Welcome to Business in Hawaii with Reg Baker. We're a show that broadcasts every Thursday from 2 to 2.30 and we focus on success stories in Hawaii of both businesses and individuals and occasionally organizations that support them. We broadcast live from the downtown studios of Think Tech Hawaii in a pioneer plaza in beautiful Halalua, Hawaii. This week we're very fortunate to have Emily Kleiner, who is the Director of Events for the Pacific Business News, which is one of the premier business publications in Hawaii and has been around for many, many years. Emily, welcome to the show. Oh, thank you so much for having me. Now you're here, I guess, wearing two hats today. I often do. Yeah, well, most small businesses, particularly the owners, wear multiple hats. But you're also a member of the Chamber of Commerce Young Professional Program. That's correct. I work with them on their steering committee to handle our mentorship program as well as professional development. Very good. And that keeps you pretty busy, I would imagine. It does, but it kind of goes hand in hand with what I do at PBN, so it's a natural fit. So there's overlap there. Yeah. Well, tell me a little bit. We're not going to spend a lot of time on it. We've had young professionals from the chamber on here talking about the program in the past. Excellent program. We're going very quickly. How many members do you have now? We have a little over 200 members and growing. That's amazing. I mean, I just remember I was with HMAA at the time when we actually kicked this off with Kyle. Yes, of course. Kyle really deserves the credit for getting this all started. They jump-started it, and we provided some of the initial sponsorship and funding for it, and it took off. And I think it took them about a year or two, and they hit 100, and now they just seem to be on steroids. They're just taken off. Yeah. It's a really fantastic membership committee in place. Jacob now has really transformed it. We get new members every week, and also I see that the caliber of the members have really taken off. We're seeing a lot more high level, director level, VP level of our members. Excellent. And that's the maturing process that the organization's taking, so it's nice. And Jacob is one of those energy guys, and he works for a company I think called HMAA. I believe so. Your role, you're involved in what capacity over the young professional? I work with professional development. So we do a once a month course for the entire year where I pick a different industry leader that has knowledge on a certain topic. So it's things that any young professional would need to know. So for example, we just recently had one on business etiquette, what to do at a meeting, what to do at a networking event, how to exchange business cards. Some of those basic skills, but things that not everybody knows. We range in topics from social media training, networking, personal finance, things of that nature. So it's all things that are really beneficial to people that are up and coming in their careers. Something they could put to immediate use. Exactly. Very good. And you do one of these a month? We do one a month. We take off December and sometimes July, but once a month. And we have the whole schedule posted on the Chamber of Commerce Young Professionals website. So you do events with the YP program, but you also work for another organization. I do. You do events over there too. I do. I'm the Director of Events and Promotions with Pacific Business News. I know you're quite familiar with the brand, but PBN hosts upwards of 50 events a year, all different types. Everything from educational base to, you know, thought leadership events about a specific industry or a specific area of the island. We also do a lot of award events. That's probably one of our more commonly known styles. We call them a signature event. Things like Women Who Mean Business or our upcoming Forty Under Forty Awards. That one's happening on June 9th, as you know. Forty Under Forty, and that's the one that, there's a lot of overlap. You see a lot of familiar faces in both the Chamber and, yeah, both sides. I think it's my work with Forty Under Forty since being with PBN that kind of steered me in the direction of the Chamber of Commerce Young Professionals Group. You know, Forty Under Forty is a super well-recognized brand. We're about to have our 18th year this year, the events at the four seasons. And we have close to 550, 600 people attending. Wow. So the program is really quite grown. Our Forty Under Forty class this year is amazing, and we find that the classes now really interact with each other over the course of the years. And many of the members are also members of our Chamber of Commerce Young Professionals Group. So in working so closely with the Forties over the last few years that I've been with PBN, it made it a really nice fit to do some work with the Chamber of Commerce. Right.  They do. And we really encourage that. We sometimes get calls and emails from the class of 2000, the class of 2002, where they've gotten together and done some sort of philanthropic event together, or gotten together just for a little palhanna. And it's really nice to see. We're looking at, in the future, doing some more alumni events as we call it. Well, that could be neat. You know, even at this year's event, we have several alumni that are attending and we do plan to note them out in the audience and work a little bit more with that as a brand itself.  Where are you now? It's funny you say that. We've often thought about doing some sort of, I mean, almost like a yearbook style section where we have some of those former classmates that were in those beginning years and showing what they've accomplished, showing what was written about them when they were a 40 under 40 and how much has grown. You know, a lot of these are local leaders that are, you know, still here in Hawaii today. Absolutely. As a matter of fact, I'm sure that they have a lot to share on how they were able to take this honor that they got and how they were able to make it work for them to help them along to get to where they're at today. Absolutely, definitely. I think that there's something there when we talk about mentorship and and really being there for our up and coming in professionals that are past 40 under 40 have shown a great interest in wanting to participate in that. And that would just fall under an events type of umbrella? It would. You know, we look at things like, you know, at PBN, there's so many different ways that we want to connect with our audience, but events are certainly the most tactile way. You know, it's the way that we can see people face to face. I find a lot of people use events now as their only time that they get to meet in person. So much of our communication is done on email and on phone. That virtual world. Exactly. So sometimes, especially for those under 40. Definitely. So sometimes we see that our events, sometimes it's the only times that you'll see your clients or see potential clients out and about in the real world. So we try to definitely encourage that. But another, you know, part under that event umbrella is looking at kind of, I mean, not an organizational standpoint, but looking at ways to keep those classes together, like what we talked about having some sort of maybe alumni group. We at PBN have a group of women business leaders together that we call Biz Women Connect. It's a private invitation only group where we host quarterly events for them. And that's proven to be quite successful and allows women in a smaller setting to be able to continually meet and grow together. So I think these are all things under the umbrella of events that we would like to consider doing in the future. Well, doing 50 events a year, which is like one a week. Just about, yes. And then you start layering on these other activities that you may be getting involved in. I mean, you're going to have to have a staff of four or five people to help you with this. Maybe I'll just clone myself a few more times and then we'll be able to get something going. No, but it's been extremely gratifying, especially to see where events have come just in the last few years that I've been there, but also just as an industry where it's come over in the last decade or two and how much it's played a role in people's professional development. Well, and that's, that's an interesting when you mentioned that the evolution of the industry and how things have changed. And I guess there's also some aspects of both the YP program with the Chamber and also with some of the events that you do with the PBN. Is it how do you get out and reach these people? How do you get them involved? How do you keep them interested in what's going on? I guess there's different ways that you do that now. Yeah.  Of course, you know, through print, through email, all of that social media has become a huge part of that, both for PBN events and with our Chamber of Commerce YP events. What I found to be really helpful is when we get past honorees or past panelists, if it's a panel event to get in on some of that social media marketing with us, you know, there's nothing like getting an invitation to an event from a past honoree to really make someone say, hey, maybe this is something that I should attend. Obviously, the caliber of the people coming are going to be good. Absolutely. As a matter of fact, taking, you know, and multiplying the effect of having everybody get engaged with their own social media friends in contacts. Right. I mean, this can start multiplying pretty quick. And that's why you end up having a large turnout for some of these events. Exactly. And when we look at events for the Chamber of Commerce YP program and some of the PBN events that are more geared towards a younger audience, you know, millennials and Gen X, social media really plays a huge part in the getting that word out there. Absolutely. That's right. And enduring the events too. There's a lot of chatter that takes place during the events. There is, you know, take 40 under 40 as an example. Again, just because it's coming up soon, we'll of course have hashtags that will ask the guests to utilize. We have a Snapchat filter that's all done with geocaching so you can have your Snapchat filter come up when you're on site only. It's quite interesting what you can do now it is. Wow. And you said one's coming up very soon. Yeah. So 40 under 40 is our upcoming event. It's on June 9th. It's going to be at the four seasons this year. Don't worry. We started a little earlier. So it starts at three o'clock. So you don't have to hit that traffic. Getting in and out of that's good. That's good. But that's going to be a real classy event then. Yeah, it's going to be wonderful. We're really looking forward to it. We have a really fun theme this year. It's kind of this 80s 90s prom style. It's going to get carried over into the section that we do that will feature all of the honorees. Well, I'm going to ask a silly question. But do some of these 40 under 40 know what the 80s were all about? You know, a lot of the 40s were born in the 80s. So I don't know if I would say that they know what high school in the 80s was like. But pretty sure that they've all done their research as well to kind of see what it's about. We've been having some fun with it, asking them questions and what not about, you know, their favorite 80s songs and 80s movies just to get a sense of their responses. And they've been quite candid and quite hilarious if I do say so myself. Sounds interesting. It sounds like it's going to be a good event. And this is the one you're saying you've got about four or five hundred people? Yeah, it'll be probably between five and six hundred. Five and six. So that's going to be good. I hope they have enough parking for everybody. They do. Complimentary value parking for the event. So. Can't ask for any better than that. So what other type of events are you going to be looking at here in the near future? With Pacific Business News, we have a few new types of events coming up. We, of course, have our panel events. When we have also in June is our when we're to Wahoo means business panel. Many people are aware that this is when we've done several years. It's going to be on June 16th. It's a breakfast from eight to ten. Well, that's right after the night. Right after it. We just keep going right through it. But that's a really great event. We get business leaders from the windward side to talk about issues that are affecting them. It's moderated by our editor, Cam Napier. And it's a really good deep dive into the issues that are specific to Kailua, Kaniwa, Waimanalo. Now, we only got a few seconds left before we got to take a break. But just one real quick question. Does PBN ever do anything on Neighbor Islands? Is that something that might be considered some day or? Definitely something we are considering. We are looking heavily into reaching our Neighbor Island audience. We have quite a few subscribers on Maui and Kauai and the Big Island, just looking for the best way to approach it. But definitely it's in our future. That's going to be interesting. I might even fly out there to attend it. Why not? But we're going to take a short break. This is Business in Hawaii with Reg Baker. We're here with Emily and she's just gotten married, I guess, a little while ago, years two, six months or so. Six months or so. So it's Kleiner, Emily Kleiner. And we're going to be taking a short break. We're going to come right back and we're going to drill down a little bit more into some of these events at both the YP and the PBN formats. We'll be right back. To Business in Hawaii with Reg Baker, this week we're talking with the PBN and Chamber YP program, one of the leaders in both organizations, Emily Kleiner. And she is going to be going into a little bit more details on exactly what's going on in both of these organizations here in the second half of the show. Emily, YPs, they do a lot of programs too. And if somebody wanted to find out more information on the YPs, maybe how to join and what form they have to fill out, how much it's going to cost. Sure. Where do they go to get this information? I think the easiest way to go is online on the website, the Chamber of Commerce Hawaii website has a very easy link that goes right to the Young Professionals program. There you can sign up for events. You can sign up to be given more information or even to be a member.  The Chamber of Commerce YP program is for people that are 21 to 39. So I think that any organization that has Young Professionals would benefit from a membership. That's right. And the Chamber website is www.cochawaii.org. That is correct. See, I got that memorized. Great job. So we can go to that website and just drill in. There's a link right in there somewhere that goes to the YP program. Absolutely. And you've got all kinds of information there. Yeah. And if you're more into social media, you can certainly visit them on their Facebook, Instagram or Twitter pages. Just look for Chamber of Commerce Hawaii Young Professionals. Very good. And then there's a calendar. And I guess, do some of these events cost or are they free? How does that work? Yeah, we have both actually. So there are complimentary events for members to attend every month. We have a variety of different programs. We also have events that do have a small entrance fee, but most of the ticket prices are kept quite low. We also have, of course, the program we launched this year, our Mentor Hawaii program that has a cost associated with it, but it's a nice, intensive, half-year program for the mentees. There are a lot of benefit out of it. Yes, definitely. Yeah. And one thing, I just want to make this comment kind of peripherally. I joined the Chamber a long time ago, and I was very involved. And I started really when I started my practice, which was about 28 years ago, and it just started with me. And over a period of about 12 years I was able to grow that practice from one individual to over 200. And I had 28 locations. We were doing 7,000 returns, 300 business clients, blah, blah, blah, all this stuff. And it was done predominantly through the Chamber of Commerce and the networking and the value-add programs, the member to member. And so what I'm saying is that if you're not getting as much out or 10 times more than what it's costing you to be a member, then there's something wrong. There's ways to get that value. And it sounds like you probably know some of the tricks on getting the value out of the membership. And there's other people over there that can help them as well. Absolutely. We hear nothing but positive results from our members, especially the YP members. You can come in at a lower rate, but still get the benefits of a Chamber membership. It's some of the best networking out there. The events are very affordable. For many of our YP members as well, it's one of the only times that they get access to these C-suite executives. For example, we run a program called Professional Development Classes. They're once a month classes where we bring in that industry leader to talk about a specific subject. We keep these classes very small to about 20 or 30 attendees. So for a young professional who's looking to get some of that access, there's nothing really like it. That's right. And for them to get it in another way, maybe impossible. Absolutely. This provides not only the opportunity here to speak, but also to talk to them afterwards, because there's usually an informal Q&A. They'll hang around a little bit to have that interaction. I mean, imagine being a young professional just starting out in your career and being able to ask a question to a CEO of a local bank when you would normally not ever be able to have any access. It's a great opportunity for them. Absolutely. It's also, and I've presented to these and I've participated. Of course. And we hope you do so in the future. Of course, I'm happy to. But it's a great way for them to stay in touch with the younger generation too and get some feedback and thoughts and perspectives that maybe doesn't always find their way up to them at some point. You know, it really works both ways. When we talk about our mentor program, for example, this just launched this year and we had our initial cohort in the beginning of the year. We're just finishing up now and it went really, really well. So we're looking to expand it in the next session starts in June. We're actually still taking applications for mentees. But the response we got from our mentors was really just outstanding about how much they benefited from the exchange as well. And what I found is that I just do not have any shortage of wonderful executives in Hawaii that would love to serve as a mentor to our young professionals. One of the nice characteristics of doing business in Hawaii is that there is a willingness to share. Absolutely. It's been really wonderful and it works both ways because like you said, so much of our business in Hawaii and I imagine everywhere it's a multi-generational workforce. So these executives are also looking for information from our young professionals to see how am I going to best be able to work with the millennials in my organization and that gives them one-on-one time. It does. It's like you said. It's a win-win for both groups. Absolutely. Now, some of this also carries over to PBN. It does. So all these benefits and advantages that you're talking about through the YP program are also present in your events or some of the events that you do at PBN. I mean certainly when you look at the events that we host, the majority of them are featuring C-suite executives that are either speaking for us on a panel accepting an award. So being at an event where there's always at least an hour or two of networking cocktail time, it can really give you that chance to, as a young professional, to go up, introduce yourself, congratulate the executive and give you that one-on-one contact. I think there's, particularly when you start getting into the training aspects, because there's going to be the events where they have a panel or they have training and you'll be able to hear what they have to say, ask some questions at some time and then also have an opportunity to interact with them after the presentation so that, you know, you could just start building a relationship. You know, I couldn't agree more. We have an upcoming event as a perfect example. It's the state of well-being. It's an event that's about workplace wellness and focusing specifically on Hawaii. But we have as a keynote speaker Dan Butner, who is the New York Times best selling author of Blue Zones. At the event, we'll have a keynote from him, followed by a panel of local workplace wellness experts. And then after that panel, we have a nice little cocktail reception where the attendees can mingle with the panelists, mingle with Dan Butner. So it's a really great opportunity for you to be able to not only attend and learn, but also get that networking piece as well. Yeah, and sometimes it's that, you know, non-public type of discussion that can be most valuable. Absolutely. I mean, there's one thing to see somebody on the street and say, oh my gosh, hi, I know who you are. But it's another to be at an event where they're there for thought and they're listening and they know that you're interested in what they have to say on a professional level. Now, if somebody wanted to find out more information about some of the PBN events that are going on, and I'm using the acronym PBN for Pacific Business News in case the audience didn't catch that, but the PBN has a website as well. Of course, you can go to pacificbusinessnews.com and it's spelled out. It's spelled out as all pacificbusinessnews.com. You can also go to pacificbusinessnews.com slash events to see our entire events calendar. Very good. And if they get to that events calendar, are they able to sign up and register right there? Absolutely. All of our events are listed. You can register for any of them that aren't currently sold out, of course. And that happens often? It does. It does. This year we have had at least 90% of our events sell out. So it's best to get there early. Absolutely. Yeah, that's good. And you can take payment online too? We can. We take credit card online, secure a site for companies that we can always give us a call at our office. Good. And it's fair. And I've registered and signed up myself personally. And it's a relatively painless process. It is. We actually just switched to a new event site that really handles it for us really well. So there's only one page, super easy to fill out. Yeah. Very good. Now what do you think is the most popular event? And I'm putting you on the spot here. But what's the most popular event that PVN does every year? I would say that there are two, one being 40 under 40. That's always a big crowd pleaser. My other favorite event and one of our most popular, if not the most popular, is our Woman Homing Business Awards. That is a really wonderful event that we do every year. I believe this coming year in 2018 will be our 20th. Wow. So we'll be looking forward to reaching back to some of our honorees from the first year and seeing where they've gone and where they've gone in their careers. But it's a wonderful event where we honor the top woman in business in the state through nomination and we always have a career achievement honoree that's picked by our editorial board. That's a good question that just popped into my mind. Let's go back to the 40 under 40. Sure. What's the process if there's people out there watching the show and they're going you know, I want to get involved. I want to maybe submit my name or I know somebody that might fit into that group. What's the process? How does this all work? That's a great question. Most of our events that are award events are done by nomination. We have a nomination site on Pacificbusinessnews.com slash nomination. Very easy to remember. But there you'll see all of our open nominations for the year. Good. We have I would say eight to ten nomination based events a year. So you'll really find something for anything. Some are for individuals, some are for companies. For example, an open nomination that we have right now. It's a new event. This will be our second year but we had a wonderful response last year and we're looking forward to it as well this year. The categories include things like the best hotel event of the year, leadership and food and beverage. So there's something, you know, for all aspects of hospitality and we really look at it from a business standpoint. And I guess it's a golden pineapple right? This year was a Coalwood pineapple but we'll see what we'll do for next year. That's good enough. Coalwood has that Hawaiian theme too. Of course, of course. That's good. And I guess when you go to this slash event or slash nominations site it'll also give you the deadlines when it opens, when it closes. Everything will be right there. Most of our nominations have a form that you'll fill out and it'll have some simple questions. They're actually quite easy to fill out. Most nominations will also allow you if you choose to submit some letters of recommendation. We recommend these clients or business associates that would really be able to attest to a person or companies standing in the community. It's got some history with them. Yeah, exactly. What we look for when we're talking about nominations for most of our events, especially individuals, is not only what they do in their business but what they do in the community as well. That plays a much larger role in selecting honorees than people realize. Okay. Alright, well we've got a couple minutes left and then we're going to have to wrap up. But how does the judging and I know you mentioned a balance of community involvement as well as professional. What other categories do they look for and where does this group come from that makes these judgment books? Sure, I mean all of our events are judged in different ways and by different panels of judges for lack of a better word. It's usually a combination of our editorial board, past honorees, leaders in the business community that are specific to that industry that we're honoring. When we're looking for nominations the judges will have certain criteria that they look at and of course it depends on the event but like I said usually it's what the business or individual is doing for Hawaii from a business standpoint from a community standpoint and what things are different because of them in their organization so what kind of changes have they made what role have they played in elevating that company. And I would imagine because I've been a judge on some of the not PB unnecessarily but other groups sometimes you get nominated you don't always make it the first time. Correct. So there's nothing wrong in being nominated a second or third time. I mean practice makes perfect right? We completely recommend that you know we have a policy that those who are nominated but not selected as an honoree that is kept confidential so there's really no reason for a person to not nominate year after year you know some years we get significantly more nominations in one award than we would this year and so sometimes it's more competitive than others we really recommend to keep trying and also always to take that nomination and update it every year with what you've done that previous year. Absolutely that could make a big difference. Definitely. You know we're pretty much at the end of the program we need to wrap it up pretty soon but I certainly appreciate you taking the time to come over. Of course. Somewhere it sounds like you're doing more than 50 taking the time to come out today but this is Business in Hawaii with Reg Baker I was here with Emily from the PBN talking about the events that she does at the Pacific Business News as well as the Chamber of Commerce YP program we broadcast live every Thursday from 2 to 2.30 and we cover stories on successful individuals, organizations and businesses in Hawaii until next Thursday Allah


Here we have a beautiful piece of land that we will call Black Acre. Why do we call it Black Acre? I don't really know, but I just know that in law school we always call it a fictitious piece of land Black Acre. It was never White Acre, Pink Acre, or Purple Acre, just Black Acre.  Real property includes most notably the land, but it also includes anything that is attached to the land, which most notably includes buildings and also other things such as fences. Real property also includes a certain amount of airspace above and a certain amount of ground below, but only to the extent that is necessary for the ordinary use and enjoyment of the land and the structures on it. So it does not include all of the air up to space, but only the amount that you ordinarily would need to enjoy your property. So the practical implication of that is that you can't stop an airplane from flying over your house because that air that's flying through does not belong to you, it's not a part of the real property that you own. And also, because you don't own all of the ground below, the stuff that's really deep down below, minerals like gold or diamonds or even oil or gas, none of that is included in real property. So if there is valuable things like that beneath property that you own, you don't own it, it's not yours. So who owns Blackacre? The fact that most people don't realize it is that it is the crown that is the ultimate absolute owner of all real property in Canada. The crown refers to the federal and provincial governments. Everyone else outside of governments can only own certain exclusive rights to possess a real property. Those rights are referred to as estates, and there are a number of different kinds of estates. So if we have Claire here, she has entered into a deal to buy Blackacre from the previous owner. Let's say she found the property for sale on a listing site like MLS.ca. She made an offer, the offer was accepted, and she says that she now owns Blackacre. What does she exactly own? She owns what we call a fee simple estate. A fee simple estate is the right to exclusive possession during the owner's life and the right to dispose of the property on death. So as long as Claire is alive, she has the right to possess and use Blackacre. And when she dies, she has a right to determine who should then get ownership of Blackacre through her will. A fee simple estate is the highest form of property ownership that you can have if you're not a government. It allows you to use the property in almost any way you want. You can sell it, you can lease it, you can give it away, you can modify it. Now how you use and modify it is subject to various land use regulations which include environmental protection laws. Let's say, for example, there is a stream or a river that runs through your property. There are environmental laws that will prevent you from dumping toxic waste into that river. And also, other land use regulations are found in municipal zoning and planning regulations. So those are regulations set by municipalities dealing with, for example, whether or not you can run a business. From a certain property or is it a purely residential property? Or how big a house can you build? How tall a house can you build? All kinds of rules like that that deal with how you can build and use your property. Now with a fee simple estate, we have to remember that the ultimate owner is still the crown. Because of that, the government, either provincial or federal government has a right to take a property to use for public purposes. And that's called expropriation. So they might need the property to build a new highway or a new airport. Now when the government decides to expropriate a piece of property, the owner of the property, so Claire in this case, would have no choice but to sell or give up the property to the government. The government, however, has an obligation to pay fair compensation for the expropriated property. Here's Claire again. She's the owner of Blackacre. Or more specifically, she's the owner of the fee simple estate in Blackacre. And here is her spouse, Igor. Claire has decided that when she dies, she wants Blackacre to go to Igor for the rest of his life. And once Igor is gone, once he's died, she wants Blackacre to go to their son. So she's put all of that into her will. What Claire has created for Igor is a life estate. A life estate is defined as a right to exclusive possession during the life of a particular person. In this case, it's the life of Igor, but no right to dispose of property on the death of that person. So that life estate does not give Igor any right to sell the property either during his life or even once he's dead. It cannot go to whoever he wants in his will. It has to go to their son after Igor has died. So with a life estate, on the death of the particular person, the property may go to either the owner of the fee simple estate. That would be called a reversion. The property is reverting back to the original owner of the fee simple estate. Or the property can go to a third person specified by the fee simple estate owner. And that's called a remainder. In our example here with Claire and Igor, does the son get a reversion or a remainder? The answer is that the son has get or gets a remainder or what's called a remainder interest. The son is a third person specified by the owner of the fee simple who is Claire. So again Claire is the sole owner of the fee simple estate in Blackacre. She has now decided to lease Blackacre to Igor and that lease would run for a year. What Claire has created is a leasehold estate. A leasehold estate is a right to exclusive possession during a specified period. So the leasehold estate that Igor would have is the right to have possession of Blackacre for a period of one year. A leasehold estate is created by a lease contract that is entered into between the lessor, which is the owner of the fee simple estate and the lessor. In this case is Claire and the lessor is Igor. Let's now say Claire and Igor want to own Blackacre together. How would we go about setting that up? There are two different ways of doing shared ownership. The first method is called joint ownership or joint tenancy. And the second way of doing it is co-ownership or tenancy in common. With joint ownership each person would own an equal share of the property. So Claire and Igor would each have an undivided 50% share of the property. With joint tenancy or joint ownership, there is something called a right of survivorship. So on the death of one joint owner, so let's say Igor dies, that person's share, the deceased person's share passes automatically to the remaining joint owner. So in our case here with Igor's death, Claire would automatically become the sole owner of Blackacre. With the co-ownership, so Igor is back in the picture now, each owner may own a different percentage of the property. So in our example here, we can have Claire owning two thirds and Igor owning the remaining one third. With a co-ownership or tenancy in common, there is no right of survivorship. So on the death of one of the co-owners, so Igor again is gone, that person's share is distributed according to that person's will. So if Igor's will says that he wants his one third share to go to his brother, the result would be that Claire would still own her two thirds of Blackacre and Igor's brother would own the other third. So Blackacre has been bought by a developer. The developer has decided to tear down Blackacre, or the house that's on Blackacre, and has rebuilt a brand new condo tower. Claire has decided to buy one of the condo units in the new Blackacre building. So when you buy a condo, what exactly do you own? What exactly does Claire own by owning the condo unit? She has an individual right to possess the space occupied by the unit that she's purchased, a specific unit in the building. So that air that's occupied by that unit, she has an exclusive right to use. So that's also called a flying fee, or instead of being called a fee symbol estate. So literally she owns a piece of air. What she also owns is co-ownership in the common areas. So the common areas of the condo are areas that can be used by all of the unit owners. So that includes the lobby area, the pool, the rec room, the elevators. So any common area, she has a co-ownership interest in those common areas. Any condominium building needs a condominium corporation. A condo corporation is a non-profit organization that manages the building. The condo corporation is run by a board of directors. So those board of directors are elected by the unit owners. The board of directors sets and enforces regulations that govern the use of the building. So that can include rules like whether or not you can have pets in the building, where you can park your bike, what are the hours for the pool to be open. All of those rules and regulations are dealt with by the condo corporation. And the corporation is funded by condo fees that are paid by the unit owners.


Under center, Tannehill gives it to Henry at right guard, Henry to the five, Henry to the end zone, touchdown, Titans, Tennessee with an answer.


Good morning everyone. I think we'll start right now. Hi, I'm Rabimba Karanjay. Today we are going to talk a little bit about something I termed as security pie, which essentially is like a big hack of a lot of scripts cobbled together, a lot of open source software cobbled together in your Raspberry Pi which can run and hopefully give your Raspberry Pi a little more insight if it is getting attacked or not and if your IoT device is getting attacked or not. So, with that a little bit of introduction. I am Rabimba Karanjay. Right now I'm a student at Rice University and I also contribute to, I used to contribute to Mozilla's emerging technology division and I work a little bit on VR and other stuff. This work mostly started as a hobby project and with some push from Mozilla about a certain project which is not there anymore. And so this is completely different to what I do in my school. So first why? Whenever you go to home, what are the devices you see? These are some of the things I don't say in my room but in a lot of people's room. You see a smart TV, I see a Nest, you have little bots which you can control from your mobile and it just runs around.  So great, these are all connected devices. Yeah, but I'm assuming the computer is a little bit more secure from the operating system perspective. So I'm mostly going to concentrate on the devices which I'm assuming are not. But the solution applies. Now let us see, how are they all getting connected? In your home, all these devices, how are they getting connected to the network, to the internet? Most of them don't have any inbuilt connection to the internet, so they rely on your home Wi-Fi to connect to the internet. So we have a single point of contact which is probably my Wi-Fi router and if I can probably protect that, maybe I can protect these. It's the same with IoT devices, you do it yourself IoT devices and other things, we can do that. Now let me ask you a question, how many of you have tried to do in some point of time like you do it yourself project with Raspberry Pi or maybe a Big O bone black? Quite a lot. And how many of you just wanted to get the feel of the product? Okay, I'm going to try the new Raspberry Pi 3 or maybe the Intel Edison. I'm going to install something and just turn these lights on and off, maybe built a kind of like coffee on off machine or something like that. So when you do that, you quickly code, put something, it works and you are excited. Yeah, it works. I have a dashboard, I built a dashboard. How many of you actually think that, okay, these are getting connected? So do you do anything to protect them? Like installing firewall? I see one person, two, three, okay, that's even quite a lot. I myself didn't used to. So because, okay, it works, it works. And when I was actually doing like making something for demo and I realized the new Raspbian, if you do an update even, it doesn't connect to HTTPS sources. It's connected to HTTP sources for repo. Now, we need to protect these devices, these hardware which are mostly unpatched and protected because they are hard to upgrade. Some of you were here for the previous talk. You know how hard it is to upgrade like embedded devices. So we need other ways. So we need to protect the legacy devices. Wait, do we need protection? So this is a graph I just pulled out from an article from Symantec and they were trying to see how attacks on IoT devices increased or decreased over the time. And this was published like beginning of 2006, I think. So as you can see, it sharply increased into 2015 and they predict it will keep on doing like that. So yeah, we probably need some amount of protection. And another case is that the recent DDoS attacks, a lot of them are now in the way of using our household devices. Maybe your refrigerator is taking part in a botnet. Maybe your Raspberry Pi, which you put there to just sense the temperature. Now it's part of a big botnet bringing down things like GitHub or things. Now we need to protect it somehow and we don't need to break a branch for that. So my tools for the trade is a Raspberry Pi 3 with a case to protect itself and I need a micro SD card for noobs and I need a power adapter, which is very important in this case. So why Raspberry Pi? When I asked how many of you used Raspberry Pi, a lot of hands went up. Matter of fact, they sold more than 10 million devices until 2016 end, September, which is quite a lot. And these are like cute little small $35 literal computers which you can carry around or put into your project. They are capable of running everything a computer does, but like you pointed out, I did not put computer in my talk because they are not as protected as a computer. So to do that and to protect other devices, let me start. So I'm going to install a noobs, like an image on that, mostly the Raspbian, and we'll start doing something with it. So the end goal of this talk is that we'll have a device which if you plug in your network, it will try to protect your other devices, which are connected to the network and which are not upgradable or patchable. How to do that? So what about my network? What do I know about my network? Mostly nothing. Apart from the fact that there are packets getting flown around all the time. So all the packets belong to us. Now we need to configure the network. Now there are three ways as I found out, which I can do. So first is that I am defining a gateway in my Raspberry Pi and I connect to that gateway and all my traffic flows through that which is not at all a good solution because somebody trying to do something nefarious or I'm assuming your device has already got hacked and they can just bypass it by changing the gateway settings. The option two I found out which was pretty elegant is that some routers, some hardware support mirror port where you can actually have a port which takes all your traffic and sends it to your computer or Raspberry Pi. The problem with this approach is that this is pretty device specific and most of the devices I found supports it are not exactly household devices. So they are like pretty big switches and costly devices. So not a good fit for a grad student. So the grad student way put your Raspberry Pi in between your router and the internet and I get all the traffic. So the problem with this approach is that there are performance implication my Raspberry Pi might not be able to handle all the traffic and it might hinder my Netflix streaming. But let's try. So what are the things I'm going to do? First I'm going to try to sneak the packets. I'm going to try a deep packet inspection for my packets. Now not exactly deep packet. So I'm going to go with a tool called Bro which is IDS. So what it essentially does is that it gets into your device. It can capture all your traffic. So it can also take a pcap file but it can also life capture your traffic and it does a lot of things on that. Now getting Bro into Raspberry Pi was a little challenging because it has a lot of dependencies but there are a lot of great articles out there so I quickly found out how to do that. And so we install Raspberry Pi, so Bro in the Raspberry Pi and all of these which I'm going to show now and other slides, they're all cobbled together in a script which I'm going to show later, the link to. So don't worry about all the codes. These slides look too dry. Now once we have Bro, what happens is that this is my packet, this is the captured packet, with the Bro I have something like this. So Bro actually takes your traffic and passes it and does a lot of things like connection log, DSCP log, DNS log and all of these has different indicators. We can actually act with these indicators but I want to make it more intelligent. How can we make it more intelligent? We need a huge list of data to do that or maybe a label data where I know which is attack which is not or which are bad actors which are not. How do I do that? I want to do fingerprint analysis like CSI does. Now to do that and to make Bro great again I'm going to integrate critical stack. So critical stack I think recently got again acquired by Capital One but this was an Intel company and once you go there they have a lot of different sources of data. For example, if you see I have phishing domains, I have fault domains and there are a lot of things. So if I get these data then I have a way of knowing which are actually known phishing domains which are if something is running from my Raspberry Pi and sending those links I know there is something wrong. So this gives me a place of data. Now installing it in Raspberry Pi is fairly simple. You have an arm distribution for it, you install it and you're good to go. Now you need an API key to access it and so the API key is actually free. I even tried last night to see if it really is still free and it's still free. And these are all code snippets from the GitHub where it's hosted which I'm going to show later. Now once I have this I also need a way to actually audit my device. I'm assuming my device got hacked, even my Raspberry Pi got hacked somehow. So I can never ensure that it won't be attacked or it won't be hacked, I can never ensure that. But what I can do is that to have a way to audit it so that I know how it happened. So I need a way to log it all and to see. So what about my logs? I'm going to stash the log in LogStash. So how many of you have worked with LogStash or Elasticsearch before? Okay, so I'm going to use three devices which are commonly called ELK, so Elasticsearch, LogStash and Kibana. And all three of them together will give me the system which I'm going to show today. So what LogStash does is that it takes the data source, it takes as input plugin, it filters the plugin and outputs the plugin and you get the logged data. So this data you can have different filters which you can put by coding yourself and have different notifications on that. For example, I can make my Raspberry Pi to actually inform me, to notify me in case something bad happens. So this notification part LogStash will do. So in short, what it does is that it can take different type of inputs which you can see some of them here. Then we have a different type of filters like GROC, search and space, a lot of things. Some of these I used are GROC and GUIP filters and some other. And then the output can go to a different type of things. For example, in a database maybe or maybe a visualization tool or somewhere you can actually see and analyze the data. For our case, I used Elasticsearch because that was easier and pretty. So what we will do, we'll utilize some custom patterns to actually see what is going on and we'll use GROC messaging patterns, we'll add some custom fields, use GUIP. There is a very specific reason for that. I'll show a later slide. We'll use the date match and translation of threat intel. So in short, what it will do is that if somebody from a different country is connecting to your device or your device is sending data simultaneously to lot of weird countries, it will show a flag. Okay, no, what is going on? If I have different message formats or if I have a package inside which is downloading maybe the frack all the magazines and then it will show me that, okay, no, this is something weird going on. So getting lockstash. So to put lockstash in Raspberry Pi is a little problematic. So there's a simple way of getting it downloading and trying to install it, which probably won't work because it needs some other installation files to do it. Once we have all of that, how do I see the logs? All the logs we have will eventually go to Elasticsearch. So to get Elasticsearch, I just download the date file and install it. Once you install it, you will have to update the cluster file name in the YML file. This you will have to do manually because my script doesn't do that. Now, this is all fancy, but I actually want to see. When I want to see, I mean visually see what is happening. So I need Kibana. Kibana is kind of like a visual dashboard where you can have a way of showing all this data and digging deep into it. So this is how we install Kibana, but if you try all this, this is like an official method and then you get an error because it needs something in ARM, which is a node version. So we install the node version of ARM and then Kibana works. This all, by the way, takes a lot of time and trial and error to essentially get done. Hence the script and the stock today. So once we have Kibana, we can actually configure an index pattern of how this all will work. So now comes the hard part. So once we have the configuration file, you see where the position it serves and where the Elasticsearch node goes. And we have an option to provide the cluster file name, which is Elasticsearch for main case. Now we can provide different filters. This is a simple GOT filter I have put. What it does is that it tries to take my whole message in a string format. It tries to differentiate based on my IP, which will be my client, based on different words, what will be my method, and the URL where it is getting connected. Once we have that, we save all these patterns in a file. So once we save this pattern in a file, they will be saved in a different messages, and we actually label these messages. So this number is my label. Why do I need the labeling and the fields? So once I actually have all these parsed data and I add labels and fields on it, next time when something bad is happening and Kibana has to search between all, like if it is already in the database or not, it doesn't have to do the computation extensive operation of regular expression. In the whole message. Instead, it will just search for those specific tags to see those numbers. So these numbers, like 291009, which makes it much easier. Now, what will I have with my GUIP data? So if I want to put more GUIP data than what I have, then I define a specific field here and put my GUIP file. If I have something from my Honeypot somewhere else, which essentially I have. Now, we are going to also see that what happens if my device tries to connect to those bad IPs, which I already have defined. And once it does, by bad IP, I'm also assuming that I will have information from different sources. For example, the IPs, which are TorExit nodes, maybe. So if I can put all the TorExit nodes inside and once I go through, if my device is connecting to any Tor node and I don't use Tor in that case, it will show me a notification that, okay, something is wrong. So this is mostly how it gets done. If it gets something like this, then bad IP, something like that, very bad IP, just normal search. So these are the two sources where I get my IPs. So TorExit IP I get from here and my bad IP source, which I get from here, which we'll have to input to the Kibana database. Now what do I know? I just told you we import a lot of files, we download a lot of files from a lot of websites, put it in our database. We still don't actually see what is going on in our device. We don't have insight. So to get the insight, this is a simple email we are going to get. So I'm assuming I have a simple server, which we have to protect. And so if the search matches and you have a device which connects to a TorExit node, then you get a mail that somebody is connecting to Tor from your devices or any of your household devices. And am I using Tor? I'm not. Then what is going on? Now these are the different type of alerts this script is right now able to handle. The TorAppian malicious IP list you can update with if you have more and if you don't have you can use the existing list and it will go on. The thing is that there is no learning part involved in it. The system does not learn yet. Now if I see in Kibana, so this is something we get. This is the imported data and you see that the attacks different IPs from different regions how it all works out. And the awesome thing about Kibana is you actually cannot drill down into the data. So you actually can see what is going on from which country, how many and everything like that. So I very much like this database but it doesn't do us much good. Now all of these I told assuming I already got attacked and hacked even. So all of these are like, okay this already happened and I am trying to prevent that of doing more damage. But what about proactivity? So here we have in-map which will try to schedule a scan of the subnet. So if somebody is scanning and if you have a new device connected or anything it will parse it and put it in a file which we can see that okay these devices these are normal devices which gets connected these are new devices which got connected. So all these wrapped up in a nice script is here which you can download and if you just initiate the initial installation script it will download and install all for you. Something I missed out on my slide is there is also another portion of code you will see there which mostly deals with network discovery. So we try to actually see which devices are getting connected or disconnected to my device. Now learn more. This is not part of that code this is a different code but I thought okay if I am getting this much amount of data why not try to do something more? Machine learning is all raged nowadays so I try to do something similar. So this is specifically for a device which was kept open with just SSH open to the public and by open I mean not anonymous login is allowed no it's not it has username and password entry and it logs every access attempt normally what it does. So I wrote a simple person which tries to parse all the logs I get and see what is going on and put all the insights I had from different GUIP. So as you can see same user which I had a demo user setup who logged in at the same time from very two different geolocations which was okay that's weird. Now on the right side if you see that's a graph that's showing how many users try to log in so since this is a honeypot they can log in they can try to do different stuff which will see they are succeeding after some point they'll just get like they'll get disconnected and it will go into the block list. So next time they won't get connected at least from the same IP. So these are the different login times I got from in a different time span and the most interesting thing is this so the X and Y axis denotes that how much time a user was logged in so these are all attack users because I never gave actually the password to anyone or the accounts so these device actually got compromised and this is the most interesting part which is this user got user was logged in for a negative time so I actually got a SSH login who was logged in for a negative time period which was awesome interesting I don't have an explanation other than the fact he changed geolocation time zone whatever or my system just failed. So does it work? So this is something else I got so the left chart is from the same semantic article I got from this morning which they tried in their own honeypot of semantic and these are the different countries which actually attacked and are attacking mostly the semantic honeypots and on the right side these are my two Raspberry Pis which got kind of owned now if you see the country list they don't exactly match but they match pretty good enough so this is just a trend that what semantic with their very big infrastructure is noticing actually happens actually can happen to us as well another lesson to not only use SSH with username and password so this is where the remaining part of the code resides where you can get the code for the parser and getting how you can actually cluster them so this actually has a lot of more things going on for example we do a lot of try to do a lot of came in clustering to cluster different activities and stuff which I'm not covering in the talk so this is where the code resides now is there a commercial solution available? there is actually so SS and TrinMicro actually collaborated and made these awesome devices which kind of does the similar work and say they cost like around 140 to 350 dollars they called it the AI protection so artificial intelligence is now protecting us what it does is that it's exactly same it sits in your home it acts as a barrier between your device and internet and the most awesome claim it does is that it tells you that it can patch on the fly your devices without actually patching them so it can do on the fly patching so that was like I was mind blown what is happening how can somebody do on the fly patching what essentially turns out is that they do deep packet inspection and do something very similar to what we do with initially with critical stack they have their own vulnerabilities what happens with the existing device once your device gets connected to these routers they get registered that this device is connecting and this device is connecting when all your data goes in they do a deep packet inspection if they can find a similar type of attack they just block it so that's what their auto patching does but since I realized this is too costly for me so I was checking with my Raspberry Pi which is 35 dollar total solution probably will come around 50, 60 maybe so that was mostly all I had for today and thank you everybody I'm open for any questions you might have yeah so the question was instead of trying to use a shell to actually download everything can't we use Ansible or something like that which essentially makes it much easier and life much easier to like maintain it later so the problem with that is that Raspberry Pi has a limited capacity so I didn't want to install anything more than I needed to like make it work so that is the same logic for installing grow instead of snot I actually tried to use snot for the same purpose which got installed nicely then the device literally crawled so I could not do anything in the Raspberry Pi at all after that so that was one of the reason and I have not tried it with Ansible in Raspberry Pi I'm pretty sure if it can handle it it will work just fine so this was just like a kind of concept that what you can do I'm sure all of you can like write much better easier script to do all these in one go but I tried to do that in shell script yeah which one so there are two I did so I actually so something I have left out is that after doing all this I tried to do like install which actually scans my environment so OpenVas things like that so with just bro ELK installed the Raspberry Pi works pretty fine I can watch Netflix I have tried watching Netflix in 4K so packet goes fine and you can even log into that you can do single stuff like it works so the load is around more than 50% I didn't need a like cooler or anything but with OpenVas installed it still works but it takes a lot of time I mean it pretty much if you install like next time you go inside it it try to do any different stuff it kind of crawls you will get very like big lags and things like that so till now it's okay and Raspberry Pi 3 I have not tried in 2 so no idea I have not tried with OpenWRT and DDWRT I just got my hands on in one for in my lab for a different purpose maybe I'll try it later on I did try it with similar things for example Intel Edison but then again Edison costs like almost $100 and which essentially brings it much makes it much less desirable but it works much faster yeah that's what I did so I just passed it through so that's why I said inline so the elegant solution would have been yeah so my limiting or my assumptions are that the bad actors won't have physical access to my router or anywhere near that so they will only access to the wifi so that once they connect to it I can monitor the remaining part it's not applicable for any IoT devices that they don't have physical access to your network endpoint or anywhere where they can bypass any monitoring yeah it's just for the Raspberry Pi I have had instances where it just randomly stopped or restarted with my mobile charger so that is one essential piece I learned that you save a lot of debugging time if you have a proper 2.5 volt like charger there are a lot of other threads so I mean I just looked into a very specific set of it for example there are two files in the repo where you can like put what other things to look for and for me I just looked at IP, GUIP, time and things like that I wanted to do a time series kind of thing but there are a lot of other aspects for example in this one when we are extracting features you can think of a lot of different things to actually incorporate as your feature and not extraction just think of that in critical stack when you are getting a lot of indicators you can mix and match them with different properties and you have your like this is bad or this is good for me where I was testing this with so I was testing this with in my home which had essentially I had almost around 11-12 I think 11-12 Wi-Fi devices that was another eye-opener for me how many even we don't have a lot of things how many Wi-Fi devices we actually connect every day I have tried that which essentially got me locked down locked out of the system so there in the code you will find instances where it uses fail to ban not users actually just to use their like block list or even IP tables will work that and which is not a very good way of doing it because getting notification is okay but if that was real traffic or something really was going on you are doing something in a laptop and it automatically blocks you so that might not be a very good scenario but if you have a like pretty good confidence things that a confidence score of like okay these are not good so anything like this happens block it so you can do that so essentially just IP tables or block list integration part I mean in the code there is a way to integrate it it's a very bad way I won't recommend it since I got locked out and there probably is better way but there is a way in the code to actually I just changed there so when you actually use fail to ban it actually maintains two lists like which are good and which are bad and you can just mimic the same behavior if I think that okay these these IPs are doing this kind of thing I just send it like okay these tried five times which is their indicator of putting it in block list it will just block that IP that's specific instance any more questions no it does not have a SSL strip so also if you have SSL certificate certificate meaning none of these will actually work that much yes you can so thank you everybody


It's okay. Just stay calm and look at me. This is the interrogator speaking Salamu alaykum wa alaykum as-salam. How are you doing? How are you? I'm okay. Thank God. What's up? Praise God. Alhamdulillah. What's is your name? Muhammad Ahmed Ahmed Al-Arshah And how old are you? I'm about 21 or 22. I was born in the year 2002 and where you from? I'm from Rafa. Rafa is a city in the south of the Gaza Strip Okay, have you prayed for the- have you prayed today the interrogator asked him? He said yes, I have prayed. Alhamdulillah Do you want to say the Fatiha? The Fatiha is the first chapter in the Quran. Go for it Muhammad is reciting the Fatiha from the Quran. Another person enters the room We targeted old men, men and women and babies, little ones, little ones, young women and teenage girls Teenage girls? What did they do to them? They Hamas. They killed them Why do you say it's forbidden? According to Islam, all of what we did is forbidden. What's forbidden? It's the kidnapping, the raping, the whoring of children. It's all considered forbidden according to Islam So why did Hamas do such a thing? Why have they gone- why did he do their heads? They cut them off? Who cut them off? Hamas. After they kill them, they cut their heads off and they place them on the ground Muhammad the interrogation subject drinks a cup of water What were their plans for the abducted women?  The babies? Yes, also the babies. They raped them. They ducted them and they attacked them And they killed them as well