Template:LIMSpec/Forensic case and data management - Revision history

Shawndouglas: Spacing

2023-01-04T23:04:03Z

Spacing

← Older revision		Revision as of 23:04, 4 January 2023
Line 55:		Line 55:
	\| style="background-color:white;" \|'''21.11''' If the system supports user-based certificates for authentication, the system shall be configurable enough to require them to be 1. user-specific, not device-specific, 2. used only by one user at any given time, and 3. activated for each use by, e.g., a passphrase or PIN.		\| style="background-color:white;" \|'''21.11''' If the system supports user-based certificates for authentication, the system shall be configurable enough to require them to be 1. user-specific, not device-specific, 2. used only by one user at any given time, and 3. activated for each use by, e.g., a passphrase or PIN.
	\|-		\|-
	\| style="padding:5px; width:500px;" \|[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.10.1.2.1–2]<br />		\| style="padding:5px; width:500px;" \|[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.10.1.2.1–2]<br />[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy Appendix G.6]<br />[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, AC-17(2) ]<br />[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, SC-13, SC-28, and SC-28(1)]<br />
	[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy Appendix G.6]<br />
	[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, AC-17(2) ]<br />
	[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, SC-13, SC-28, and SC-28(1)]<br />
	\| style="background-color:white;" \|'''21.12''' The system shall allow "encryption in transit" and "encryption at rest" of criminal justice information (CJI) that meets or exceeds the requirements of CJIS Security Policy 5.10.1.2.1 and 5.10.1.2.2.		\| style="background-color:white;" \|'''21.12''' The system shall allow "encryption in transit" and "encryption at rest" of criminal justice information (CJI) that meets or exceeds the requirements of CJIS Security Policy 5.10.1.2.1 and 5.10.1.2.2.
	\|-		\|-
Line 70:		Line 67:
	\| style="background-color:white;" \|'''21.15''' If the system is capable of being run in a virtual environment, it shall meet the virtualization requirements set forth in CJIS Security Policy 5.10.3.2 and best practices set forth in CJIS Security Policy Appendix G.1.		\| style="background-color:white;" \|'''21.15''' If the system is capable of being run in a virtual environment, it shall meet the virtualization requirements set forth in CJIS Security Policy 5.10.3.2 and best practices set forth in CJIS Security Policy Appendix G.1.
	\|-		\|-
	\| style="padding:5px; width:500px;" \|[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy Appendix G.5]<br />[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, AC-6(4)]<br />		\| style="padding:5px; width:500px;" \|[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy Appendix G.5]<br />[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, AC-6(4)]<br />[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, SC-39]<br />
	[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST 800-53, Rev. 5, SC-39]<br />
	\| style="background-color:white;" \|'''21.16''' The system should provide separate processing domains in order to not only allow for more granular allocation of user privileges, but also to prevent one process from modifying the executing code of another process.		\| style="background-color:white;" \|'''21.16''' The system should provide separate processing domains in order to not only allow for more granular allocation of user privileges, but also to prevent one process from modifying the executing code of another process.
	\|-		\|-

Shawndouglas: Updated for 2022.

2022-05-05T20:37:05Z

Updated for 2022.

Show changes

Shawndouglas: 21.17 update

2019-11-20T22:48:36Z

21.17 update

← Older revision		Revision as of 22:48, 20 November 2019
Line 73:		Line 73:
	\| style="background-color:white;" \|'''21.16''' The system should provide separate processing domains in order to not only allow for more granular allocation of user privileges, but also to prevent one process from modifying the executing code of another process.		\| style="background-color:white;" \|'''21.16''' The system should provide separate processing domains in order to not only allow for more granular allocation of user privileges, but also to prevent one process from modifying the executing code of another process.
	\|-		\|-
	\| style="padding:5px; width:500px;" \|[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, IA-2(12) ~~and~~ IA-5(11)]		\| style="padding:5px; width:500px;" \|[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, IA-2(12), IA-5(11), and IA-8(1)]
	\| style="background-color:white;" \|'''21.17''' The system should support the use of personal identity verification—a U.S. Federal government-wide credential system—and other forms of hardware-based (i.e., public key infrastructure or PKI) token authentication, while electronically verifying those credentials and any configured token quality requirements.		\| style="background-color:white;" \|'''21.17''' The system should support the use of personal identity verification—a U.S. Federal government-wide credential system—and other forms of hardware-based (i.e., public key infrastructure or PKI) token authentication, while electronically verifying those credentials and any configured token quality requirements.
	\|-		\|-
	\|}		\|}
	\|}		\|}

Shawndouglas: Updated 21.17

2019-11-20T22:02:45Z

Updated 21.17

← Older revision		Revision as of 22:02, 20 November 2019
Line 73:		Line 73:
	\| style="background-color:white;" \|'''21.16''' The system should provide separate processing domains in order to not only allow for more granular allocation of user privileges, but also to prevent one process from modifying the executing code of another process.		\| style="background-color:white;" \|'''21.16''' The system should provide separate processing domains in order to not only allow for more granular allocation of user privileges, but also to prevent one process from modifying the executing code of another process.
	\|-		\|-
	\| style="padding:5px; width:500px;" \|[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, IA-2(12)]		\| style="padding:5px; width:500px;" \|[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, IA-2(12) and IA-5(11)]
	\| style="background-color:white;" \|'''21.17''' The system should support the use of personal identity verification—a U.S. Federal government-wide credential system—and electronically ~~verify~~ those credentials.		\| style="background-color:white;" \|'''21.17''' The system should support the use of personal identity verification—a U.S. Federal government-wide credential system—and other forms of hardware-based (i.e., public key infrastructure or PKI) token authentication, while electronically verifying those credentials and any configured token quality requirements.
	\|-		\|-
	\|}		\|}
	\|}		\|}

Shawndouglas: Added an a new NIST item

2019-11-20T21:29:52Z

Added an a new NIST item

← Older revision		Revision as of 21:29, 20 November 2019
Line 72:		Line 72:
	[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, SC-39]<br />		[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, SC-39]<br />
	\| style="background-color:white;" \|'''21.16''' The system should provide separate processing domains in order to not only allow for more granular allocation of user privileges, but also to prevent one process from modifying the executing code of another process.		\| style="background-color:white;" \|'''21.16''' The system should provide separate processing domains in order to not only allow for more granular allocation of user privileges, but also to prevent one process from modifying the executing code of another process.
			\|-
			\| style="padding:5px; width:500px;" \|[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, IA-2(12)]
			\| style="background-color:white;" \|'''21.17''' The system should support the use of personal identity verification—a U.S. Federal government-wide credential system—and electronically verify those credentials.
	\|-		\|-
	\|}		\|}
	\|}		\|}

Shawndouglas: Added NIST 800-53 to various items

2019-11-14T17:22:31Z

Added NIST 800-53 to various items

← Older revision		Revision as of 17:22, 14 November 2019
Line 45:		Line 45:
	\| style="background-color:white;" \|'''21.8''' The system shall be able to record all National Crime Information Center (NCIC) and Interstate Identification Index (III) data transactions, clearly identifying the operator and authorized receiving agency or organization. III records shall also identify requester and recipient using a unique identifier.		\| style="background-color:white;" \|'''21.8''' The system shall be able to record all National Crime Information Center (NCIC) and Interstate Identification Index (III) data transactions, clearly identifying the operator and authorized receiving agency or organization. III records shall also identify requester and recipient using a unique identifier.
	\|-		\|-
	\| style="padding:5px; width:500px;" \|[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.5.6]		\| style="padding:5px; width:500px;" \|[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.5.6]<br />[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, AC-17(1) ]<br />
	\| style="background-color:white;" \|'''21.9''' If the system provides remote access to authorized users over authorized devices, the remote access shall be monitored, controlled and documented, particularly for privileged functions. If remote access to privileged functions is allowed, virtual escorting that meets CJIS Security Policy 5.5.6 conditions will be required.		\| style="background-color:white;" \|'''21.9''' If the system provides remote access to authorized users over authorized devices, the remote access shall be monitored, controlled and documented, particularly for privileged functions. If remote access to privileged functions is allowed, virtual escorting that meets CJIS Security Policy 5.5.6 conditions will be required.
	\|-		\|-
	\| style="padding:5px; width:500px;" \|[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.6.2.1.1.1–2]<br />[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.6.2.1.2–3]		\| style="padding:5px; width:500px;" \|[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.6.2.1.1.1–2]<br />[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.6.2.1.2–3]<br />[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, IA-5(4) ]<br />
	\| style="background-color:white;" \|'''21.10''' The system shall be capable of putting into place, in their entirety, either the "basic password standards" or "advanced password standards" described in CJIS Security Policy 5.6.2.1.1.1 and 5.6.2.1.1.2. If PIN and/or one-time password is also used, the attributes in 5.6.2.1.2 and 5.6.2.1.3 shall also be required.		\| style="background-color:white;" \|'''21.10''' The system shall be capable of putting into place, in their entirety, either the "basic password standards" or "advanced password standards" described in CJIS Security Policy 5.6.2.1.1.1 and 5.6.2.1.1.2. If PIN and/or one-time password is also used, the attributes in 5.6.2.1.2 and 5.6.2.1.3 shall also be required.
	\|-		\|-
Line 54:		Line 54:
	\| style="background-color:white;" \|'''21.11''' If the system supports user-based certificates for authentication, the system shall be configurable enough to require them to be 1. user-specific, not device-specific, 2. used only by one user at any given time, and 3. activated for each use by, e.g., a passphrase or PIN.		\| style="background-color:white;" \|'''21.11''' If the system supports user-based certificates for authentication, the system shall be configurable enough to require them to be 1. user-specific, not device-specific, 2. used only by one user at any given time, and 3. activated for each use by, e.g., a passphrase or PIN.
	\|-		\|-
	\| style="padding:5px; width:500px;" \|[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.10.1.2.1–2]<br />[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy Appendix G.6]		\| style="padding:5px; width:500px;" \|[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.10.1.2.1–2]<br />
			[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy Appendix G.6]<br />
			[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, AC-17(2) ]<br />
			[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, SC-13, SC-28, and SC-28(1)]<br />
	\| style="background-color:white;" \|'''21.12''' The system shall allow "encryption in transit" and "encryption at rest" of criminal justice information (CJI) that meets or exceeds the requirements of CJIS Security Policy 5.10.1.2.1 and 5.10.1.2.2.		\| style="background-color:white;" \|'''21.12''' The system shall allow "encryption in transit" and "encryption at rest" of criminal justice information (CJI) that meets or exceeds the requirements of CJIS Security Policy 5.10.1.2.1 and 5.10.1.2.2.
	\|-		\|-
Line 66:		Line 69:
	\| style="background-color:white;" \|'''21.15''' If the system is capable of being run in a virtual environment, it shall meet the virtualization requirements set forth in CJIS Security Policy 5.10.3.2 and best practices set forth in CJIS Security Policy Appendix G.1.		\| style="background-color:white;" \|'''21.15''' If the system is capable of being run in a virtual environment, it shall meet the virtualization requirements set forth in CJIS Security Policy 5.10.3.2 and best practices set forth in CJIS Security Policy Appendix G.1.
	\|-		\|-
	\| style="padding:5px; width:500px;" \|[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy Appendix G.5]		\| style="padding:5px; width:500px;" \|[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy Appendix G.5]<br />[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, AC-6(4)]<br />
	\| style="background-color:white;" \|'''21.16''' The system should provide separate processing domains in order to allow for more granular allocation of user privileges.		[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53, Rev. 4, SC-39]<br />
			\| style="background-color:white;" \|'''21.16''' The system should provide separate processing domains in order to not only allow for more granular allocation of user privileges, but also to prevent one process from modifying the executing code of another process.
	\|-		\|-
	\|}		\|}
	\|}		\|}

Shawndouglas: Created as needed.

2019-09-19T22:52:24Z

Created as needed.

New page

{|
| STYLE="vertical-align:top;"|
{| class="wikitable collapsible" border="1" cellpadding="10" cellspacing="0"
|-
! colspan="2" style="text-align:left; padding-left:20px; padding-top:10px; padding-bottom:10px;"|
|-
! style="color:brown; background-color:#ffffee; width:500px;"| Regulation, Specification, or Guidance
! style="color:brown; background-color:#ffffee; width:700px;"| Requirement
|-
| style="padding:5px; width:500px;" |
[http://des.wa.gov/sites/default/files/public/documents/About/1063/RFP/Add7_Item4ASCLD.pdf ASCLD/LAB Supp. Reqs. for the Accreditation of Forensic Science Testing Laboratories 5.8.4.3]
[https://www.astm.org/Standards/E1188.htm ASTM E1188-11 3.2.3] 
[https://www.astm.org/Standards/E1188.htm ASTM E1188-11 3.4.1] 
[https://www.astm.org/Standards/E1188.htm ASTM E1459-13 2.1] 
[https://www.astm.org/Standards/E1459.htm ASTM E1459-13 4.1.1–2] 
[https://www.astm.org/Standards/E1459.htm ASTM E1459-13 4.1.4.2] 
[https://www.astm.org/Standards/E1459.htm ASTM E1459-13 4.2.2–3] 
[https://www.astm.org/Standards/E1492.htm ASTM E1492-11 4.1.1] 
[https://www.astm.org/Standards/E1492.htm ASTM E1492-11 4.1.5]
| style="background-color:white;" |'''21.1''' The system shall be able to assign each piece of collected evidence and each scene a unique identifier using methodologies such as an ID with an incrementing integer (for sequential evidence numbers) or a user-defined naming format for meeting regulatory requirements.
|-
| style="padding:5px; width:500px;" |[http://des.wa.gov/sites/default/files/public/documents/About/1063/RFP/Add7_Item4ASCLD.pdf ASCLD/LAB Supp. Reqs. for the Accreditation of Forensic Science Testing Laboratories 4.13.2.6–10] [https://www.astm.org/Standards/E1492.htm ASTM E1492-11 4.1.1] 
| style="background-color:white;" |'''21.2''' The system shall be able to assign each case a unique case identifier that, in addition to an electronic signature, is able to be automatically placed on, at a maximum, each page of the case's associated examination and administration records.
|-
| style="padding:5px; width:500px;" |
[https://www.astm.org/Standards/E1492.htm ASTM E1492-11 4.1.1.1–2] 
[https://www.astm.org/Standards/E1492.htm ASTM E1492-11 4.1.4–5] 
[https://www.astm.org/Standards/E1492.htm ASTM E1492-11 4.2.2–3] 
[https://www.astm.org/Standards/E1492.htm ASTM E1492-11 4.5.1.1]
| style="background-color:white;" |'''21.3''' In addition to a unique case number, the system shall provide a means to add additional information to a case file, including, but not limited to, submitting agency, agency case number, date of case receipt, name of recipient, shipping and receipt details, items associated with the case and their unique designators, notes, test data, related reports, and other documentation.
|-
| style="padding:5px; width:500px;" |[https://www.astm.org/Standards/E1188.htm ASTM E1188-11 (throughout)] [https://www.astm.org/Standards/E1459.htm ASTM E1459-13 (throughout)] [https://www.astm.org/Standards/E1492.htm ASTM E1492-11 4.4.3 and 4.5.1]
| style="background-color:white;" |'''21.4''' The system should be able to document evidence using an ASTM-compliant evidence log, including, but not limited to, unique identifiers, investigator and custodian names, key dates and times, evidence conditions, and storage location.
|-
| style="padding:5px; width:500px;" |[https://www.astm.org/Standards/E1492.htm ASTM E1492-11 4.3.1.1]
| style="background-color:white;" |'''21.5''' The system should be able to prevent a piece of evidence from being scheduled for destructive testing until an appropriate authorization for such analysis is acquired and documented.
|-
| style="padding:5px; width:500px;" |[http://des.wa.gov/sites/default/files/public/documents/About/1063/RFP/Add7_Item4ASCLD.pdf ASCLD/LAB Supp. Reqs. for the Accreditation of Forensic Science Testing Laboratories 5.8.1.1.1] [https://www.astm.org/Standards/E1492.htm ASTM E1492-11 4.1.2]
| style="background-color:white;" |'''21.6''' The system shall be able to record and maintain chain of custody of evidence that is subdivided in the laboratory in the same way that original evidence items are tracked.
|-
| style="padding:5px; width:500px;" |[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.1.3]
| style="background-color:white;" |'''21.7''' The system shall be capable of recording the secondary dissemination to an authorized agency or organization of criminal history record information (CHRI) sourced from U.S. Criminal Justice Information Services (CJIS).
|-
| style="padding:5px; width:500px;" |[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.4.7]
| style="background-color:white;" |'''21.8''' The system shall be able to record all National Crime Information Center (NCIC) and Interstate Identification Index (III) data transactions, clearly identifying the operator and authorized receiving agency or organization. III records shall also identify requester and recipient using a unique identifier.
|-
| style="padding:5px; width:500px;" |[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.5.6]
| style="background-color:white;" |'''21.9''' If the system provides remote access to authorized users over authorized devices, the remote access shall be monitored, controlled and documented, particularly for privileged functions. If remote access to privileged functions is allowed, virtual escorting that meets CJIS Security Policy 5.5.6 conditions will be required.
|-
| style="padding:5px; width:500px;" |[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.6.2.1.1.1–2] [https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.6.2.1.2–3]
| style="background-color:white;" |'''21.10''' The system shall be capable of putting into place, in their entirety, either the "basic password standards" or "advanced password standards" described in CJIS Security Policy 5.6.2.1.1.1 and 5.6.2.1.1.2. If PIN and/or one-time password is also used, the attributes in 5.6.2.1.2 and 5.6.2.1.3 shall also be required.
|-
| style="padding:5px; width:500px;" |[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.6.2.2]
| style="background-color:white;" |'''21.11''' If the system supports user-based certificates for authentication, the system shall be configurable enough to require them to be 1. user-specific, not device-specific, 2. used only by one user at any given time, and 3. activated for each use by, e.g., a passphrase or PIN.
|-
| style="padding:5px; width:500px;" |[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.10.1.2.1–2] [https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy Appendix G.6]
| style="background-color:white;" |'''21.12''' The system shall allow "encryption in transit" and "encryption at rest" of criminal justice information (CJI) that meets or exceeds the requirements of CJIS Security Policy 5.10.1.2.1 and 5.10.1.2.2.
|-
| style="padding:5px; width:500px;" |[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.10.1.5]
| style="background-color:white;" |'''21.13''' If the system is cloud-based, the vendor shall ensure that CJI is stored in databases located within the physical boundaries of APB-member countries and within the legal authority of APB-member agencies. Additionally, the vendor shall agree to not use any metadata derived from unencrypted CJI for commercial, advertising, or other purposes, unless specifically permitted for limited within the service agreement.
|-
| style="padding:5px; width:500px;" |[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.11.1–2]
| style="background-color:white;" |'''21.14''' If the system is cloud-based, the vendor should agree to FBI and CSA compliance and security audits of CJI.
|-
| style="padding:5px; width:500px;" |[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy 5.10.3.2] [https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy Appendix G.1]
| style="background-color:white;" |'''21.15''' If the system is capable of being run in a virtual environment, it shall meet the virtualization requirements set forth in CJIS Security Policy 5.10.3.2 and best practices set forth in CJIS Security Policy Appendix G.1.
|-
| style="padding:5px; width:500px;" |[https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center CJIS Security Policy Appendix G.5]
| style="background-color:white;" |'''21.16''' The system should provide separate processing domains in order to allow for more granular allocation of user privileges.
|-
|}
|}