 7 in my writing in Gogama. I wish that the oil would stop coming up the Mokimi River in Gogama. I wish that the people of Gogama would get support from their government to be fairly compensated and I wish that somebody would tell me that it is safe to eat the fish. My fifth wish is that the North East continues to have a search and rescue helicopter based out of the Sudbury airport. This way we can ensure the safety of our hikers, Kastron Trisky or Snowmobiler and I wish that if the government is doing a review of this decision that the terms of reference and minutes and who works on that is happening because the elves in my office have failed, filed freedom of access of information requests but nothing is coming back. I also wish, Speaker, that the people living along Highway 69 where the blasting is happening for the widening of the highway get fair compensation when their house gets destroyed by those blasting and lastly, Speaker, I wish that the people of one of the First Nations don't have to drive to two riding and hours and hours of drive to get service from their MPP and that they get moved back into the riding of Nickel Belt like at the federal level where they belong. Thank you. Thank you, Mr. Speaker. Well, I rise to actually deliver some positive news from Kitchener Waterloo. Wow. As you know in my riding of Kitchener Centre, the tech sector is flourishing. Today I'd like to share with you news of a tech startup that's developed a remarkable innovation that's designed to keep kids and drivers safe on our roads. Sober Steering is the name of this company and they've produced a new sensor technology that could make breathalyzers obsolete and here's how it works. Sober Steering uses a biosensor in the steering wheel which detects the driver's blood alcohol level. So to start the engine, you have to put your palms on the steering wheel. The sensor measures alcohol in your system through the skin and if alcohol is detected then the engine won't start. The company's Chief Operating Officer Catherine Carroll says this technology could revolutionize the way that we monitor drinking and driving. Sober Steering is currently targeted for school buses but it could also be used on public transit, construction machinery and so much more. I'm pleased to tell you that Sober Steering got off the ground in 2009 with an investment from this province. Researchers at the University of Waterloo helped to develop the technology. Currently there are three school bus companies in Waterloo Region that are testing the system in a pilot project. This company I believe has a very bright future and I'm so proud of the people who work there and all the other innovative businesses in my region that are developing creative solutions and creating jobs. Thank you. Thank you. Further member of sustainments? The member from Farnhill. Thank you very much Mr. Speaker and I'll continue the tradition with a little poem. The holiday of lights is here. Good friends and happiness to share. Sweets with honey for us to eat. Candles to light and friends to greet. One little candle, two little candle, all the way to eight little candles to celebrate the eight days of Hanukkah which is going to be upon us this Sunday December 6th at sundown because the Jewish holidays pretty much always start at sundown the night before. Now this little poem I've actually never heard before because it's not an English Hanukkah song. It's not a Yiddish Hanukkah song. It's not a Hebrew Hanukkah song. It is actually from a Spanish Hanukkah song which is called Una Candelica and so you can imagine how it goes Una Candelica, Due Candelica and Candelica we all know what can be translated easily into candle. So what I want to remind everybody here is yes Hanukkah is being celebrated but the Jewish community is not just here obviously in Ontario. It is found all over the world in every culture and pretty much every language. So that means people will be singing Hanukkah songs in every language across the world starting December 6th this year since it follows the Jewish calendar which makes adjustments as we all know and likes to confuse everybody including the Jewish community. So Chadsameach, Happy Hanukkah and I'm looking forward to celebrating with people in Thornhill many events going on all over the GTA, Ontario, Canada and the world. Chadsameach. Good afternoon Mr. Speaker. I rise today in this house to recognize the outstanding seniors who are this year's Ontario Senior Achievement Award recipients. Ontario acknowledged 21 outstanding seniors for their significant contribution to their communities and to the province. The Ontario Senior Achievements Award recognizes individuals who have made exceptional contributions to their community after the age of 65. It is the highest provincial honour for seniors that is important to acknowledge that in 2015 for the first time there are more seniors 65 and over than children under 15 both in Ontario and across Canada. In Ontario there are currently more than 2 million seniors and this number is expected to double in the next 25 years. The awards were presented at a Queens Park ceremony by the Honourable Elizabeth Dowswell, Lieutenant Governor of Ontario and the Honourable Mario Sergio, and his affairs. I'd like to highlight a recipient of the awards who is my constituent from York Centre. Ekaterina Latkina is an active volunteer with the Jewish Russian Community Centre. She is responsible for the mailing and operations of the organization making sure that thousands of letters birthday greetings and invitations and tax receipts are prepared, signed and delivered on time. As Ontarians we should take inspiration from these seniors who have made such diverse contributions to their communities. They are a constant reminder that life is long and that no matter the age the potential to bring about positive change is always possible. Thank you Speaker. Thank you for the member students and members from Beaches East York. Well thank you Speaker and it's my pleasure to honour Patricia Hung today a constituent of Beaches East York and the first ever Parkview Hills Citizen of the Year. The Parkview Hills community has represented residents of Parkville Hills in the northwest corner of my riding for the past 25 years and until just a few weeks ago it was headed up by my good friend Justin VanDette for the last seven years. Before exiting as the president he launched the Parkview Hills Citizen of the Year award and also helped kick off a $25,000 campaign for the Toronto East General Hospital which as you may have heard recently has changed its name to the Royal Garin Hospital as a result of a $50,000,000 donation by the family to the hospital. Now so congratulations Justin on your very successful tenure as the president and we're glad that you're staying on the board and I also want to best wishes to Leigh Ann Reid the new association president and the board but let's just talk briefly about Patricia a self declared do-gooder she's a police officer, an author an inspirational speaker and a tireless volunteer and a direct loss of her daughter Stephanie in 2008 Patricia began the healing process by helping others from holding workshops, sitting on victim adversary committees to contributing to her blog The Joy in the Aftermath Patricia has been helping families who have been impacted by tragedy finding hope. In 2012 she also launched Quality Care Employment Agency a volunteer organization which recruits live in caregivers for children and she's been a part of her well deserved award Parkview, Citizen of the Year Congratulations, thank you to all of the members who have made statements today it's now time for ... ... ... ... ... ...


Parents and their children streamed in to the WJCT Studios Monday evening as the Harvey Bernhardt Foundation celebrated its seasonal tradition of random acts of kindness. The foundation, along with the Boys and Girls Club and Big Brothers Big Sisters had quite the surprise waiting for the kids in 79 brand new bikes from Academy Sports. One chairman, Wesley Bernhardt, said donors, many of them anonymous, made it all possible. Christmas can be a very tough time, especially for so many children in the northeast Florida area that have so little and it's nice to be able to give them something that can make them feel good around the holidays as well. The parents lined up at a hidden studio in the back of WJCT and then brought the bikes into the main studio to the delight of everyone, including Trinity. It's pretty and it's pretty to see. The Harvey Bernhardt Foundation's mission is to provide one-time financial assistance to families or people with hardship cases, such as natural disasters, medical issues or even victims of crime. Billboards Field 89-9 WJCT News.


good morning everyone I feel so weird with this shirt on so basically happy Monday everyone welcome back to another Monday in my life vlog we have Coco here because as you guys can probably tell oh sorry she needs to be groomed so bad so I'm dressed right now very unlike me I'm wearing all Lululemon that's not very unlike me but my top is I never wear these because I was like oh my gosh I'm running mom errands all morning so I'm gonna dress like a mom and I realize that today's Veterans Day so I need to go to the bank that's closed I need to drop off film that's closed so I'm just gonna work from home for the morning I'm going to the studio today I'm recording three podcast episodes and then as always Pilates tonight but hi if you guys are new here be sure to subscribe I think I actually am gonna have a haul from Express as well today which is very exciting because my last package came in I had two separate packages and I've already worn I wore the dress yesterday the outfit was so freaking cute and I didn't get a photo in it and I'm really mad at myself but you guys will see because it's just really cute stuff so anyways I'm gonna listen to the rest of my podcast I'm listening currently to the Hillsong creative podcast this is a really really good one I need to get home my hair is drying I'm gonna drop her off come back home get ready I've been reading all morning it's been a good morning it's currently a 52 and we're going to take Coco to get pretty are you excited she's not oh she actually looks so cute right now hi hi oh my gosh hi alright guys I'm home I just did my makeup I was on the call Bank of America I thought I had all this travel credit but I guess when I redeemed it I already needed to pay my credit card I don't know I just basically learning you know adulting so today I need to book my flights for Christmas and just get a bunch of like computer work done and everything so I'm ready I really am guys I'm dressed like a mom this is so not me but it's very exciting I got some packages my final package from Express so many guys show you quickly a little bit of a haul from Express alright guys so I'm in my office as you guys can see but I'm really excited to be partnering with Express on this video Express has really really great clothes I one of my favorite pajama sets that I've ever owned which if you guys know me you know I love a good pajama set that is like my favorite thing one of my favorite sets that I've ever owned is from Express so I've been a big fan for quite some time I've worked with them before so you guys know that I love them so I'm partnering with them on their fall college campaign so these outfits are like comfy clothes that you can wear to class they have things you can like wear to tailgates and like pretty much everything they have it's like ready to wear you always have something basically you guys will see what I picked out you guys know I love outerwear so I got some outerwear that's really cute I got a nice blazer dress if you guys are going out for interviews or anything like that or just like nice formals and stuff okay so I'm gonna show you guys what I picked up I'm gonna have everything at linked down below if you guys want to shop it I really think you guys are gonna be obsessed with the sweater it is so soft this is what I've been waiting for to film this video because I just didn't want to leave it out it's so comfy I'm gonna have it linked down below I got this in a size large but it is seriously just like the coziest comfiest sweater and a lot of the time with these sweaters I'm a little bit afraid that they're gonna be like itchy or uncomfortable or whatever and this is the material is not the kind that gets itchy or hot this is the really soft like so cozy I cannot wait to wear this to class like oh my gosh it's just so cozy and so soft I'm gonna have it linked down below because you guys are gonna be obsessed with it but love this I also got this jacket I'm gonna stand up to show you guys so you guys know I love how to wear this is just super cozy and cute to like throw on over something honestly even over like a really you can dress this up and wear it so many ways you can even throw it on on top of like what I'm wearing today and it looks like you tried harder I honestly might do that actually but it's so cool it's really cute I think it's like a little bit different than your average like black and white coat as well it's not too thick so you can layer sweaters underneath it scarfs all that stuff the quality is amazing and I love it I feel like this is just perfect okay so this jacket is great because it's very versatile so you could wear it to class you could like dress it down for class kind of with what I'm wearing we're like all black and then this you know so this is really really cute I love this especially for the holiday season and stuff I know I'm gonna get so much wear out of that okay this jacket is so fun like I'm obsessed with this I'm I'm going to New York in December and I'm gonna just for sure wear this cuz it's just so cute so it's this little coat with on the sleeves this blue little fur it's also so soft like guys do you see how cute this is it's just so freaking cute like I cannot get over it I'm so obsessed with it I love it oh my gosh and especially if you wear this and then you wear like a dress underneath it and then like boots like oh my gosh I love it it's adorable I love this especially for the holiday time so if you have like cute holiday party or you're like me and you just like to dress like cute anyways or like family events and stuff over the holidays this is so perfect it's so cute the sleeves just make it cuz it's like a classic coat it would be cute without the sleeves but then this happens and you're like this is so cute so love that okay the last thing I got this is so great because a lot of you guys I'm sure are going out for interviews or maybe you're giving presentations or what not this is just a the laser dress I wore yesterday so I need to zip it back up not zip it back up find it back up okay so it's just your classic classic laser dress it's the perfect length I wore it with a treble neck underneath I dressed it up with some jewelry I wore like over the knee boots and I got a lot of compliments on the outfit okay people but it is just the cutest thing I think it's so classic and I also think like as you graduate or just in general it's really important to have something like this in your closet that you can just throw on you could also so dress this down and make it like cuter have like a little like cute moment with some sneakers dress it down with accessories like have your hair kind of tossed and stuff you can wear this so many different ways truly it's a staple in my closet now so that is it for my next dress haul I hope you guys enjoyed I'll have everything linked down below check them out they're really great if you guys are in college I would definitely check them out because so now I need to get some editing done I am waiting on a call back from American in the next however many years basically I want to switch our seats together to be on the plane for Thanksgiving and I need to book Coco's flight I also need to book flights home for Christmas today so the holiday season is really upon us guys I just like cannot wait all right guys so I just finished editing my week in my life vlog and I made the thumbnail as well it's 1140 I booked our flights home for Christmas I just did a bunch of random email stuff I have the vlog edited I'm going to edit some footage or import some footage I'm waiting for Coco to be done at the groomer I have to leave here and like a little bit less than two hours and really all I have to do is change and pack a bag for Pilates tonight which I'm excited for as always I haven't gone grocery shopping and I think I'm probably gonna have my groceries delivered this week so I just sorry they're mowing the lawn it's so loud so I ordered stuff from Caviar this is so loud I'm getting so excited for vlogmas with all this stuff guys I have so many videos already ready and prepared okay guys so I just really quickly cleaned up my room a little bit as you guys can see I just swept and wiped off the floors and clean the mirrors and stuff so I changed for the day I'm just wearing this white turtleneck it's a bit see-through but I'm wearing a coat over it my hair is still drying so ignore that I haven't worn this necklace in a bit but I wore it yesterday for the first time in forever comment down below if you guys remember it it is just like the prettiest cross necklace from the M jewelers guys seriously like it's just so cute alright so this is the jacket that I have on I don't know how hot it is outside so I don't know how much I'm gonna wear it the lighting this way is always better for outfits but here is a better look here's the 15th look in my outfit but as always lighting is better in here so I'm off I feel like a true mom right now really been feeling very maternal lately I'm gonna pick up Coco oh my gosh this is happening at everyone else this is so annoying Princess Coco hey Coco hey she looks so cute with a little pink handkerchief don't you my tindergreens order just took literally two hours to arrive I really want to stop by Starbucks on the way so I'm gonna eat this hopefully leave in like five minutes when I finish watching Keaton's vlog but yeah so frustrating alright guys so I just finished lunch I'm about to head out so I can get my Starbucks on the way I cannot believe it took that long to deliver alright guys Morgan created this drink basically um so it's like the peppermint cold brew they have the pumpkin cream cold brew which I got into which is crazy cuz I this is how I know that I'm like not as healthy as I once was stuff like that used to like kind of gross me out because it was just so like heavy and like whatever cuz I was eating so clean and now I just now I'll drink it so but that's not for everything like I still can't drink chives and stuff anyways I'll do a little taste test and see if I like it oh my gosh it's so good wow it is so good so this drink is a sweet cream cold brew with peppermint it is so good guys oh my gosh yeah all right guys I just filmed oh my gosh didn't film I recorded my first episode and now I'm recording a solo episode the first one I just recorded is a Sophia and it was so good I'm very excited for it so now I'm about to record my solo one all about hustle culture very exciting play it by here after do the thing with Connor I don't know how I don't know how long it'll take any of it takes he said I'll take like 10 minutes yeah shouldn't be too long okay perfect we have asked this week oh my gosh guys it is so dark it's so crazy because it's only like 6 p.m. so I'm about to go into Pilates I had the best recording sessions today like I'm just so happy I didn't vlog as much in the studio as I should have literally at all I hate when I do that but the recordings were really great like when I leave the studio I'm just always in the best way I always say that but I'm always in the best mood and Quentin texted me and he's actually like over by where I live well he's actually my house now so he was like what are you doing so so after Pilates we're gonna order food and just hang out and I'm gonna do random stuff that I need to do so he's gonna cook it right now which is great because I don't like leaving her home by herself I mean I have to like by the nature of like being a human being but normally there's like someone with her like she's not really home for like more than like four hours by herself or whatever so he's hanging out with Coco I'm gonna get a Pilates with daylight I'm so sorry it is so dark I'm really excited about the new podcast episode and yeah I'm going to Pilates I recorded three whole episodes today normally top-cell record to a solo on anti- household culture one with Sophia Rossi and then one with Eric and Roman who I like love they are Zoe people and I'm just so excited like these are just such great episodes I'm like so excited for you guys to hear so I love you guys I'm in a great mood and I'm gonna go change okay guys I'm out of Pilates now I've realized that when I was editing my vlogs that it keeps focusing on the steering wheel and not on me it was a really great workout I am taking from daylight every single week every single day this week which is really great also look at this really cute small essential water we have them at the studio right now but great class I'm heading home I need a shower self tan I've ain't quintupled my house so we're gonna order some food because I didn't have time to go grocery shopping today and I don't really love ordering from Whole Foods it's like so much more expensive so I'm gonna blast music and roll all my windows down in my stoner down it's like my favorite thing after you work out does anyone else do that and it just feels so good and you just feel amazing and I love it so I do back at Pilates at 7am tomorrow so I basically just leave for like a few hours you know also guys I'm so into summer walker right now like I'm obsessed with our music I just got out of the shower I self-tanned we ordered food I'm wearing sweats these sweats are actually like so comfortable they're champion spots they're from bootleg labs but they're like actually champion so it's a Ritzki a crew knock I feel really great I got new blood rollers and they're like many that you can put in your bag which is so convenient so I'm very excited about many purges I got these on Amazon so it is currently like what time is it 8 p.m. I'm just gonna get some editing done we have some fall candles burning I think Quinton was working on a soft top before but yeah I'm just gonna get some more editing done do some computer work wait for our food to get here just kind of chill tonight fun fact as you guys have probably seen Quinton always plays the food every single time so we just stored ash I'll have credit down below I'm in the description if you guys want to get credit you guys like $20 free food and delivery and whatever Quinton really wanted on you rain so oh okay I'm glad we didn't get two orders of sweet potatoes fries not sweet potatoes because it's a lot also love the hoodie do this but wow look at you go so this is what we're eating tonight it's 846 just eating dinner alright guys we just ate um it's like nine we're gonna watch a show and then I'm probably gonna fall asleep so hope you guys enjoyed this vlog check out the close from Express I'll have everything linked down below I'm so tired love you guys bye


Hello and welcome to the session in which we would look at two adjustments to income, which are moving expense for members of the armed forces and the penalty on early withdrawal or savings. I'm going to keep this penalty on early withdrawals and savings till the end of the session. I will discuss more the moving expense and the moving expense is only specific for active members of the armed forces and they have to complete the form. 3903. Now this is part of the adjustment. So those two adjustments notice their online 13 and 17 on form. Schedule and schedule one form 2020. Now again, if you're dealing with 2122, they should be still an adjustment, assuming the law does not change, but they might be in a different place. Now again, once we add up all the adjustments, let's assume all of them at up to 2000. The adjustments, let me just, you know, let's assume 1000 for moving expenses and 1000 for penalty on early withdrawal. That's stiff penalty, but that's okay just to make the point. Total adjustments of 2000. Those adjustments goes on adjustments to income. Schedule one, line 22, 2000. They are before. They are before you get to adjusted gross income. So those adjustments are for AGI. This is important. So if your total income is 50,000, you can deduct 2000. You can deduct 2000. Then your adjusted gross income is 48,000. So those are for AGI. That's important. I know I keep repeating this every time. And the reason is simple. You want to understand which adjustments are for AGI and which adjustments are from AGI. We haven't discussed those yet. We will discuss them later because some of the questions on the CBA exam, on the enrolled agents exam, are to determine whether this adjustment, this deduction is at for AGI or is it from AGI. It makes a huge difference. Okay. Now, if you are a CPA candidate, accounting students or an enrolled agent, I strongly suggest, especially if you are a CPA candidate, to take a look at my website, farhatlectures.com. I don't replace your CPA review course. You can keep it. I don't replace it, but I can be a useful addition to your CPA review course. I can add 10 to 15 points to your score by explaining the material differently, by helping you understand the material differently, which in turn will help you tremendously on your CPA review course, which in turn will help you pass the exam and improve your score. Your risk is one month of subscription. Your gain is passing the exam. I will take that offer if I was giving that offer. $30. Maybe I can pass my exam. And if not for anything, take a look at my website to determine how well your university is doing or not doing on the CPA exam. I do have resources for other courses as well. Please connect with me on LinkedIn. If you haven't done so, like this recording, share it, connect with me on Instagram and Facebook. So let's take a look at the moving expense deduction. Okay. Now, the Tax Cuts and Jobs Act of 2017 suspended this deduction till 2025. So the only people who can take the moving expense deduction are active U.S. armed forces. In this topic, you used to give students a lot of trouble. The student hated moving expense deduction when I used to teach it. You know, students did not like that topic. So it's suspended till 2025. And who knows, it might be suspended again or changed. But for now, you don't have to worry about the moving expenses, except for the rules for the armed forces, which are much simpler than for private individuals. So let's take a look at the rules. The moving expense deduction and the execution applies to members of the armed forces and they have to be active members on active duty, not on active duty, their spouse and their dependent. And we'll define under what circumstances, as long as their spouse and dependent are member of their household, of course, you cannot deduct, obviously, and you can deduct only unreimbursed moving expense. You cannot deduct reimbursed moving expenses. So if you spend the money, then they gave it to you as reimbursement, you cannot deduct it. So you can only deduct the amount that they did not reimburse you. Obviously, but we have to state this. Okay. And it has to be a permanent change of state station. So if you're in the armed forces, they might move you from one state to another. So it has to be permanent and move from their home to their first post of active duty that that that is that is they can take the deduction either from your first move from your home, a move from one post to the other. So you were, you were, you were stationed in Hawaii, you moved to Alaska. Well, that's that's also a sport of your active duty. Those moving expenses are deduction, a move from your last post to their home, or to a nearer point in the United States. Again, that will apply in the move must occur within one year of ending their active duty or within period allowed under the joint travel regulation. If you are in the armed forces, you know, what does that mean? I really don't know. But you would know if you're in the armed forces. Now this is those are what qualified ads move. Now we're going to also have moves outside the US, which we'll talk about in a moment. So what happened if the government gives you any reimbursement or they provide any services to you? Well, service member would not include in their income the value of moving and storage services provided by the government because of the permanent change of station. So if the government pays for it or they provide you any benefit, you don't have to include that benefit in your income. Also, you would not include income amount to receive as a this look at this location allowance, temporary enlarging expense, temporary enlarging allowances or moving allowances. Also, if they give you money for those purposes, you will not include them. However, generally, not generally, if the total reimbursement or allowance that service member received from the government because of the move are more greater than their actual moving expenses, the access will be included in their W2. So if they give you more money than what you needed to move, then you will include that. If any reimbursement or allowance other than this location temporary lodging, which are this part here or moving expense exceed the cost of moving and the access is not included under wages. If they did not include under wages, then you must include them on your in your income on your gross income. So if they gave you more, then you will include it if it's not in the W2. That's it. That's simply what we are saying. Now, what can you deduct? What about expenses? So service members can deduct the expenses of moving their household goods and personal effect, including expenses for hauling a trailer, packing, creating and transit storage and insurance. They cannot deduct any moving furniture or other goods that were purchased on the way from their old home to their new home. They cannot deduct any new purchases on the way there. That's not included. And you can only include the cost of storing and ensuring their household and personal effect within any period of 30 consecutive days after the day these goods and effect are moved from their former home and before they are delivered to their new home. So you have 30 days to basically move. So this is the this is one expense moving expenses, moving your furniture, so on and so forth. You don't have travel expense transportation. Okay, so you can deduct traveling expense, including lodging but not meals.  Okay, that include car expense and airfare. They can deduct if you're taking your car expense, you can deduct either actual out of pocket expense such as gas and oil and you obviously have to keep track of that or standard mileage, whatever that standard mileage for the year it that year is it happens to be 17 cents for 2020. Now again, every time you see here in my lecture, those figures might change if you're looking at 2021 2022 2023. Obviously, this will go up unless really the oil go go down in price. Okay, so they can add any parking fees and tolls. Okay, so parking fees and tolls are independent whether you would use the standard mileage or the actual expense. You cannot again deduct expenses for meals, nor you can deduct any expenses, unnecessary side trips or very expensive lodging. Okay, those you cannot deduct. So it has to be reasonable. It has to be reasonable. What about if you are traveling overseas? Okay, for a foreign move, foreign move means means outside the US or any of the US possessing. For example, you're moving from here to Germany to Europe or to Japan. The deductible moving expense described earlier are expended to include reasonable expenses such as moving the service members household and personal effect to and from storage. Obviously, if you're going away overseas, you might put yourself in this, you might put your stuff in the storage because you're not going to take it with you. And storing these items for part or all the time the new job location remains of the service member main duty. Now while you're away, you want to keep them there and you have to pay. That's considered reasonable expense. Therefore, you can deduct those. The new duty location must be outside the US obviously because we are talking here about a foreign outside the US move. Now who is considered spouse independent? A member of the service members household is anyone who has both the service member, former's home and the new home as his main or her main home. So that's your main home. Then you are part of that household. Okay, it does not include a tenant. If you have somebody renting your place, that's not part of your household because they are technically a tenant or an employee, unless that person can be claimed as a dependent. If that person is your dependent, then that's a different story than their part of your household. So this is what, you know, spouse and dependent. So anyone living with you as long as you can claim them as dependent, they're part of your household. Now, you have to complete a form called not form, form number 3903 moving expense. Let's take a look at this real quick. So notice you have transportation and storage and you have traveled and you add line one and two. So simply put, do not include in line one through three expenses for moving services provided by the government also do not include any expenses that were reimbursed by any allowance that the member does not have to include in his or her income. So you only include the qualified cost here. Let's assume it's $1,500. So total line one and two is $1,500. On line four, enter the amount the government paid you for the expenses listed on line one and two. And that is not included in box one of your W2 wages. This amount should not should be shown in box 12 of form W2. So simply put, let's assume you incur $1,500. The government paid you $800 of that. They reimbursed you for $800. What's left is $700 obviously. So this is what happens. So you're moving deduction becomes $700. Now if they pay you more, then you're moving deduction that it's not included. Then you have to go back and include that income. So if they paid you $2,000, then guess what? You don't have any deduction and the difference should be part of your income, should be part of your income. Now let's move to the penalty on early savings. Penalty on early savings, when does it occur? When you have a certificate of deposit in the bank or some type of a savings account, you know, CD means certificate of deposit. You have to hold it for a period of time.  It could range from three months to five years. Often the rules associated with this financial instrument is you have to keep them there. You are entitled to the interest only if you keep them there. For example, if you have a two-year CD and you took it out before the two years because you needed the money, guess what? This is called the premature withdrawals. And as a result of this premature withdrawals, they will give you a penalty.  So if the taxpayer incurred an early withdrawals of savings penalty, the taxpayer is entitled to report this as a deduction for AGI online 17 right here. Again, the line could change, but this is where it is now online 17. And this is usually the assumption here is you took the money because you had an emergency. Why would you take your money if you did not have an emergency? Therefore, the government is giving you a break. That's the idea behind it. That's the basic idea.  I can help you understand the material differently. I can provide you with an alternative explanation as well as resources. Take a look. Give me a chance. I might be able to help you. One month of subscription you find out. You don't want it, you cancel. Too bad. You lost one month. You want it. You keep it. It's a subscription and you will pass your exam. Move on with your career. Good luck. Study hard. And of course, stay safe.