start	end	text
620	5920	Hi folks, welcome to Lock Bypass Village and to my talk all about physical reconnaissance.
5920	11080	So this is going to be a fairly low-tech talk. It's all about how we can use our human senses
11560	17860	and our eyes to walk around and tell as much information as we can about a physical facility
17860	26320	before we ever actually step inside. So I gave a different version of this talk at HOPE a few
26320	34300	weeks ago. That one is a little bit more formal on sort of the architectural plans and inferences
34300	41160	there. This one will be taking a more red team perspective. It's got a lot of new examples that
41160	44300	weren't in the other one, as well as a lot of content that was cut. So I'm going to try to be
44400	48980	a little bit faster with this one and take advantage of the more intimate environment
48980	55180	that a DEFCON Village gives to make this talk all about the Q&A afterwards and having some
55180	64420	interesting discussion. So to get started with the basic information. Intelligence follows a cycle.
64420	69620	So we collect information, we analyze it into usable intelligence, and that's going to determine
69620	74800	if we need to then collect more to decide ultimately what our course of action is. So
74800	79400	that's the end goal that we need to keep in mind while we're collecting this information.
80860	85460	Reconnaissance is something that we want to do of our physical facility, of course, but we're
85460	90920	going to start with the area of influence, both physical and political. So looking at nearby
90920	97180	streets, nearby shops, looking at nearby utilities, etc. As well as if the organization has multiple
97180	103380	facilities, what are those facilities like? Do they have... well, they usually will have very
103380	111580	similar layouts and usages and security situations there. And we want to observe at a range of times,
111580	117680	day and night, week and weekend, and normal operation and during an anomaly to get a sense
117680	124260	of how the organization handles that. We want to look at the people as well as the facility. So
124260	129380	when are they entering? What the general demographic is? We can keep track of how many
129380	135020	enter and leave at each time to get a sense of the occupancy of the building at a particular time.
135020	139480	We want to look at what entrances and exits they use, as well as any security steps that they take
139480	146920	inside, such as keys and credentials, and if they sign in or do anything else on entry.
147780	154020	We can then go up to the main entrance and look at all the information we can get from that. So
154020	159780	this particular picture is very telling. We can see the fire panel off to the side. You can get
160000	163940	a very good sense of the occupancy and layout of the building from all the different fire zones
163940	168680	that are going to exist. We have our fire safety plan blocks here telling us that this is the main
168680	175000	entrance. We look at all the ways that are access controlled on this building. So there are a number
175000	184020	of keypads, a credential reader, a doorbell, a video doorbell, and a different one used at night
184020	189660	apparently. We can see the elevators through in this lobby, so we know exactly how to get to those,
189660	194560	and we can infer that the hallway is going to go perpendicular to that, which makes sense given the
194560	199820	layout of this building. We can notice these magnetic contact sensors there, so that gives
199820	203160	us an indication that we're going to see more of those throughout the building, and there might be
203320	209920	a networked alarm or intrusion detection system. So there's a lot that we can tell just by looking
209920	216260	at the front doors. We can zoom in a little bit on the locks, so we can see something like Medeco
216260	221460	or Schlage Primus lets us know that they take security a little bit more seriously, as well as
221460	227300	an electronic strike plate lets us know that there is an electronic access control system involved.
227300	233700	We can look around back and we might see what's happening in terms of things being
233700	238180	disposed of, so if there's a dumpster back that tells you that the area is in flux, there's
238180	244040	construction going on or something within it. You might see something like a specialized disposal
244040	249400	bin, so in this case it's a cooking oil bin that tells us that there is a restaurant inside, and
249400	254860	they fairly universally look like this, even if they're not so blatantly labeled. We can find the
254860	261460	parking garages, so we know that this one is a full underground garage rather than just a number
261460	267040	of vehicles because it starts to slope down. And we can find the ventilation grates near that and
267040	272420	see how deep they actually go based on seeing, in this case, the light coming out from two levels
272420	279700	down. We can look for the loading docks, and so that'll give us a sense of both where the service
279700	283980	entrances and service corridors are going to be within the building, as well as what type of
283980	290900	material they actually accept at this particular facility. And then looking around the back,
290900	297520	this is a great sign of a site that does not have any alarm system installed on it.
298580	304460	So that starts to give us a sense of what all the entrances around the perimeter of the site are
304460	310760	going to look like. Now we can switch gears a bit and figure out what happens inside of that
310760	317960	building envelope. To do that, we're trying to infer the floor plan of the site, which generally
317960	322540	is going to include assignable space, so that's going to be our offices, residences, etc., what
322540	328320	people are actually using. Circulation space, such as halls, stairwells, and elevators. And
328320	334560	building support space, so washrooms, custodial closets, mechanical space, etc. And by identifying
334560	341020	where all of these elements go, we can then help to improve our red team operation with this
341020	347760	information before we even begin it. So with that, we can get the best plan for how to get from A to
347760	354520	B, and we can then filter that into a timeline. So if, say, we need to go faster than the response
354520	359800	is going to be coming in after we've set off an alarm or some other trigger for the response to
359800	364900	come, we can use this information to determine if that's going to be feasible. We can figure out
364900	370140	where it would make sense to put the cameras and work around that space, as well as we can do a bit
370140	375300	of auditory analysis to see where we could be heard and where we can hear other people. And,
375300	379660	of course, if we plan to do any social engineering in the space once we enter it, it really helps to
379660	387080	know where we're going. So you can get floor plans often from the fire safety plan box, if that
387080	393560	happens to be available to you. If not, you can usually do a search online and sometimes get good
393560	400540	information there. So searching for a PDF and a number of keywords that I've outlined here that
400540	408000	tend to be found in floor plan files online and not in a whole lot else is going to really help
408000	412780	narrow down your search to get floor plans there. And if it's a public building, there's usually a
412780	418860	tenders website that has loads of plans for it. When we infer floor plans, we're not going to get
418860	425220	very detailed diagrams, but we'll get a topology that's good enough for all of these purposes for
425400	430640	a red team engagement. The first thing we'll start with to infer floor plans is the massing
430640	438520	of the building. So what is its overall shape? We have a primary mass, which is the main shape,
438520	442620	anything smaller sticking out of it is called a secondary mass.
443540	449880	This then has surrounding it as a skin is the building envelopes, which envelopes the massing.
449880	455440	It has doors, such as the doors, loading docks, etc. that we looked at before.
455620	461640	Windows, which we'll use the architectural term of fenestration. It would have mechanical equipment,
461640	466880	so vents and louvres coming out of it, as well as potentially equipment on the roof and external
466880	471920	structural members, all of which are clues to the internal layout. We can get this massing
471920	479460	information from Google Maps, often has it for many cities. Many cities also often have their
479460	485740	open data releasing this information. We can look at satellite views, as well as local government's
485740	493200	open data, and of course taking pictures in person. So from the exterior massing and envelope,
493200	498860	how do we determine the floor plan? So here's an example of a very large complicated facility.
498860	503660	Looking at it from an aerial view, we can start to see that it is very well
505440	513140	set out as a linear layout. So it's branched, but otherwise we can infer, well there's probably
513140	518340	going to be a hallway in the center there, with rooms branching off to either side. The size of
518340	523120	those rooms is going to be quantized by the positioning of these windows here. And so as it
523120	528360	turns out, that's exactly what we see. Hallway in the middle, with rooms quantized by the windows,
528360	533540	equal depth on either side. The stairwells, we can start to guess where they are based on where it
533540	539480	makes sense, given fire and egress requirements. And the entire facility, we see that that holds
539480	546700	true as well, with hallways in the middle, and it very closely follows what we could infer from
546700	553700	looking at that external massing. So sometimes we can also get the hall location directly from
553700	558900	fenestration or massing. So in this case, we have both windows and a very thin mass element that
558900	563500	tells us that the hall must be in the middle here. It's usually in the middle, but not always. So in
563500	570200	this case, this bridge tells us that this hall is on the edge. An interesting case study for these
570200	576980	long massings, long thin massings, is prisons. So cell blocks tend to be laid out that way.
577040	580980	In terms of the inside of them, once you've seen one, you've seen them all. They all pretty much
580980	587640	look like this. But there's one interesting aside about prison escapes, and that is that every prison
587640	593600	needs to have a lavatory in it, and every lavatory needs to have plumbing, and that plumbing has to
593600	600460	get out somewhere. And so that will usually be in a crawlspace, and in older prisons it will often
600460	607000	be in a fully-fledged service tunnel that already exists, and that must therefore be connected
607520	612520	through a wall from the cells. So when you hear about people tunneling out of prisons,
612520	616440	you think, well that's a very daunting task. They don't actually have to go very far,
616440	622480	just a couple inches of brick or concrete or whatever it might be, to get to the crawlspace
622480	628080	where the plumbing gets out. We can use this, when we're not trying to break out of a prison,
628080	633940	to determine where washrooms are in a facility before we ever set foot in it. So washrooms need
633940	639380	plumbing, and multi-story plumbing needs pipe riser shafts. So you tend to see the washrooms
639380	645360	are in the same place on every floor, so that the plumbing can be collinear in that regard.
645520	650420	Pipe riser shafts usually end in mechanical equipment at the top of the building, and so by
650420	656580	seeing this mechanical penthouse jutting out on the roof, we can infer that the pipe riser shafts
656580	662820	are under it, as likely are the washrooms. So in this particular example, we have this
663060	667920	t-shaped building, and we can infer that there's going to be likely a t-shaped hallway in the
667920	674080	middle. If we did a bit more research, we determined that this was a long-term care home, and so given
674080	680920	the dimensions of this building, that would be abnormally large for the suites to extend right
680920	687920	the way to the center. So we might infer that there's going to be two hallways per wing,
687920	694240	and support space in the middle, as a building or a facility of this type would need a lot of
694240	700120	support space. We can also see this large vertical window here, indicating some sort of large common
700120	706220	room in this area on every floor. Looking at the floor plan, that is what we find. So we have this
706220	713180	large common room where the window was, as well as suites around the edges, and a loop of hallways in
713180	719260	each wing, and then support space in the center, including stairs on each of the three wings. It
719260	725160	makes sense for egress purposes that they would be located there, and central elevators. High rises
725860	731540	are a lot easier to determine what the layout is, because they're relatively small horizontally,
731540	737000	and there's a number of things that are often stacked. So they're the same place, floor to
737000	742000	floor to floor. Obviously elevators, structural columns, and stairwells, that makes sense.
742040	748140	Washrooms need their pipe space behind toilets, so in this case the pipe space is here, but it's nearby
748140	754520	to it. Telecom closets, electrical closets, pipe shafts, mechanical rooms, and vents, all of which
754520	760740	have vertical risers that ensure that they tend to be vertically stacked. What this gives rise to
760740	766240	is generally you have a central core that's going to contain all of these building support elements.
766240	773400	So your mechanical room, washrooms, stairs, elevators. Here we can see in this diagram that
773940	779340	pipe space behind the toilets there, and that's the reason that's stacked. And that also makes
779340	785060	sense to use this space that's very far from the windows where people like to occupy for
785060	791680	these central core elements, and then let people occupy the outside. This indicates the column grid
791680	797020	here, so this might be partitioned by the final user of the space, and those partitions are
797020	802760	generally going to follow the column grid some way or another. It also makes sense for egress
802760	808160	purposes to have the stairwells and elevators in the central core, because it's about equidistant
808160	815000	from everything in that floor. Most high rises have entire floors dedicated to mechanical
815000	821480	equipment, and we can locate them by noticing very clear differences in the fenestration. So
821480	827940	instead of windows it's mechanical vent louvres. If we see the top level of fenestration is well
827940	831820	below the roof level, that indicates that there's a mechanical penthouse at the top,
831820	836980	and there's also often mechanical basements or partial basements that are going to house
836980	842820	that equipment. So in this particular case we see a number of mechanical penthouses well concealed
842820	847860	within the architecture of the building, and in this case we see loads where the fenestration
847860	852400	doesn't extend all the way up to the roof, and that indicates that that's what's going on there.
852760	857360	We can also do a bit of math, so we can get the height of the building either by public records,
857360	864380	as many of them are, or we can measure it fairly simply with simple trigonometry and
864380	868920	angle measurements. With the height of the building, counting the floors, we can then
868920	873340	determine what the average floor height is, and that gives us a sense of both what the occupancy
873340	879580	is, what the usage is, as well as where the mechanical equipment will go. So very very tall
879580	886140	floors will likely have false ceilings or false floors, and that does affect our ability to bypass
886140	890780	in certain ways, since we know we can get into places through the ceiling or the floor if that
890780	898880	exists. And then shorter ones are then going to have mechanical corridors instead, and they'll
898880	904500	tend to be smaller with a central core housing that mechanical equipment. In terms of high-rise
904500	911760	residential, it's not nearly as open as an office floor plan. It's going to be set up into separate
911760	917640	suites, but they're going to follow a central core as well, housing the stairs, elevators,
917640	924820	and building support systems. And it will tend to have a ring-shaped or u-shaped corridor
925460	930840	for circulation space to give access to all of those units. And so in this particular case, we
930840	936380	see a slightly abnormally shaped building, but stairs, elevators, support space in the center
936380	944320	with a ring-shaped corridor following that general outer perimeter. In terms of identifying where in
944320	949760	the core each things are positioned relative to one another, and in a larger building where these
949760	955180	elements are in general, we can sometimes look at the parking garage. So right away we can see where
955180	959400	the structural columns are, and that's going to extend all the way up the building. We can find
959400	968100	where the elevator banks are. We can find where the telecom riser shafts and pipe riser shafts are
968100	972920	by the location of mechanical rooms in the basement. So in this case, security system room
972920	982440	is very likely going to be located very close to the telecom riser shaft. And that we'll notice
982440	986800	is right beside the elevator lobby, which makes sense in the high rise that's going to be above
986800	993400	this. The elevator and the riser shafts and all this other building support space is going to be
993400	998800	in the central core, so it will be close to one another in the parking garage. Of course, we can
998800	1005480	identify stairs as well. In older buildings, the stairs tend to be located on the outside of the
1005480	1010400	building, and so we can identify those using a number of tricks. Sometimes you can just see the
1010400	1017180	stairs very clearly. Stairs tend to have egress doors at the bottom of them, since they are
1017180	1022860	provided for egress purposes as well. And when you look at the building at night, if there's one
1022860	1027520	column of windows that's entirely lit up, that is usually a stairwell, because it needs to be lit
1027520	1034540	for egress purposes. Here's an example of the stairwell being unfenestrated. It's this
1035160	1040800	secondary mass that runs along the side of the building. A cue that it's a stairwell... well, one
1040800	1049300	is its general dimensions. This makes sense for being a stairwell, as well as extends up onto the
1049300	1053920	roof level of the building. So this is likely a stairwell that goes up and opens up onto the roof,
1053920	1058720	indicating that that is likely what that is. And then we also have some cell towers on this
1058720	1064940	building. Stairwells that are fenestrated, we can tell what they are from the fenestration. So if we
1064940	1070040	see windows that are halfway between the regular floor heights, it's a very good indication that
1070040	1075380	that's a landing on a stairwell. In this case, we have windows zigzagging up the building,
1075380	1081400	and that's likely going to be following stairs that are zigzagging up, landing to landing. We
1081400	1086440	also see that this is a secondary mass sticking out of the building, and it sticks up at the top,
1086440	1091480	creating a little exit onto the roof from the top of that stairwell. And it makes perfect sense
1091480	1097040	that that's located where it is, relative to how these windows are laid out. In this particular
1097040	1102020	case, we have windows that are not aligned with the rest of the windows in the building. This is
1102160	1107280	a residential building. You can tell based on the litness, or how lit the windows are, what that
1107280	1112960	pattern is. And on this column of everything lit with the exact same intensity, that's got to be a
1112960	1119360	stairwell. And here's another example of these half-height windows, indicating this is a stairwell
1119900	1125160	terminating in a door at the bottom, and it's a column of lit windows. So that's very clearly what
1125160	1130600	that is in this case. Where there's a fire escape, we can tell that there's likely no stairwell
1130600	1136500	near it. That's about all we can tell, because they are retrofits. If there's multiple exit doors,
1136500	1141360	and the exit doors are only cued as to where the stairwell is, it might also be to a hallway.
1141360	1145380	We can tell which one's the primary exit door by looking at some safety features.
1145440	1152460	So this light up here, to provide illumination to people exiting, as well as we have a parking
1152460	1158000	lot there, so we have some vehicle ballers to protect pedestrians exiting from being rammed
1158000	1163460	into by vehicles parking, indicates that this is the primary door. And these are likely mechanical
1163460	1171320	doors. That's helped along by the fact that this vent loop exists there. So in this case, looking at
1171320	1176620	this building, can we tell if it's an office building or residential? Based on the pattern of
1176620	1182620	lighting in the windows, we can tell that it is almost certainly an office building, with the
1182620	1190570	lower floors lit, the upper floors likely on timers, and not lit up. We can tell where the
1190570	1197010	elevators are by looking for the associated machinery that goes with them. A hydraulic
1197010	1203130	elevator, they tend to be shorter because there's a hydraulic ram that goes as deep into the ground
1203130	1211310	as the elevator is tall, and so they can't go very high. And as well, they don't tend to show up in
1211310	1216990	very old buildings because they're a newer technology. Every other type of elevator, and
1216990	1222530	most of them are this second type, which is a traction elevator. So they're the typical ones
1222530	1229230	that are hanging off of a cable. And they require a machine room at the top, with some exceptions,
1229230	1235710	but they're rare. That machine room needs to be sticking out above the top level that the elevator
1235710	1242510	serves. So if the windows go all the way up to the top level, all the way up to the roof, we can see
1242510	1247850	that if the elevator is going to serve that top level, it's going to need an elevator penthouse
1247850	1255290	extending out, excuse me, onto the roof. And that's what we see here. We see three elements,
1255290	1260170	three secondary masses extending onto the roof. This central one makes sense to be the elevator,
1260170	1265090	both based on the size, if we compare it to these vehicles down here, as well as the positioning
1265090	1271430	relative to the main entrance to this building. And these secondary masses on the side are likely
1271430	1278590	where the stairwells are coming out, exiting onto the roof. Another couple examples, we can see
1278590	1283330	an elevator penthouse up here, indicating that's likely where the elevator is. In a building of
1283330	1287970	this age and height, it's unlikely to be a hydraulic elevator. And here we can see the
1287970	1293010	elevator directly exiting out the back, and this very likely is a hydraulic elevator.
1293630	1299010	In this case, we can point out the stairwell very quickly by this column of lit windows.
1299010	1303350	There's likely going to be one on the other side of the building as well. And we can infer the rest
1303350	1308590	of the floor plan by noting that there are two balconies per side. Each balcony is partitioned
1308590	1313590	into two, so eight units per side, or four units per side, eight per floor. So there's going to be
1313590	1319190	four more on the other side. We can see this mechanical penthouse only covers part of the
1319190	1323610	building's roof, so the elevator's got to be in the central core, which makes sense for circulation
1323610	1332510	purposes. And we can tell that this building is likely symmetrical all around. Utilities are also
1332510	1339110	very helpful for us to determine what a building's used for, what its occupancy is, and where things
1339110	1345290	are within it. So here's an example. We can see this particular box coming out is a remote meter
1345290	1353030	reader. It's for water, so the water meter reader can go and tap an electronic device onto this to
1353030	1357890	read the meter. And that tells us that this is a mechanical room down here that it goes into.
1357890	1364090	Here's another example where we have both that box as well as the gas meter leading into that.
1364150	1367490	And looking into this grate, it's a bit hard to see in this picture, but there is a vent
1367490	1372970	louvre there, further indicating that that is a mechanical room down there. In this case,
1372970	1379030	we can spot the mech rooms by looking at what we can see, pipes directly in this room. We can see
1379030	1384230	the fire stand pipe coming out of it, so it tells us something about the size of that mechanical room.
1384410	1388750	On the second floor, we can tell that there is none here, because we can see in the windows.
1388750	1392650	And on the third floor, there likely is a mechanical room up here, based on this louvre
1392650	1397990	and the lack of windows. And of course, there's likely going to be some pipe shaft connecting this
1397990	1402610	first and third floor mechanical room, recessed somewhat into the building, because we know it's
1402610	1409210	on the edge. We can look at incoming telephone utilities to determine the occupancy of the
1409210	1414410	building. So a cable coming up from an underground conduit, in this case, we can look at it and see
1414410	1420990	that it, by its diameter, is about a 50 pair copper cable. So this building had a design maximum of 50
1420990	1426410	phone lines in the building, and that's going to estimate the occupancy. We can also look at where
1426410	1431270	the phone lines split up to, if they split up into separate units, to identify what the units are.
1431270	1435750	So we can see a phone line coming along here, entering the building at this point.
1435850	1440250	It's a little hard to see, but there is a line swinging up there and entering at this point.
1440250	1447010	And then there's one along the side here, entering at that point. So from where these phone lines are
1447010	1452390	entering the building, we can identify where the units are. That, combined with the fenestration,
1452390	1457690	will give us a very good sense of what the internal partitioning of the walls is going to look like.
1457690	1461950	Here's an interesting case that gives us a sense of the history of the building. We see
1462570	1468830	a whole rat's nest of phone lines all going to the same place. What likely happened there is
1468830	1475870	this is a rental building, and it changed hands many times throughout its life. And every time
1475870	1480650	it did, a new phone line was installed, and the techs were lazy and just added a new one
1480650	1486510	without removing the old one. So that's likely why we see this pattern here. And so that tells
1486510	1491310	us something about what happens within the building. We can also look at heating, ventilation,
1491310	1496690	and air conditioning. So in older buildings, these tend to be external units, visible, and we can look
1496690	1502550	at what their capacity is to get a sense of what the internal capacity of the building is. In newer
1502550	1508470	buildings, we have cooling towers on the roof, and those are going to have a certain capacity, feeding
1508470	1514610	chillers on the inside that are going to then cool a water ethylene glycol mixture down to what it
1514610	1520050	needs to cool the rest of the building and operate the HVAC systems. We can also look for specialty
1520050	1525430	HVAC equipment. So if you see something like this, kind of looking like jet engines on the top,
1525430	1531850	that's for creating an extreme negative pressure, generally to drive fume hoods or other chemical
1531850	1539110	exhaust disposal systems. And so if you see those, that indicates that that's going on in the building.
1539110	1544690	If you see fans like this, which operate on a similar principle but lower pressure,
1544690	1551190	these are highly associated with cooking spaces. So here we have an axial fan. This is common to
1551190	1558090	see over restaurant spaces. And here we have a centrifugal fan that pulls up from a vent here,
1558090	1563870	indicating that there is likely a restaurant in this location as well. And in this particular case,
1563870	1569010	we have a large industrial dust collector system, indicating that there's a machine shop
1569010	1575150	or some sort of industrial fabrication system going on in this building. We can look at the
1575150	1581030	incoming power. If we have pad mount transformers on the outside, we can look up the capacity of
1581030	1586350	those transformers to figure out what the power requirements are inside that building. And if it's
1586650	1592670	a volt transformer, we can see if it's a double or a single, giving us a sense again of the capacity
1592670	1598550	to a bit less granularity. Kind of an interesting aside about how those are actually maintained.
1598850	1605830	These concrete slabs at the top of them are crane lifted up, and then we can crane lift in and out
1605830	1611950	new transformers to maintain those. So that's kind of interesting how that works. These all look
1611950	1618710	similar to this, with an access hatch and a vent, since transformers do need to be vented or cooled
1618710	1623310	in some way, as well as these crane liftable concrete slabs. So now that you know what these
1623310	1629470	look like, you will start seeing them everywhere in urban settings. Inside of them we have power
1629470	1636410	coming from the underground duct bank, and it then goes in a separate conduit to the basement of the
1636410	1642130	customer's building. And so that gives us a sense, based on the positioning of the hydrovolts, where
1642680	1649190	that customer's basement mechanical room is going to be positioned. If they have
1649590	1653910	a standby generator, they look something like this. Of course we can't see that from the outside,
1653910	1659330	but that does indicate, if it's present, that it's a highly critical facility that's doing something
1659330	1666290	with high importance, if it doesn't get interrupted. We can tell the presence of that
1666290	1671450	by looking for these diesel fuel refilling stations. They look like this on the inside,
1671450	1675970	it's just a pipe that you dump the diesel fuel into, but if you see that, it indicates not only
1675970	1683110	where the diesel standby generator is, but also that one exists in that facility. Looking at the
1683110	1688210	meters gives you a sense of how many separate units are being metered in that particular site.
1688210	1693090	So in this case, we have a tack of the gas meters here, and we can count these, and that's exactly
1693090	1699630	how many separate metered units exist within this building. If we see something like this on the
1699630	1706550	ground, it's a groundwater test well, and so they're going to dig down and essentially leave
1706690	1712750	a pipe, a well, and they can test whenever they need to how deep that groundwater actually is.
1712770	1718310	That could be used for flood prevention, but you also see this happening anytime there is new
1718310	1723810	construction planned that's going to involve excavation. So if you see this and it's not in
1723910	1729850	a floodplain, that likely indicates deep construction is being planned. We can also
1729850	1735970	get a sense from the security features what might be happening inside of a building.
1735970	1744950	So in this particular case, we have vehicle ram bollards here, fairly beefy, as well as very bright
1744950	1751010	glare lighting. These vehicle bollards are to protect from vehicle impact attacks, as well as
1751010	1756330	truck-mounted bombs. If this particular facility has that in its threat model, it gives you a good
1756330	1761430	sense that whatever's going on in there must be fairly serious. As a bonus here, we have these
1761430	1766990	half-height windows indicating a stairwell, and this lack of fenestration here indicates that
1766990	1773450	there's very likely an elevator shaft there, possibly with a little window vent in the penthouse
1773450	1783350	at the top here. So looking at the fenestration in this particular case study, we see a weird pattern.
1783350	1788370	We can tell immediately that there's going to be a basement suite there, so likely from this
1788970	1794950	entrance door there's going to be some stairs up to a fairly tall first floor. When we have a tall
1794950	1800490	floor, the rooms tend not to be partitioned very small, so it's likely either a large open event
1800490	1808970	space or a number of larger rooms within that. Anytime we see a strange looking fenestration
1808970	1815750	pattern, like in this case, we can infer that that's certainly because of whatever requirements
1815750	1822490	the inside of this building has for its layout. Here's a really great example. So we have this
1822490	1829310	L-shaped building, immediately gives us a sense of the circulation layout within it. We can see the
1829310	1835830	elevator penthouse here, as well as a chimney stack indicating that the boiler house is going to be
1835830	1844090	below that. We can see that the boiler house is indeed spanning floors three and four here, and
1844090	1852470	the entire central core supporting this building's utilities is going to be located near there as
1852470	1858090	well by looking at the roof and what exists on the roof. We can also see this framing here that used
1858090	1864010	to support some heavy HVAC unit. It's going to be anchored on the columns of the building, and
1864010	1870310	those columns line up with the breaks in the fenestration alongside of this building. So from
1870310	1875670	this and from the fenestration, we can actually infer the entire structural diagram of this
1875670	1882210	particular building. So that was sort of a whirlwind tour. If you're interested in this sort
1882210	1887510	of thing and would like to see a little bit more of the details of how these things are
1888130	1893690	are done, I encourage you to check out my Hope Talk as well. But this now gives us a great
1893690	1899670	opportunity to have some Q&A, chat about this, chat about some interesting cases that you've seen
1899670	1906130	in your life, and see what else we can infer from these types of tricks. So I'm hoping that this
1906130	1910590	will make you more situationally aware in your everyday life, look at your built infrastructure
1910590	1915870	differently, and when you're going to an unfamiliar building, know where you're going. I'd like to
1915870	1920530	extend a huge thank you to Kara and Bobby, Josh, and Eric for their help in preparing this talk,
1920530	1926850	and I'd be happy to take any questions and start the discussion on this. Thank you very much folks.