My name is Isaac and this is Ian, and we're going to speak today about uh, VoIP botnets. Um, a topic which is very popular nowadays, nowadays all the VoIP getting into more cooperates and companies, not always people understand the risk involved with implementing VoIP and the controller associated with it. So, um, this is kind of our research into the area to see what can be done using the VoIP capability. It's not for a specific protocol, it's not for a CIP or, or a Skypey, but it could be leverage, uh, either. And, uh, we're going to show some demos of how we can do stuff over VoIP, um, it's going to be very cool. So, Ian. Alright, let's kick this one off. VoIP. Intro to VoIP. And this is not an intro to VoIP talk. Alright, heard that. Alright, so we're not going to do an intro to VoIP. VoIP is everywhere. Um, we've got tons of residential VoIP providers such as Skypey, Avage, Phone.com, Uma. They pop up like mushrooms after the rain. Uh, obviously in corporations, it's really the factor standard. Uh, all the internal communications for every company that I walk into today is VoIP. Uh, Cisco, Avias, the Alcatel Lucent, whatever. It's, it's a vendor fest out there. Um, and it just works. Now, one of the biggest problems of VoIP is that it works so well. Okay? You get a vendor in, it drops a box, turns it on, and it works. You start plugging extensions, having fun, conference calls, trunks, everything's very easy. Uh, even the free stuff, like asterisk. Okay? You just download the VM, it's already made, it's, everything's installed. If you have a Digium card, recognizes it, trunk it out, and get a SIP provider, or, or just a plain old PSTN. That's the biggest problem of VoIP in, in our view. Uh, because that basic configuration is just not good enough. No one takes care to actually fully utilize the capabilities that VoIP provides you in terms of security.  It's just, kind of, and, and people just don't care, because it just works. SIP is the protocol that we like to play around with. Anyone here that doesn't know how HTTP works? Get out. Alright, so if you know HTTP, you can basically know SIP. Alright, it's a, it's a request response protocol. Forget the fancy graphics behind me. It's, it's really simple. If you want to, again, read more about it, Google it, um, because this is not a interest with SIP talk either. So what's new with VoIP and security? Let's dig in. We're going to talk about two issues or two eras of research that we've been digging into. First one is VoIP is a getaway car. We'll see some interesting techniques that relate more to data exfiltration and back channels and see how VoIP can be utilized to do that and how people are doing that. And the second topic, which is really cool is VoIP botnets. We're going to see how VoIP can be used as a command control channel to message between a bot master and a lot of bots. So let's start off with a getaway car. So, VoIP can traverse firewalls very easily. Alright, that's by design. It can pierce nets. It can go over PSTN. If you're in a confined environment, let's say, of a very secure network that doesn't have an internet connection, but has a VoIP network on top of it, there is some PSTN line that allows that VoIP network to go out and make calls and receive calls from the outside world. And on top of that, no one really looks at VoIP. You're really looking hard at your web traffic and email traffic because you've learned that all the bad stuff is there. That's where all the lulls are. Voice over IP is kind of just works, which means you can X-Roll trade. You don't have to go through the hoops of transcoding your data and modifying it and encrypting it and trying to hide it and kind of sift it, drip it bit by bit to avoid pesky stuff like DLP and stuff like that. You can just use version of IP to push the data out. Second topic, voice botnets. We're kind of rushing through this to get to the meaty stuff and also because the demo is really prone not to work. It worked what? Twice at the office? That was like six months ago? Yeah. It billed on us at B-Side, so we're really hoping and we gave it at a church there. So all our prayers weren't answered. Hopefully this is going to be a little better. So voice over IP botnets. Basically take your Google standard botnet, disconnect all command control channels. All the bot hunters these days look for specific communication. They look for IRC, for HTTP, they're looking for specific domains that host all those command control servers and they're doing a phenomenal job. I know that. I'm dealing with that on a daily basis sometimes. So disconnect all those command control channels that everyone is looking at and replace with voice. Simple so far, everyone on the same page. You get a command control channel that's fully mobilized. Net piercing, no problems in terms of running through different networks. It looks really legit because it's voice over IP traffic and we established that no one really looks at voice over IP traffic and worse come to worse you'll see some phone calls coming in and out and some discussions or sounds going over those phone calls if you really care to listen up to them and it's really harder to pick into. Again if you do start looking at the actual communication you need to start deciphering what's going on over RTP and other streaming H3 through 3 whatever and start buffering it, decoding it, figuring out what the hell is going on there because we're not talking about actual data, we're talking about sound. So this is all streamed. Well everyone actually needs a voice botnet. When we look at what is being done right now from the criminal side of things, most of the work is focused on establishing secure channels, back channels, stuff that's not going to break, peer-to-peer communication so that when my one point of failure fails, my botnet doesn't just disappear from the face of the earth. The botmaster is literally more mobile using a voice over IP channel because you can actually walk around with a cell phone or pop into some phone booth, dial a number and connect to your botnet and issue commands. So it really detaches the botmasters, the bad guys from their laptops and their command control servers. They can come to Vegas. It's much more anonymous and what we're demoing and what we're looking at is command control servers that are actually conference call numbers. You can get conference call numbers for free, no identification, no nothing. You can set up your own pretty easily. I mentioned asterisk before, phenomenal, right? And it's already. Just pop a VM, not pop a VM, like tech a VM and put it somewhere, use it and you have a SIP communication really made. And if you really want to go through trouble, you can actually get a real phone number, cost you a couple of bucks a month and switch that straight back to the conference call number. And you can actually transfer fair amounts of data in and out. If you guys remember, I know I do good old modern days, it's actually pretty fast.  And it is starting to show up as an alternative method of communication. We're seeing that already. So anyone who nods too vigorously right now, someone can grab him and take him to spot the fed. So let's see what, all right, botnet in action. We're being lazy today?  We practiced this. Red team testing is one aspect of this, where we're using it, where other people are starting to use this, looking more carefully into those channels. And you will find, not you can find, you will find stuff that will make the hair in the back of your neck just go scary stuff. Botnets in no internet or closed networks. I mentioned before, especially and we're going to see that in the data exploration technique, ways to communicate outside of non networked networks, if it makes sense. Basically, high security networks that are fully disconnected and air gapped from the internet or from other networks. Okay, if you see voice or IP somewhere in there, just to facilitate internal communication or just phones, you can get out. Okay, and you can have a lot of fun there. And the last thing is botnets for voice or IP phones. Okay, we're starting to get smarter and smarter phones. They're not there yet, but that's, you know, it's an attempt. And these things actually start to run SIP and voice or IP. And they're powerful enough to be considered as PCs that are worthy to participate in a botnet. Okay, we're connected to high speed networks, 3G, often Wi-Fi, why not use them to as part of the botnet that does DDoS or whatever it is. Are you okay now? Yeah, I'm great. Thanks. Okay, so we're going to see how exactly this white botnet can actually be implemented. So the first thing we have to keep in mind is we're looking on the telephony system, which has not been changed in the recent years, and basically have two ways to communicate. We can either have the botmaster calling each of the bots individually and send them commands. That would be a very ideal channel for a private conversation. But again, since the botnet will grow larger and larger, the test to maintain these phone numbers, these identifier of the bots is harder. So the Unicast method would not work for this kind of botnet. What we're going to try to do is to create a similar to an IRC channel field over the telephony system, and we're going to use it during a conference call concept. So a conference call is a very simple concept. Basically, you call in, you get to participate in a conference with other people. And whatever you're saying, they can hear and vice versa. This is a very ideal IRC style channel over VoIP. Basically, we have a conference call. Conference call can have a PSTN connection, which means you can call it from a pay phone, your mobile phone. So basically, you have a way to get in. It's also accessible. Some conference calls through pure SIP. This means you can have a pure TCP AP connection to the conference call. And at the same time, have a person using a pay phone somewhere in New Jersey. So it's a very ideal infrastructure when you're going to use it today to emphasize the VoIP botnet. So this is an example of a very simplistic conference call. You can see the bots are dialing to the conference call. They can either dial through SIP or they can actually have other access to the conference call. And the botmaster, as you can see below, it can either use a pay phone, a throw away cell phone, or it can actually use SIP as well to get on the call. So like I mentioned before, the interesting concept about VoIP is that they actually bridge together two different entities. We have the PSTN, the Telephone Network, which is like the internet. It's external. And many people can get into it and from it. And then we have the internet with it. So basically, both the bot and the botmaster has to make a choice and they can use either PSTN to call the bridge and get online or use the TCP AP option. The most interesting idea over here, and we're going to get to it a little bit later on, is that we're going to use only technology. I mean, if you're going to use the PSTN and you're going to claim that you can operate the botnet using a pay phone in New Jersey, we're also going to stick into telephony style technology, which means it will be accessible and the botmaster could control the botnet using a standard phone. And that's a very interesting thing that you're going to see later on. So basically, all the demos we're going to present has already been, it's not theoretically demos are practical. And you can of course download your copy right now. Mushy Mushy is actually alone Japanese and it's basically the botnet that we're going to demonstrate today. The interesting stuff about how Mushy Mushy's works is it's going to use SIP as the wide protocol. But again, it's not limited to SIP. It's just for the easy views. We're going to use DTMF tons for input. Again, to emphasize that even if you make the call through PSTN and you have no internet connection and it's a pure telephony system, you can still communicate with your bot and get it to do what you want to do. And of course, since the telephony system is not visual, the bot cannot per se give you an image of the information or have it displayed to you in a very convenient way. You're going to use text, speech ends and engines as an output method. So basically we're going to punch some numbers and the bot is going to speak back to us. Okay. So DTMF is just one of the ways that you can communicate over the funds. The reason why we choose DTMF is because it's a standard. It means that you don't have to do any predefined negotiation. It will work from my phone, your phone, the pay phone outside, and et cetera. This means that actually the bot can be communicated with from any phone that is that has DTMF tons in it. This is a very interesting feature. And in early conversation and debates we also had people asking whether the bot can use DTMF to response back. Well, the answer is yes. The bot could use DTMF to response to the bot master. However, that's not going to be graphically visualized on the bot master phone. So he would have to use a special software to decode it back. Now I know in iPhone and Android there's tons of software like that, apps that do it for you. But then again, it's not generic and it won't work for a pay phone. But yes, it is possible to do DTMF both way. Much like Ian said, we're going to show demos. We're going to have like a two-letter setup over here. Ian's computer is going to be the actual PBX which I'm going to dial to. And my computer is going to be the actual infected bot. Now again, like Ian said, there's very interesting thing about the void because you can get it instantly up and running in a matter of minutes. We actually did it the same way. We didn't took the time to study asterisks or design our own PBX. We simply went and get the first thing that supposedly work in five minutes and it is working in five minutes. So we're cool with that. What you have to know if you're going to build your own conference call, you're not going to use an only existing one, is that you have to pass the DTMF to the other participates. Now, normally in a conference call, if you ever have to experience that, whether you punch up numbers, it's actually a command for your user. For instance, you can mute yourself, you can skip another conference call, and etc. So per se, DTMF won't rely to other participates unless you're going to configure it that way. So for our demos, we're using asterisks, now Linux distribution, and to simply to have the DTMF relying to other participates, we just edit extensions.conf and edit the F in the meet me is the conference call bridge for asterisks. If you're going to use a commercial conference call or any other conference call that you have in mind, check out for this feature, you have to configure it in order to get the bot running. So the idea that we're going to present first is how to use the DTMF passing, like I said, it's going to be a very simple demo. Basically the bot master is going to dial a DTMF sequence to the conference call, and the conference call in its turn is going to relate to all the bots on the line. So basically the bot master communicates once and all the bots here is command. Some misconception about DTMF is since it's very limited or very poorly designed, it's not as good as any other language or is it limited in some way? Well the truth is it's not limited in any other way. You can go wild with it and create your own languages and your own syntax. It sounds like a quick example of what we did in Mushy Mushy. So basically we have like a grammar that we have asterisks at the end of flying a hash pound as a delimiter. And then you can use examples like zero pound asterisks which means invoke the command zero without no arguments. You can do one pound, one to three pound asterisks which is like invoke command number one with the argument one to three and etc. So basically you're not limited in any other way and you can develop it into much more sophisticated language for the proof of concept and for just to show the capabilities. It's good enough. Okay so we're gonna try to do the demo. So we have two ways to do the demo. The first one is going to be through a mobile phone. Basically I'm going to connect to the PBX and Ian is gonna call in through a landline and is going to activate a simple application on my PC. If it works. Yeah. If it's not we have a backup for it. So we're going to dial in right now. Where are you connected to the DEF CON network? Come on. Something is wrong about your life. Something's terrible wrong. Something when terribly wrong is our IVR intro. Okay. You're in? Yep. Doesn't feel like. Okay. So by now the bot should be analyzing the DTMF tones to actually see the commands coming but it's it's not working for some reason. So we want to try again or we're gonna go to the backup. Yeah we'll give it one more shot and then we have like the soft phone PB. The soft phone demo which soft phone works. Yeah. Okay. Sorry. It's enabled. It's enabled. It's enabled. It's actually working. Only person in this conference. That was supposed to be zero.  Seriously. Okay. So we kind of jump to the second demo right now but we're gonna do a step back and gonna show the first one. That's the problem with live demos. One last. Yeah. It's gonna we're gonna have to do it. Okay. So right about now excise should pop up in my left corner of the screen. Here we go. I hope you guys saw it because we're not gonna do it again. It's the best use for a blackberry by the way. Yeah. The only thing it's good for. So basically what we saw right now is Ian used. We had the PBX with a DAD line in Vegas. Ian just called in and I connected through the C protocol to Ian's computer to the PBX and he just when I command the DTF command and it popped up excise. For the second demo which we actually prematurely showed it to you is basically we're gonna do a ping. Just to show that again you can do you can pass arguments to the to the bout. It's not limited to like a one way straight commands. So we're gonna try to pull that off to the phone. If it's not we're gonna do our own soft one demo which is again using the same concept. Somebody got a drop of the call. We'll try again real quick. I did not drop of the call. Come on try again. Are you in? I think the line quality is really bad because somewhere on the way we're gonna lose the DTF man. Oh. Says AT&T here. Okay. So yeah we're gonna move to the soft demo which basically you want to do it from okay. So basically Ian's gonna call the PBX using a soft phone so it's gonna be cipped directly to the PBX and I'm connected to the bot to receive to Ian's computer. Nothing shows. We're showing some faith. Kind of worked. Well it worked the first time. Just of the demos are basically you can do everything. Okay it's a question of how do you design your language as Isaac said before to respond to DTF commands. So zero was popping eyes. It could have been you know initiate a DDoS on some predefined address. I can chain commands. I can provide parameters that ping that will work. That will work. You can basically punch in any IP that you want. So again you can walk around, jump into Hooters, get bad service, Hooters.com and it's done. Okay. So it's working from a landline but it's working from a South America. Awesome. You connected to mine? Yeah. Okay. While Isaac is setting up another VM with asterisk we're gonna switch over and do a quick data talk a little bit about data exfiltration which is the second part and what we discussed before. So data exfiltration. The reason or the research that started this whole this whole thing basically started in the red team where the situation was very simple. We could break into a network. That's not a problem. Drop a USB talk to someone. You know the drill. There are like a gazillion talks here about breaking into networks. That's fine. The problem was that that network was basically air-gapped. No connection. The whole facility is fenced and barbed wire and whatever you want and you need to get data out to show the risk. To show that it's possible and to start working on mitigations and monitoring for VORS RIP channels. What the... So the deal was very simple. We figured you know what we saw while you know during the recon and intelligence gathering that we had a VORS RIP accessible inside that network. Right there is a few soft phones that were needed for some reason and the rest was just handsets which meant that the computer network was overlapped with the VORS RIP network. Which meant that our payload could talk to the VORS RIP network. So the deal was very simple. We took... We wanted to... What we wanted to do is to take the binary data that we wanted to exfiltrate. In that case it was a few war documents that were like classified or whatever it is. And basically modulate them to audio. We took half bytes, right, 16 bits and each half byte was translated to one of 16 different octaves within the human audio range of 200 Hertz to 2000 Hertz. We generated a tone corresponding to that octave using the payload. The octaves were spread out evenly enough to be easily detected or identified later on and we'll talk about it in a second. And basically recorded a half second tone of that octave. Marrying up all those different tones, you basically transcode any binary file to music, to tones. So the demo that we're going to show here is very simple. We have a proof-of-concept code written in Python which is very optimistic and very simple and is not really designed to be used to actually do this. It's more... It's a proof-of-concept, okay? The main issues with the proof-of-concept is that it's using only 16 octaves. You can easily use 32 and just transcode the whole bytes one at a time. You can shorten the length of every tone so you don't spend half a second just generating it. And basically you can take the Linux self-mode-in driver and get all those hints from old-school gangsta-mode-in stuff to compress and transcode your data more efficiently over audio. Proof-of-concept is called... First of all we have a message, alright? In this case it's message.txt. Some secret files, blah blah blah blah. The Python script is data to sound. We're taking an input of message.txt and an output of sound.wave. We're assuring that file that we just generated is indeed a riff, a wave file, and we dial out. We dial out to a voicemail. In this case and my usual preference is Google Voice because you can get on email when you have a voicemail and you can, you know, get an mp3 of that voicemail. It's just super easy to use. So that was message.wave. At that point we've got some music playing in our voicemail. We downloaded that mp3, transformed it to wave because my Python skills don't allow me to use mp3s.  And we have another script. This is our VM. It's voicemail.wave. It is a riff. The second part of proof of concept is basically sound to data with an input of VM.wave, an output of output.file. We see that the file type is indeed ASCII, just the one we sent, and secrets. Doc's dad. Hi. So we have the demo ready for the rest of the MashaMasha botnet. So basically, again, I'm going to call the conference call on it here. Can you put the... What do you have two holes? Good question. That's what she says. True story. So I'm going to dial the conference call. I'm going to use this lovely soft phone to show how we are going to do more than just a one time command. So basically, I'm going to ping a computer using just the tmftones. So that's a really quick way if somebody was thinking about null of service and whether it's possible over using five botnets. It's network problem tracking. Yeah. Really? Thank you. Oh, yeah. Yeah, that's not going to work. Okay. So far, we only did the bot, the master, the bot, and now we're going to do some reverse traffic. We're going to do reading out of information. Of course, one of the things that the bot master would like to do is to get information outside of the computer network that he has access to it. And like we said before, the telephony system does not provide a good visual way to communicate that. So we're going to do the text to speech engine trick right now. So basically, this is a very simple trick I'm going to do. It's playing out to picking up my root entry in my ETC password. Again, I'm going to dial, I will be dialed to the conference call. So my computer is going to read out this line in a few minutes. Yeah. So, I'm going to read out this line in a few minutes. That was a quick way to get a sentence out of the computer. Again, using only the phone, only DTMF, no other software involved. Okay, so we're a bit short in time, so we're going to go back to the best demo that we give. I'm going to show you right now. So basically we say it's possible to do a one line, but if we'd like to do something more, like to take an entire file outside, it's also possible. Basically, we have the very top secret document. As you can see, highly sensitive and confidential. And basically what I'm going to do, we're going to ask the bot to read out, to take this word file, to convert it to text, and read it back to us. Secret. Some company statement for 2011. We made a $1 billion and we are expected to do $4 billion. Next year, with con 19 rocks exclamation. Thank you. So I'm going to do a quick jump back to the presentation just to go over some of the theoretical stuff at the time that we have left and we'll take questions of course later. So we saw the DTMF demo and we got the idea that DTMF could be a very good way, a common way to communicate with any VoIP botnet. We saw the text to speech could be an ideal data leakage concept. Basically, if you cannot see the data, the bot can read you back the data. We saw Ian in his concept of using the voicemail as a callback. Basically the bot calls the voicemail, drops the message. No, no, no, no. The ultimate idea that we think that the VoIP botnet could provide eventually is to basically create a VPN and how the VPN will be created by simply bringing some seriously old school shit back to the game. Bringing back the modern HDLC and PPP protocols. Basically you can have the idea that the bot will create a VPN, will call back to the master and will get an IP and in that way you can see it's similar to a VPN. All the blue dots are basically what's going to be on the public infrastructure and all the red dots could be another layer of communication and that's going to work with hardware modems, software modem. It works within the voice frequency, it worked in the past, it will work now. Works under pro connectivity issues and of course it's a two-way communication. So basically if you look at the last bullets the bot master can simply explore his bot. He can then use protocols such as IRCHTP and whatever else he wants. He has an IP access within the organization and he can do whatever he wants with it. So that's to conclude. What you guys heard today is that the VoIP botnet is as good as any other botnet's out there. It's not less or for bigger than HDP. Every communication protocols has its pros and cons but we believe that VoIP has much more pros in it and therefore we suspect it's going to be if it's not already been used it's going to be popularly used in the future. And it's something that the industry needs to think of, it's something that your company needs to think of the next time someone says oh we can save a lot of money by implementing this technology and it's cool and it's fast and it's easy but then again there is no controllers, there is no awareness, there is not no help to understand what actually can happen. That's that's kind of the result. A word about the counter measures. So yeah the first thing will be to separate the VoIP network from the cooperate network. I know it's tempting to have a soft phone in your computer and have the ability to go on and off with it but again the risk is that if there is a VoIP infrastructure that comes all the way from a pay phone to New Jersey to your computer then this is a risk that you have to think of over the advantage of having a soft phone installed. Definitely monitor the VoIP activity. That's something that people don't do and like Ian said we do it for web, we do it for emails, we do it for what else but for VoIP it's like it's going to be okay. Don't worry about it and that's the problem. And the last bullet is kind of experimental thought it's if the company or yourself are using some very specific conference calls bridge. So there is actually no reason for anyone else to connect to a foreign conference call for that better. So again although it's not going to solve their problem it could be a way toward the solution just of a better understanding of auditing your bills and allowing which numbers can be made calls to. How's the future is going to be? Well the future is going to be very soundish. It's going to be speech to text as an input. Again we today we emphasize the DTMF as an input vector. Again the future could be commands spoken by, do that, give me that, attack this it's capable. We have the mobile angle which basically going through SMS get ways and basically get visual appearance. The bot can text you, you can text them back. And some of the going back basically one way to get a screenshot which is a very interesting vector is basically have the VoIP, sorry have the VoIP, the bot taking a screenshot and then communicate it as effects. So you can basically have a screenshot of the computer that you're looking at through the effects. And of course for the internal VPN start communication bring back the modern protocols and these protocol communication. That's about it.


than as captioner for our life. OK, so do I need to enable her as? Yes. OK, let's see here for how to do that. Yeah, you'll first disable the auto captions the same way you did the enabling. And then you should be able to assign her as the captioner. Sorry, guys. OK. Disable and assign a participant. OK. All right, closed captions are ready. Recording is happening, so you may take over. Thank you, Katie. Thanks for all the technical help. And welcome, everyone, to our live panel, advancing K-12 OER through a collaborative model. I really want to thank the OpenEd conference for having a stronger light on K-12 this year, really putting that intention out and bringing more people to look at this space. Let's meet our panelists. I'm Amy Evans-Godwin, VP of Research and Development. It is me, an independent nonprofit based in Half Moon Bay, California, doing OER research and development for many years now. We do social science research, and we are the developer of the digital public library OER comments and supporting those to use and collaborate with OER. And I'll pass it to my colleagues, Jean. Hi, I'm Jean Weller, and I am with the Virginia Department of Education. We have a statewide microsite through ISCME that supports OER and K-12 called Go Open VA. And that's what I'm doing here. So Cynthia. Great, thanks, Jean. Hi, everybody. I'm Cynthia Curry. I'm director of technical assistance at CAST. And I project direct the National Center on Accessible Educational Materials. CAST is best known for developing and continuing research on universal design for learning. And accessibility is at the base of that framework. So that's why I'm here. Thanks for the opportunity. Becky. Hi, everyone. I'm Becky Henderson. I'm the distance learning supervisor at Westmoreland Intermediate Unit. The WIU is one of 29 intermediate units across the state of Pennsylvania. Altogether, collectively, we are the Pennsylvania Association of Intermediate Units. And PAIU has worked collaboratively with ISCME to develop our own PAIU hub through OER Commons, which is a central location for educators across the state to be able to curate and develop OER. Yvette. Hi. Good afternoon, everyone. I'm Yvette Makmahan-Anal. I'm the state director of instructional development in the Virgin Islands Department of Education. We're new to open educational resources. We just launched our microsite in August of this year. And so we are happy to be here to learn along with the panelists and definitely learn from them as well. Thank you. Together, we are representing today K-12 Voices for Open, even though we come from very different settings, state, organizational, and district-level settings, working nationally and locally. But together, we hope to build something that's different. It happened about a year ago. ISCME, working with the Hewlett Foundation, convened a series of conversations to look at the K-12 OER space. And though, over the years, there have been mavericks and champions and states out in front doing this work, we thought there was a place to have broader representation and coordination from the ground up for those of us who are implementing that would like to learn from each other and support each other. And K-12 Voices for Open was born about six months ago. The vision for the community is to grow the use of open education to improve learning and advance equity and inclusion for all. We're bringing together education leaders from schools, from nonprofits, government settings, states, and districts who are dedicated to grow the use of open education in K-12 and not OER as the end in itself. But where can we really improve teaching and learning and our own professionalism together? We aim to create a community of practice that's open to everyone. And one of the rationales for this session is to invite all of you and your colleagues to join us, because we don't want to do that alone. As we heard in the keynote today with Dr. Ahmad, that a lot of the things that we're working against is an exclusion and isolation in education. And this group is coming together because we believe in the K-12 voice that we all have something to contribute. We all can learn from each other and everyone has expertise in something that's valuable. We aim to create this community in addition to be open and inclusive and productive for everyone, but also to capitalize on an opportunity that the OER community has that is not yet fully realized. And that's the potential for open education to be used as a vehicle for anti-racism, for representation and inclusion across the space. We want to replace isolation and exclusion with collective strategizing and mentoring. We have a community action plan, and all the outputs of this community will be shared in the slides, which I'll upload after our session. But we have tangible outputs like the community action plan that put together our governance model of meeting together when we meet once a month, when we meet all together, our working groups quarterly, and how we are looking to contribute to changing practice and policy across OER. We also made a very intentional commitment to increasing diversity, equity, inclusion, and accessibility, DEIA, and have a public statement about that that we share as well. Our four groups are the leadership and implementation committee, and we work to support the other three working groups and ensure that the workflows are happening and that there's communication and elevating and disseminating the outputs that come from these groups. The policy and advocacy working group is really looking at offering guidance and making recommendations and putting out those messages that the rest of the country needs to hear. Professional learning group is bringing together knowledge and expertise that's out there, doing some important curation work, and the quality and vetting group is looking at synthesizing frameworks for evaluation of materials. So we're ensuring quality. We'll hear about all of those groups from my colleagues. So this is a chance to talk about some of the ways that we've been working in the past year. What are some of the high points and progress? So, Becky, why don't you kick that off? Sure. Thanks, Amy. The biggest thing that I want to talk about when it comes to the leadership and implementation committee is the development of the DEIA statement. That was very intentional work for us, and as you said, Amy, one of the main goals with that was to really articulate how we were going to develop a community of practice. And those are the words that, for me personally, and I know for many people within our organization here now, they really ring true to us because our work is not siloed off. We are not individuals just trying to solve all of the problems, all of the hurdles. We are working together and gaining insight from each other. And when we bring that term practice in the play, it helps us to remember that this isn't just a one and done thing. We're not just taking what we've done right now and saying, okay, we got it, we figured it all out. Instead, we're constantly striving to take the next step, to do more, to learn more, and to experience more from each other. So this community of practice for us is really important because we need each other's perspectives to be successful. The thing that I also really love about the DEI statement, and I wrote this down because I wanted to quote it, is, above all, K-12 Voices for Open commits to continuous personal and collective learning and improvement. We are a collection of lifelong learners and our goal is to do everything that we can to support students, educators, administrators, and organizations everywhere. That is as inclusive as we can be. We want to be able to help and connect with everyone because we truly see the value in open educational resource initiatives at all levels. And we know that when we all work together, we can create amazing things. Great, thank you. Dean, tell us about the group you've been coordinating. Okay, the policy and advocacy working group is one that's near and dear to my heart because I want to second Becky in saying we all need to work together. I mean, in Virginia, there's one of me to run the whole system and I need help from other people who are doing similar things, not necessarily at the state level. Oftentimes a lot of really cool ideas come out at the local level or at the national level also. So sharing these things is really what's important about our group just as it is with OER in general. I mean, OER is about sharing and helping each other grow. So our policy and advocacy working group started off back in the spring, we noticed that of course the ARP funds were being put out, but nobody was talking about the potential use of OER as part of the strategy and we thought that we ought to at least put the idea out so that people could be thinking about it, people at the local level, people at the state level and even people at the national level who could be thinking along those lines. And that's really what our group is about is to seize moments, to seize things that are happening and see what we can do to talk about them in terms of OER. And not just season the moment, but also planning ahead, thinking of what things might come up that we want to address, things that have become issues for OER organizations, what have they had to deal with, what types of things, what types of barriers are there. And I think it's a great group. We're small but mighty. We have a small group and I wanna say hi, Karla Speer, she's one of my group. So I'm so excited she's here with us. We're working hard and we'll continue growing and doing things to advocate for us. For us. Okay. Great, Gene. I just led, I just put the link to the policy statement and we'll upload these links at the end. But just to add to that, people can join in OER from many different entry points. It's not a prescribed or linear way of initiating a new way of developing and adopting curriculum. You can jump in at many different points along the way and I think the policy statement is really strong about explaining that and advocating for that. Yes, Karla was very instrumental in helping us figure that out because she is from a local area and knows what it's like trying to do it in a local space. Great. Yvette, tell me a bit about the curatorial work and how you've been involved with the group. Okay. Thank you, Amy. And Gene just spoke about being a team of one and I can definitely identify with that. And the idea of having the collaboration from this group really supports me personally and professionally. And the support that I get presents itself somewhat like a blueprint for professional development, professional learning for us as a whole, but for everyone else. Amy, you talked about various entry points and I'd like to suggest that one such entry point is the professional learning working group and anyone who's on is welcome to join us. We are located on the OER Commons as a working group and as far as curation, I must say we started out meeting every once a month, second Thursday and we were looking at curating evidence-based practices, resources and the like through the OER Commons group. What we found is that the members of this working group are all aligned to different states. And so each of us has quite a number of resources already located within the state's hub or within the state's microsite. And so we started looking at well, how do we transition all these resources into OER Commons so that they become accessible in once one place? And that's one of the questions we are trying to answer within our group. The other thing we've been talking about quite a bit of is that there's not enough out there for K-12 in terms of recognition and knowing, however, as far as higher ed is concerned, there's so much available. Higher ed is run miles with open educational resources. And so here it is, we are looking at this as an opportunity to, I guess latch onto the higher ed wagon so to speak and find ways to be part of their initiative at the same time collaborating with them so that we can find a place, a component within their various conferences so we can grow along and grow ourselves primarily. And so these are two of the main initiatives that we are looking at, getting into our resources that are being curated into the open educational OER Commons and how we can do more to work and collaborate with the higher ed to help us to grow even faster. That's great. It's very true that higher ed has had quite a head start in the OER space and more formalized policy, more formalized funding and support for faculty to create OER that often K-12 does not have those streams. And part of what we're advocating for is that reallocation to support teachers to do this work and move that away from the tradition of buying materials. So then last, certainly not least, I'm going to share what Becky shared also the DEI statement and move to you, Cynthia. Tell us not only about the group, but I think also that quality vetting is also looking at accessibility and you were really instrumental in making sure that our inclusion statement spoke explicitly to including accessibility in that. So I'll pass it to you. Great, thanks, Amy. And I will say when it comes to the quality vetting and curriculum development group, we're really looking at it from a learner centered perspective. So vetting materials curating what's already available, but also in the development of new OER to be thinking from the learner perspective and from the diversity of students that are really across the country. We are thinking about accessibility specifically in the context of disability while diversity and equity really carries across all demographics. So from the legal perspective, in terms of civil rights accessibility relates to disability and thinking about the demographics though disability crosses every demographic. So we wanted to make sure that accessibility was explicitly called out, both from a compliance perspective because by law through the Individuals with Disabilities Education Act through section 504 of the Rehabilitation Act through section 508 of the Rehabilitation Act, there's a lot of legal compliance that's tied to accessibility. But more than that, we're thinking about it from the perspective of equity and inclusion and making sure that everybody can participate in OER. And to take this as an opportunity, we know that oftentimes commercial products are not accessible and when something is in OER, it can be adapted, it can be remixed, it can be created in a way that is accessible. So through derivatives, so really trying to be creative about OER when it comes to accessibility. Also thinking about vetting through the lens of culturally responsive teaching and what are some things to be looking for when it comes to making sure that the language of the materials are either responsive to the population of students that are typical to a particular school or region, but also making sure that the content is relevant to students as well as to their families, particularly thinking about so much remote learning is happening and so many parents are now in a position of supporting their students through periods of time and really making sure that families feel included within the curriculum and how can we be creative with OER to do that. So part of it is vetting. So what is already available and how can we vet it for a learner inclusivity and then guidelines for curriculum development, making sure that we're being inclusive in the content as well as the delivery and the language. So we have a couple of tools, but as the other working groups have really put out there as a recruitment strategy, we really need more help. As Amy so graciously stated, I'm very comfortable in the accessibility realm of this. I don't currently work for a state or a district, although my work in that area certainly informs my, how I go about considering accessibility as well as working with cohorts of districts and states across the country, but we need more of that. We need more perspectives around how do we make sure that materials are accessible to students with disabilities, also need more representation of people who know how to incorporate cultural responsiveness into OER. So we would greatly appreciate more participation from those of you who would like to join us in this work. Couple of the materials that we currently have is a curation tool or protocol for accessible OER. So that's something that's available. It's through a cast has a hub on OER Commons. So it's a protocol that anybody can pick up and use to run through any OER, you can run through its paces in terms of is it going to be technically accessible for students with disabilities. And then we also have some guidance around how to ensure that a material is perceivable, meaning that it can be accessed through multiple means, whether through sight, through hearing, through Braille or any other tactile means. Are the materials going to be operable in terms of responsive for students who use various types of technologies to access the content? Is the understandable? So is the language understandable, both in terms of everything from Lexile to any language that's not English. So multiple languages that are spoken within a context. And then is it robust? Is it going to stay accessible? Is it going to maintain its flexibility across platforms and across the devices that are used in schools today? So we would greatly appreciate more support on our working group. Thank you. Great, thank you Cynthia and all of you. This is the lens on K-12 Voices for Open and I'll just reiterate it, Cynthia, you touched on. It's not only for specialists or OER experts, the community is built with the notion of including those with lived experience, including students and community members and family members. And especially in the time of COVID where parents are more involved, all are open to join us. So moving from the lens on K-12 Voices for Open specifically, let's just have a discussion and go circle back to each of you where is OER playing a role in your context? What are things that you're looking to transform and how might community support help that concentrate really on that first question, something that you're looking to transform this year, Becky? Why don't we hear about Pennsylvania? Sure. So Pennsylvania really has a grassroots movement when it comes to OER implementation. We have 500 different districts across the state, which means 500 different ways to implement everything. But that's kind of the beauty of what we're doing in the state is that this really highlights the fact that an OER initiative is not a one-size-fits-all initiative. It really is a very personal experience, not only within each district, but in many cases within each building in a district and within each classroom. So what we're looking at right now is really how to personalize the experience for our educators. It's one thing for us to wanna build a roadmap to say, here are the steps that you can take to get started, but these aren't the steps that you have to take to get started. What have you been doing? Where are you comfortable? And let's grow from there. I think that is the way, at least in Pennsylvania, that we have seen success in a way that doesn't quite overwhelm people. Because as we all know here, when you first start, it's like being given a blank piece of paper or just staring at a blank screen. You get a little bit of writer's block. You don't know where to go with it. So by personalizing and trying to connect to the lived experiences that educators have already had, we're able to then grow out what they want to do on a much more personal level. So in Pennsylvania, we really want to take this idea of sharing resources, collaborating together, and making it much more personal for each one of us. We continue to develop our work with the PA STEM toolkit, which is on OER Commons. And that continues to evolve and grow again as our STEM points of contact across the state continue to refine their work and start using that in the classroom. There are a lot of really amazing things that are happening in the state, but because it's not a comprehensive statewide initiative, sometimes it's hard to find them. So I love the fact that I get to dig in and really find those amazing stories that are happening and share them with everyone. It's been really inspiring to see the unique structure of Pennsylvania, the intermediate units doing that work independently. And yet I'm sure there's some synthesis, some synergy across units and feeding up to the state to see what works. Absolutely, we have a statewide job-alike group called PAMES, which stands for Pennsylvania Instructional Media Specialists. And they are distance learning supervisors, online coordinators, technology directors, anyone that kind of falls into that realm of the instructional media support specialist. We all come together regularly and we have a subgroup within that job-alike group whose sole focus is on working on promoting and enhancing OER across the state. And that group has been just doing a phenomenal amount of work year after year. Wow, great. Jean, I know Virginia has been sort of leading the way as a state-level OER adopter. And I'm sure districts make their own decisions about this. How does it work from your perspective where OER is really making some headway? Well, I think our goal is to really affect the way teachers actually teach and students learn. So our focus has been on trying to provide the resources, the open education resources because they are the most flexible way to support teachers in this work, to give the teachers resources to change the way they teach so that they are doing what we're really focusing on is deeper learning, culturally relevant teaching, personalization, all of those kind of buzzwords, but we're really trying to focus our content on growing those skills with teachers. And part of that is a emphasis on the whole remixing part of OER, which means that teachers can take resources that are already out there and personalize them for their students. And while they're doing that, they grow, they learn, they reflect upon how they're changing the way they teach. And then they share that with other teachers and other teachers, share things with them. As you were saying earlier, Amy, about the fact that we are being able to learn from each other, it's exactly the way it is at the state level in Virginia is that teachers are all at different levels and have different experiences and different expertise and it's great to get them together to share that information as opposed to not, you know, and not really growing very well. So that's really what we're looking for it to do. The community is helping us by finding all kinds of ways to do that. I mean, I have one brain and it comes up with some ideas, but oh my gosh, the ideas that I get from my colleagues around the nation and around the world are fabulous ideas and things that I wouldn't have necessarily thought of to try to do. So if I really want to make this happen in Virginia, I need the ideas of a collective community. So. Great, thank you. Yvette, you're in such an amazing position to be kicking off an OER initiative across the Virgin Islands. Tell us a bit about how that's going. Okay, great. And so we have been, we say building the plane and flying it at the same time. I see Jean shaking her head because we are so new to OER. Right now, the vision admittedly is Yvette's vision. I brought it to the department from CCSSO and was quite thrilled by what I learned and saw there at a conference and started pursuing OER actively to the point where I went out and procured the microsite and now launching it through a lot of professional development. And it's like amazing to see and hear teachers as we walk through the professional development come upon a resource and that resource has so much to offer and that they can remix that resource and share it again with others. That has been quite an experience. It brings like, oh yes, this is where we really want to go. But I do admit that I've been very cautious and even though the assistant commissioner is like the biggest cheerleader of the microsite and of OER, I am still very cautious. So I'm taking it a little at a time. I have not opened it up to the entire community but those possibilities are there through the professional development, learning that we're partnering with ISCME on for culturally relevant teaching. We are able to bring in some of our community members to help with the facilitation of the culturally relevant teaching academy. And that is opening up where others are now reaching out and saying, well, can we have a hub on the microsite to do 21st century scales and different things within the community? But we also want to embrace use of the microsite and particularly a dedicated hub to embrace our Virgin Islands history and culture and actually write the playbook right there within the hub. We have resources and the like but when we reached out to those historical, cultural organizations, the response is like, wow, you're developing a digital library of our cultural and Virgin Islands historical resources and like we're going, yes, that's where we're going with this, thank you. And so the interest is there within the community. We just haven't opened up the site yet to the entire community where they can download and remix and so forth. We're still learning as we go along and I would like to be able to have more of a deeper understanding of the OER and the site before I just go wide open with it. So in essence, I'm not being as open as I ought to be in open education resources. But that will be coming. That's great. Oh, yes. What you and Becky and Jean have emphasized is that teachers are such a key part of this supporting their knowledge and their participation, their engagement is really key. Cynthia, did you wanna add to that or anything around this idea of materials being designed from the beginning to be accessible and of the highest quality and using principles of universal design? Sometimes that's intimidating for teachers and bringing them along is a such important part of that work. Absolutely. I think one of the goals is how that vetting process as well as the creation process really is, it can be transferred across all areas of teaching and learning. I think that that's really the exciting part of the vetting and curriculum development group is that the types of strategies and skills that apply to making sure that OER are accessible and that they're culturally responsive, those skills translate across every area of education. So while we're focusing on choosing accessible from the beginning, using a curation process, for example, the protocol for curating accessible OER or any type of vetting criteria when it comes to content standards, teaching assessment standards, all of that is essential. When thinking about it from your vetting, that's from the beginning, really important and considerations that can be applied to that include universal design for learning. So are there multiple representations of the information? Is there text as well as video? Are there opportunities for interaction and ways that actually also account for various ways that learners function? But also the opportunity that if it's not accessible, how we can change it, how we can make it accessible, and then we can reshare it for the common good and not just making it accessible, but perhaps incorporating into it more culturally responsive content, making sure that multiple types of students of various backgrounds are also represented that their families are represented. So just the opportunity to add more diversity, equity, and inclusion into OER and then to reshare them. And that in and of itself becomes modeling for other users of OER, but also can impact education on a broader scale. So thinking about this initiative and this opportunity beyond just here's the material, but also how can it impact the way teachers teach, the way that we create assessments, the way that we lead? How can we use this as an opportunity to do that because within the flexibility of OER? Yes, everyone has some value to add and especially librarians. I see Kate, you made that point. When we say educators, we include librarians. And teachers, we should be explicit. Also school librarians have played such an important role and have even more role to play around curating and bringing OER together, being the arbiters of licensing and intellectual property issues, understanding metadata and discovery of materials and collection building and cataloging since so much of this work is librarianship. We certainly want to highlight that, so thank you. So we have a period of discussion where I invite anyone from the audience and the panel to start thinking about where does OER implementation play a role in your setting in K-12? How could this community support you? And what else would you like to learn from us today? So please feel free to put it in the chat or unmute yourself, happy to hear your voices. Very good line, Amy, since we are the voices for open. Yeah, you caught that. Hi, Amy, can you hear me? Yes. Wonderful, okay, I have a question actually. So you actually mentioned something about trying to change the funding structure where we are, let me put my camera on so you can see me actually. So it'd be, just give me a second, one second. Sorry, I'm here with my kids. So they're watching a movie. I'm asking them to turn off the movie for a second. Okay, hi, Amy. So you mentioned about trying to find, divert the funding. So instead of purchasing the content, say, hey, look, teachers can create this OER content, right? So that's what a higher ed does basically. And so I'm wondering about if we have enough a way to measure the impact of OER to support the funding. I think every time we go to funding, you kind of have to go and build a business case and say, look, this is the impact it's gonna have. And we are gonna be able to tell you that after we get this funding in a year or two years, we'll be able to come back and say, look, we made an impact. Do we have, is that important in that process? And if so, how do we manage to figure out how OER impacts, especially considering that OER is designed to be so low barrier so that people don't have to go jump hoops to get the OER? Great question. Thank you. I think there's a lot of complex pieces to changing policy and changing funding allocations. Everyone wants to have evidence. Everyone wants to say, demonstrate and prove to me that OER is gonna make the difference and it's worth not buying textbooks and putting that money to teachers. I would love the panel to respond to that, but I know that in my heart, if our educators are more familiar and more hands on with the material, they're gonna be more connected to what they're teaching, bring innovation to the classroom and really change the way students are impacted. So anyone wanna respond to that question? I'll say just that this is the Holy Grail. We'd all love to have this, but we're still at the very beginning of OER in K-12. And so having studies, especially, very highly scientific, renowned studies, long-term effects and stuff like that, it's just not there. I know in our state, we've tried for a very long time to connect any type of educational technology to an increase in student achievement or learning or whatever, and we've never been able to do it. So I don't know if that's ever gonna happen. And I think that it may be important to try to try other arguments as opposed to, hey, the research says, because I just don't think it's ever gonna really get there. Well, and Jean, I think part of it too is that the research will never get there if we're not willing to try. We have to be willing to start the work. I have one district that I know of in Pennsylvania right now that has been able to show an increase in student achievement within the past five years of their OER initiative. And I think that's absolutely wonderful. That's one in 500. What I think is more important at this point is that we start the work so that we can start to collect the data and really develop those insights. But if we just continue to sit there and say, there's no research, there's no research, there's no research, nothing's ever going to get developed. We have to start somewhere. How do they narrow that, I guess, the variable in order to show that it really is directly related, that's always been my concern. How can you show it is that one thing? Well, in the case of the district that I'm referring to, they did a comprehensive K to 12 initiative. The only textbooks that they purchase now are for AP courses because of college board requirements. So the teachers are curating and developing and personalizing resources based on the district's curriculum, based on their student population and based on the state mandated tests within the state of Pennsylvania. So they're able to close that a little bit more and say, here's the correlation because here's what we've done. We're not using these materials anymore, we're using our own. But it's taken six years, five, six years to get there. This is not a flash in the pan, something fast that you can do. This is great, Desi, this is exactly, I hope our participants noticed that this is exactly why this community is great. I just want to ask for your information, Becky, and I'll be able to use that. And there's so many types of research that hasn't been done. There may be those that are looking for the numbers, but there's research around changes in practice and our teachers more satisfied. Are they more likely to stay on the job in the classroom? Do they feel more comfortable with the material? Are they able to speak to the cultural relevance? So a lot of these qualitative pieces yet remain to be studied and could bring a lot of value to the space. This is Cynthia, I was just going to add, the gold standard is always randomized control trials and that just never, I mean, it's just not possible to do that in schools. I mean, there's just way too much humanness going on and so many variables. You can't have your two simultaneous lessons going on and not have a thousand other variables competing against each other. So I'm with you, Amy, that really it's beyond just test scores and student outcomes. There's so many other factors when it comes, not just to OER, but just in general doing some comparison about teaching, learning and the materials that are used. But I would love to see that as well. I think there are a lot of ways to get creative with OER when it comes to, what is the impact? I think that's really the first question. What is the impact difference that we're looking for? A lot of opportunities there for OER. Cynthia, I just want to add to- We can do a study.  I just wanted to add to Cynthia's point about the randomized trials. My background is computer science and I do that kind of, let's call it pure science, I guess, very strict science. And over the summer when I interviewed teachers and instructors and K-12 and then higher ed, I had a hard time, especially even in both areas, even, you know, but even within K-12, I had a set of questions and I felt like I had to change the questions all the time and the interviews always became dynamic. And at the end, I could never make a table and draw like a neat conclusion of anything. I could just get a background story and kind of perspective of the different perspectives that exist, but not something I can like isolate neatly and test it. Is it true? You know, it's just, it's, there's subcultures and it's just so, it's too big, I think. Too many variables, like you said. I hear you, I hear you on that. The type of research, we call it social science research is because we're looking at some subtle differences, you know, does collaboration by making things together change how the materials are used or the amount that teachers feel comfortable in the classroom. These are, you know, these are maybe some soft skill measurements that still would add a lot of value to the space if we were able to do that. So we have just a couple of minutes left. If anyone has other questions, please feel free. And otherwise I will put up the links to the community and these we will publish right afterwards and as well as our own, here are the links. The K-12 Voices for Open right now is at this Google site URL and we'll put that out there, I'll put it in the chat and all the statements and documents we've been talking about are publicly available and these are the links there and then I will give you our contact information and hope that you will be able to join us and continue this conversation. So any more questions? Can I add a little thing? Sorry, like I'll steal the floor here but I had a conversation with someone recently in the summer when I was doing interviews, someone who works in India and he supports several schools in his region. They speak, some of them speak English, the schools teach in English but they also use their local language as well. And he found it very difficult to find OER resources and what he usually does because these schools are in rural areas, they don't have internet, what he does is he coordinates OER on behalf of these schools and he distributes them on USB sticks basically and drives around the region. And he mentioned to me how hard for him it is to find K-12 OER period. Do you have any kind of advice that I can share with him or to see how he can, I know that in North America we have more, you're starting these collaborations but people who are on the international side, how do they get involved? Well, I'll just give you the URL of the library that Istmi runs OER Commons.org and so much of that material is K-12. Even though we've talked about higher ed being out in front, we always wanted to have these materials so K-12 was not siloed so that K-12 and higher ed materials could be searched across the same descriptive information. So that library you're going to be able to filter by grade level and subject area and drill down and find thousands of things that are open for adapting to your own context. Wonderful, thank you. Well, it looks like we had one more minute. We can hang out for a few more minutes if you wanna talk to us but thank you so much for joining us and please feel free to join K-12 Voices for Open and contact any of us with any questions or things that you'd like to follow up about and learn more about. Thank you.