From 6ffb29d5d8243ac7211d964c5ee39541607ffe9b Mon Sep 17 00:00:00 2001 From: "Allen D. Householder" Date: Wed, 14 Jun 2023 12:26:26 -0400 Subject: [PATCH 1/9] bulletize list --- doc/md_src_files/030_representingInformation.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/doc/md_src_files/030_representingInformation.md b/doc/md_src_files/030_representingInformation.md index e727e118..0fd439cf 100644 --- a/doc/md_src_files/030_representingInformation.md +++ b/doc/md_src_files/030_representingInformation.md @@ -3,7 +3,13 @@ # Representing Information for Decisions About Vulnerabilities We propose that decisions about vulnerabilities—rather than their severity—are a more useful approach. -Our design goals for the decision-making process are to clearly define whose decisions are involved; properly use evidentiary categories; be based on reliably available evidence; be transparent; and be explainable. +Our design goals for the decision-making process are to +- clearly define whose decisions are involved +- properly use evidentiary categories +- be based on reliably available evidence +- be transparent +- be explainable + Our inspiration and justification for these design goals are that they are the features of a satisfactory scientific enterprise [@spring2017why] adapted to the vulnerability management problem. To consider decisions about managing the vulnerability rather than just its technical severity, one must be clear about whose decisions are involved. From 78a1e0d78f1e936d02397dbf20a401f6ae73654c Mon Sep 17 00:00:00 2001 From: "Allen D. Householder" Date: Wed, 14 Jun 2023 12:27:17 -0400 Subject: [PATCH 2/9] add text to point ahead to "Information Changes over Time" --- doc/md_src_files/030_representingInformation.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/doc/md_src_files/030_representingInformation.md b/doc/md_src_files/030_representingInformation.md index 0fd439cf..f8522b6e 100644 --- a/doc/md_src_files/030_representingInformation.md +++ b/doc/md_src_files/030_representingInformation.md @@ -36,8 +36,14 @@ Quantified metrics are more useful when (1) data for decision making is availabl Vulnerability management does not yet meet either criterion. Furthermore, it is not clear to what extent measurements about a vulnerability can be informative about other vulnerabilities. Each vulnerability has a potentially unique relationship to the socio-technical system in which it exists, including the Internet. + +Vulnerability management decisions are often contextual: given what is known at the time, the decision is to do X. +But what is known can change over time, which can and should influence the decision. The context of the vulnerability, and the systems it impacts, are inextricably linked to managing it. +Some information about the context will be relatively static over time, such as the contribution of a system to an organization's mission. +Other information can change rapidly as events occur, such as the public release of an exploit or observation of attacks. Temporal and environmental considerations should be primary, not optional as they are in CVSS. +We discuss the temporal aspects further in [Information Changes over Time](information-changes-over-time). We make the deliberation process as clear as is practical; therefore, we risk belaboring some points to ensure our assumptions and reasoning are explicit. Transparency should improve trust in the results. From b41acd6363500efd311c51895e0c192dcf7c1a2d Mon Sep 17 00:00:00 2001 From: "Allen D. Householder" Date: Tue, 27 Jun 2023 09:59:10 -0400 Subject: [PATCH 3/9] Add detail about customization, tree sharing, and decision point scope (#242) * add section about tree sharing, customization, and decision point scope, using stakeholder-agnostic and stakeholder-specific language with examples of each * add words about some potential stakeholder-specific decision point ideas * s/supplier or deployer/stakeholder/ because we support more stakeholders now * typo fix, bulletize and add headers --- doc/md_src_files/060_decision-trees.md | 84 +++++++++++++++++++++++++- doc/style-guide-how-to | 2 +- 2 files changed, 83 insertions(+), 3 deletions(-) diff --git a/doc/md_src_files/060_decision-trees.md b/doc/md_src_files/060_decision-trees.md index 1827067c..0ead80b8 100644 --- a/doc/md_src_files/060_decision-trees.md +++ b/doc/md_src_files/060_decision-trees.md @@ -124,7 +124,15 @@ In our case, we are not attempting to fit a tree to data. Rather, we are interested in producing usable trees that minimize extraneous effort. To that end, we briefly examine the qualities for which decision tree measurement is suitable. -Decision tree construction methods must address four significant concerns: feature selection, feature type, overfitting, and parsimony. +### Decision Tree Construction Concerns + +Decision tree construction methods must address four significant concerns: +- feature selection +- feature type +- overfitting +- parsimony + +#### Feature selection Feature selection is perhaps the most important consideration for SSVC, because it directly affects the information gathering requirements placed on the analyst attempting to use the tree. Each decision point in SSVC is a feature. @@ -136,13 +144,18 @@ If nothing else, this means analysts are spending time gathering evidence to mak The added details also make it harder for the decision process to accurately manage the risks in question. This difficulty arises because more variance and complexity there is in the decision increases the possibility of errors in the decision process itself. +#### Feature types + Regarding feature types, all of the features included in SSVC version 2 can be considered ordinal data. That is, while they can be ordered (e.g., for Exploitation, active is greater than poc is greater than none), they can not be compared via subtraction or division (active - poc = nonsense). The use of ordinal features is a key assumption behind our use of the parsimony analysis that follows. +#### Overfitting + When decision trees are used in a machine learning context, overfitting increases tree complexity by incorporating the noise in the training data set into the decision points in a tree. In our case, our “data” is just the set of outcomes as decided by humans, so overfitting is less of a concern, assuming the feature selection has been done with care. +#### Parsimony Parsimony is, in essence, Occam's Razor applied to tree selection. Given the choice between two trees that have identical outputs, one should choose the tree with fewer decisions. One way to evaluate the parsimony of a tree is by applying the concept of feature importance to ensure that each feature is contributing adequately to the result. While there are a few ways to compute feature importance, the one we found most useful is permutation importance. @@ -174,9 +187,76 @@ Thus, 60 unique combinations of decision values is the point at which a decision SSVC trees should be identifiable by name and version. A tree name is simply a short descriptive label for the tree derived from the stakeholder and/or function the tree is intended for. Tree versions are expected to share the major and minor version numbers with the SSVC version in which their decision points are defined. Revisions should increment the patch number. For example: “Applier Tree v1.1.0” would be the identity of the version of the Applier Tree as published in version 1.1 of SSVC. “Coordinator Publish Tree v2.0.3” would be the identity of a future revision of the Coordinator Publish Tree as described in this document. The terms “major”, “minor”, and “patch” with respect to version numbering are intended to be consistent with [Semantic Versioning 2.0.0](https://semver.org/spec/v2.0.0.html). +### Sharing Trees With Others + +Communities of shared interest may desire to share information about decision points or even create custom trees to share within their community. +Examples include: +- an Information Sharing and Analysis Organization (ISAO) within a critical infrastructure sector might want to define a custom decision point relevant to their constituents' regulatory compliance. +- a corporate Computer Security Incident Response Team (CSIRT) might choose to adjust decision priorities for an existing tree for use by its subsidiaries. +- a government department might define a separate tree using existing decision points to address a particular governance process within their constituent agencies. +- a regional coordinator might want to produce decision point information as a product of its threat analysis work and provide this information to its constituency in an advisory. + +In these and other scenarios, there are two scopes to consider: +1. Decision Point Scope +2. Decision Tree Scope + +#### Decision Point Scope + +Each decision point defined in this document has a characteristic scope, either *stakeholder-agnostic* or *stakeholder-specific*. + +- **Stakeholder-agnostic decision points** describe the state of the world outside the stakeholder's environment. +One might think of them as global facts that form the background context in which the stakeholder is making a prioritization decision. +Nearly all stakeholders should agree on the assignment of specific values to these decision points. +- **Stakeholder-specific decision points** are expected to be contextual to some set of stakeholders. +Information about a stakeholder-specific decision point can still be inherited by other stakeholders using the same tree. +For example in the corporate CSIRT scenario above, the [*System Exposure*](#system-exposure) value might be consistent across all subsidiaries for a centrally managed service. + +We generally consider the following decision points to be *stakeholder-agnostic*: +- [*Exploitation*](#exploitation) +- [*Technical Impact*](#technical-impact) +- [*Automatable*](#automatable) + +On the contrary, we consider the following decision points to be *stakeholder-specific*: +- [*Value Density*](#value-density) +- [*Utility*](#utility) +- [*Safety Impact*](#safety-impact) +- [*Public Safety Impact*](#public-safety-impact) +- [*Situated Safety Impact*](#situated-safety-impact) +- [*Mission Impact*](#mission-impact) +- [*Human Impact*](#human-impact) +- [*System Exposure*](#system-exposure) + +We anticipate that most custom decision points created by stakeholders for themselves or a constituency will be of the *stakeholder-specific* variety. +Examples of these sorts of custom decision points include +- A decision point indicating whether a system or mission context is affected by regulatory oversight that might alter the decision priority. +E.g., a healthcare-focused ISAO might define a decision point about whether a vulnerability affects patient data privacy protection. +- A decision point that incorporates the concept of change risk to a deployer. +E.g., a financial institution might have a very low tolerance for changes to a transaction clearing system. +- A decision point that indicates whether the affected software belongs to a list of critical software for a specific constituency. +E.g., an open-source consortium might want to prioritize fix development for a set of key projects. + +#### Decision Tree Scope + +Two kinds of modifications are possible at the decision tree level. + +- A *Risk Appetite Shift* retains the structure of an existing tree and all its decision points, and simply adjusts the decision outputs according to the stakeholder's risk appetite. +For example, an organization with sufficient resources to efficiently deploy fixes might choose to defer fewer cases than the default tree would recommend. +- *Tree Customization* can be done in one of three ways: + 1. incorporating an already-defined decision point into an existing tree that does not already contain it. + 2. defining a new decision point and adding it to an existing tree. +Note that adding or removing an option from an existing decision point should be treated as creating a new decision point. +The new decision point should be given a distinct name as well. + 3. defining a new tree entirely from existing or new decision points + +Because tree customization changes the tree structure and implies the addition or removal of leaf nodes, it will be necessary for the organization to review the decision outputs in light of its risk appetite as well. + +Risk-shifted or customized trees can be shared among a community of interest, of course. +Further customization within each stakeholder remains an option as well, although there is likely a diminishing return on more than a few layers of customization for the same basic decision. +Of course, SSVC users might choose to construct other trees to inform other decisions. + ## Guidance for Evidence Gathering -To answer each of these decision points, a supplier or deployer should, as much as possible, have a repeatable evidence collection and evaluation process. However, we are proposing decisions for humans to make, so evidence collection and evaluation is not totally automatable. That caveat notwithstanding, some automation is possible. +To answer each of these decision points, a stakeholder should, as much as possible, have a repeatable evidence collection and evaluation process. However, we are proposing decisions for humans to make, so evidence collection and evaluation is not totally automatable. That caveat notwithstanding, some automation is possible. For example, whether exploitation modules are available in ExploitDB, Metasploit, or other sources is straightforward. We hypothesize that searching Github and Pastebin for exploit code can be captured in a script. diff --git a/doc/style-guide-how-to b/doc/style-guide-how-to index 9bf8486f..e18cbad3 100644 --- a/doc/style-guide-how-to +++ b/doc/style-guide-how-to @@ -39,7 +39,7 @@ Terms quoted from other sources In order not to collide use of emphasis, italics (*word*) should not be used to identify a vocabulary word that is not the name of a decision point. If the word or phrase need not be emphasized, it should simply but put in double quotes ("). -If the word or phrase needs to be emphasized because it is critical to understanding the passage and it should stand out from the surrouding text, bold can be used (** or __). +If the word or phrase needs to be emphasized because it is critical to understanding the passage and it should stand out from the surrounding text, bold can be used (** or __). This style should be used sparingly, primarily for the first place that a key term is defined. ================================================= From aa242bc56689687109c6ab6b9fcdc5c579efa760 Mon Sep 17 00:00:00 2001 From: "Allen D. Householder" Date: Tue, 27 Jun 2023 10:06:12 -0400 Subject: [PATCH 4/9] Replace Utility with Automatable in Deployer tree (#248) * replace Utility with Automatable in Deployer options script, CSV, .tex and .pdf Deployer tree v2 had 108 rows, v2_1 has 72 rows. This reflects the change from Utility having 3 options to Automatable only having 2. - Utility = laborious implies Automatable = no - Utility = super effective implies Automatable = yes - Utility = efficient is ambiguous about the Automatable value. All we did was eliminate the Utility = efficient rows from the CSV and kept the values for "laborious" and "super effective". Any subsequent tuning will be handled separately but at least this version is 100% consistent with what information was already present in the v2 CSV file. * fixed variable name in generator script * Fix example to reflect new Deployer tree with Automatable instead of Utility - Removed sync defer from D3 library to ensure init scripts do not fail. Co-authored-by: Vijay Sarvepalli (SEI) --- data/csvs/deployer-options_v2.csv | 109 --- data/csvs/deployer-options_v2_1.csv | 73 ++ doc/graphics/ssvc_2_deployer_SeEUMss.pdf | Bin 36304 -> 34934 bytes doc/graphics/ssvc_2_deployer_SeEUMss.tex | 108 +-- doc/md_src_files/060_decision-trees.md | 4 +- doc/md_src_files/080_workedExample.md | 4 +- favicon.ico | Bin 0 -> 15086 bytes index.html | 466 +------------ src/enumerate-deployer-options.sh | 10 +- ssvc-calc/Deployer-v2.1.0.json | 849 +++++++++++++++++++++++ ssvc-calc/cmu-logo.png | Bin 0 -> 6796 bytes ssvc-calc/icons8-copy-60.png | Bin 0 -> 448 bytes ssvc-calc/icons8-copy-link-48.png | Bin 0 -> 552 bytes ssvc-calc/index.html | 11 +- ssvc-calc/moon_icon.png | Bin 0 -> 4010 bytes ssvc-calc/ssvc.js | 2 +- 16 files changed, 968 insertions(+), 668 deletions(-) delete mode 100644 data/csvs/deployer-options_v2.csv create mode 100644 data/csvs/deployer-options_v2_1.csv create mode 100644 favicon.ico create mode 100644 ssvc-calc/Deployer-v2.1.0.json create mode 100644 ssvc-calc/cmu-logo.png create mode 100644 ssvc-calc/icons8-copy-60.png create mode 100644 ssvc-calc/icons8-copy-link-48.png create mode 100644 ssvc-calc/moon_icon.png diff --git a/data/csvs/deployer-options_v2.csv b/data/csvs/deployer-options_v2.csv deleted file mode 100644 index 189c21ce..00000000 --- a/data/csvs/deployer-options_v2.csv +++ /dev/null @@ -1,109 +0,0 @@ -row,Exploitation,Exposure,Utility,Human Impact,Priority -1,none,small,laborious,low,defer -2,none,small,laborious,medium,defer -3,none,small,laborious,high,scheduled -4,none,small,laborious,very high,scheduled -5,none,small,efficient,low,defer -6,none,small,efficient,medium,scheduled -7,none,small,efficient,high,scheduled -8,none,small,efficient,very high,scheduled -9,none,small,super effective,low,defer -10,none,small,super effective,medium,scheduled -11,none,small,super effective,high,scheduled -12,none,small,super effective,very high,scheduled -13,none,controlled,laborious,low,defer -14,none,controlled,laborious,medium,scheduled -15,none,controlled,laborious,high,scheduled -16,none,controlled,laborious,very high,scheduled -17,none,controlled,efficient,low,defer -18,none,controlled,efficient,medium,scheduled -19,none,controlled,efficient,high,scheduled -20,none,controlled,efficient,very high,scheduled -21,none,controlled,super effective,low,scheduled -22,none,controlled,super effective,medium,scheduled -23,none,controlled,super effective,high,scheduled -24,none,controlled,super effective,very high,scheduled -25,none,open,laborious,low,defer -26,none,open,laborious,medium,scheduled -27,none,open,laborious,high,scheduled -28,none,open,laborious,very high,scheduled -29,none,open,efficient,low,scheduled -30,none,open,efficient,medium,scheduled -31,none,open,efficient,high,scheduled -32,none,open,efficient,very high,scheduled -33,none,open,super effective,low,scheduled -34,none,open,super effective,medium,scheduled -35,none,open,super effective,high,scheduled -36,none,open,super effective,very high,out-of-cycle -37,PoC,small,laborious,low,defer -38,PoC,small,laborious,medium,scheduled -39,PoC,small,laborious,high,scheduled -40,PoC,small,laborious,very high,scheduled -41,PoC,small,efficient,low,defer -42,PoC,small,efficient,medium,scheduled -43,PoC,small,efficient,high,scheduled -44,PoC,small,efficient,very high,scheduled -45,PoC,small,super effective,low,scheduled -46,PoC,small,super effective,medium,scheduled -47,PoC,small,super effective,high,scheduled -48,PoC,small,super effective,very high,scheduled -49,PoC,controlled,laborious,low,defer -50,PoC,controlled,laborious,medium,scheduled -51,PoC,controlled,laborious,high,scheduled -52,PoC,controlled,laborious,very high,scheduled -53,PoC,controlled,efficient,low,scheduled -54,PoC,controlled,efficient,medium,scheduled -55,PoC,controlled,efficient,high,scheduled -56,PoC,controlled,efficient,very high,scheduled -57,PoC,controlled,super effective,low,scheduled -58,PoC,controlled,super effective,medium,scheduled -59,PoC,controlled,super effective,high,scheduled -60,PoC,controlled,super effective,very high,out-of-cycle -61,PoC,open,laborious,low,defer -62,PoC,open,laborious,medium,scheduled -63,PoC,open,laborious,high,scheduled -64,PoC,open,laborious,very high,out-of-cycle -65,PoC,open,efficient,low,scheduled -66,PoC,open,efficient,medium,scheduled -67,PoC,open,efficient,high,scheduled -68,PoC,open,efficient,very high,out-of-cycle -69,PoC,open,super effective,low,scheduled -70,PoC,open,super effective,medium,scheduled -71,PoC,open,super effective,high,out-of-cycle -72,PoC,open,super effective,very high,out-of-cycle -73,active,small,laborious,low,scheduled -74,active,small,laborious,medium,scheduled -75,active,small,laborious,high,out-of-cycle -76,active,small,laborious,very high,out-of-cycle -77,active,small,efficient,low,scheduled -78,active,small,efficient,medium,scheduled -79,active,small,efficient,high,out-of-cycle -80,active,small,efficient,very high,out-of-cycle -81,active,small,super effective,low,scheduled -82,active,small,super effective,medium,scheduled -83,active,small,super effective,high,out-of-cycle -84,active,small,super effective,very high,out-of-cycle -85,active,controlled,laborious,low,scheduled -86,active,controlled,laborious,medium,scheduled -87,active,controlled,laborious,high,out-of-cycle -88,active,controlled,laborious,very high,out-of-cycle -89,active,controlled,efficient,low,scheduled -90,active,controlled,efficient,medium,scheduled -91,active,controlled,efficient,high,out-of-cycle -92,active,controlled,efficient,very high,out-of-cycle -93,active,controlled,super effective,low,scheduled -94,active,controlled,super effective,medium,out-of-cycle -95,active,controlled,super effective,high,out-of-cycle -96,active,controlled,super effective,very high,out-of-cycle -97,active,open,laborious,low,scheduled -98,active,open,laborious,medium,scheduled -99,active,open,laborious,high,out-of-cycle -100,active,open,laborious,very high,immediate -101,active,open,efficient,low,scheduled -102,active,open,efficient,medium,out-of-cycle -103,active,open,efficient,high,immediate -104,active,open,efficient,very high,immediate -105,active,open,super effective,low,out-of-cycle -106,active,open,super effective,medium,out-of-cycle -107,active,open,super effective,high,immediate -108,active,open,super effective,very high,immediate diff --git a/data/csvs/deployer-options_v2_1.csv b/data/csvs/deployer-options_v2_1.csv new file mode 100644 index 00000000..66b5f3fe --- /dev/null +++ b/data/csvs/deployer-options_v2_1.csv @@ -0,0 +1,73 @@ +row,Exploitation,Exposure,Automatable,Human Impact,Priority +1,none,small,no,low,defer +2,none,small,no,medium,defer +3,none,small,no,high,scheduled +4,none,small,no,very high,scheduled +5,none,small,yes,low,defer +6,none,small,yes,medium,scheduled +7,none,small,yes,high,scheduled +8,none,small,yes,very high,scheduled +9,none,controlled,no,low,defer +10,none,controlled,no,medium,scheduled +11,none,controlled,no,high,scheduled +12,none,controlled,no,very high,scheduled +13,none,controlled,yes,low,scheduled +14,none,controlled,yes,medium,scheduled +15,none,controlled,yes,high,scheduled +16,none,controlled,yes,very high,scheduled +17,none,open,no,low,defer +18,none,open,no,medium,scheduled +19,none,open,no,high,scheduled +20,none,open,no,very high,scheduled +21,none,open,yes,low,scheduled +22,none,open,yes,medium,scheduled +23,none,open,yes,high,scheduled +24,none,open,yes,very high,out-of-cycle +25,PoC,small,no,low,defer +26,PoC,small,no,medium,scheduled +27,PoC,small,no,high,scheduled +28,PoC,small,no,very high,scheduled +29,PoC,small,yes,low,scheduled +30,PoC,small,yes,medium,scheduled +31,PoC,small,yes,high,scheduled +32,PoC,small,yes,very high,scheduled +33,PoC,controlled,no,low,defer +34,PoC,controlled,no,medium,scheduled +35,PoC,controlled,no,high,scheduled +36,PoC,controlled,no,very high,scheduled +37,PoC,controlled,yes,low,scheduled +38,PoC,controlled,yes,medium,scheduled +39,PoC,controlled,yes,high,scheduled +40,PoC,controlled,yes,very high,out-of-cycle +41,PoC,open,no,low,defer +42,PoC,open,no,medium,scheduled +43,PoC,open,no,high,scheduled +44,PoC,open,no,very high,out-of-cycle +45,PoC,open,yes,low,scheduled +46,PoC,open,yes,medium,scheduled +47,PoC,open,yes,high,out-of-cycle +48,PoC,open,yes,very high,out-of-cycle +49,active,small,no,low,scheduled +50,active,small,no,medium,scheduled +51,active,small,no,high,out-of-cycle +52,active,small,no,very high,out-of-cycle +53,active,small,yes,low,scheduled +54,active,small,yes,medium,scheduled +55,active,small,yes,high,out-of-cycle +56,active,small,yes,very high,out-of-cycle +57,active,controlled,no,low,scheduled +58,active,controlled,no,medium,scheduled +59,active,controlled,no,high,out-of-cycle +60,active,controlled,no,very high,out-of-cycle +61,active,controlled,yes,low,scheduled +62,active,controlled,yes,medium,out-of-cycle +63,active,controlled,yes,high,out-of-cycle +64,active,controlled,yes,very high,out-of-cycle +65,active,open,no,low,scheduled +66,active,open,no,medium,scheduled +67,active,open,no,high,out-of-cycle +68,active,open,no,very high,immediate +69,active,open,yes,low,out-of-cycle +70,active,open,yes,medium,out-of-cycle +71,active,open,yes,high,immediate +72,active,open,yes,very high,immediate \ No newline at end of file diff --git a/doc/graphics/ssvc_2_deployer_SeEUMss.pdf b/doc/graphics/ssvc_2_deployer_SeEUMss.pdf index 27590550857d119d64f6509e7e866994b9040d80..986007d3f6e59938bf8613384cda84f5c19555fc 100644 GIT binary patch literal 34934 zcmc$^Wpo_PvLz~(EM|rlGqcoUwwRfjnVFf%lEt>bVrFJ$W@faQN8dSfXU?oUKjzna zy;gN~RYhgz-mxPxvnt3HM8)Zu8Q5XTyB-TZU|9i70DB`VSRfFgb^tRAH$WG_C=cKSFp7O$WMlfeDEE)4%GVJGJ1c;nAJ){) z7qfKfxq)a(m}shzot1%RCkz$k8M<6`RcwYM>JF%>m6wm12* z`uASJ(8<;r@DB+h_BO7zcFuq=Yzj`MCYHu7_D)~Wzpw!q)xVfv2C#f>Upz?JnV5Qf zonQs9u>AYj%>L^N6F>>TsAO;N0$~65Z{;sS0W9qQYR>InM6vxhau}sV0op(|Q+9R^ zBMw$WZWeZSGc$HhZZ0!cPBwOCZevq6BNJwRpdlNJp%JSYw}~0Ei3uySi76ASDYuCs zhp8zOCx;maGr#UXK5%w%GBvb?^~f?dGTAmaFf!o!M)spJNJCsOs0O8<1`72%XFy0A ze8O}G9N7<7!4L*;G~;X#$#3AKQV<|lwoZNU|?WwV9+`R0x>}c?*L-T z3eKEFB}tFX%7o5(&CC=jW_n=a$Ty=`ogN4Zk`n^e@ZXu@{ErTZ*xR|7+POFbxc=Q~ z*)KgA3fupqntx!hadR;+a{;(HI2f4z9a~>A{IdUFAeBs=?OmOWzhE=})9jb9{tf#d zD*glWKdt{4OaE8Q|1$=-*twbi54;z;V~ylZw%KR2mkPK#MNei3dvr(Kkwz2kK!x9p zg{gK8q)od|SKy1pa8#H=wNW+Nr{3v$^o02M=vK*i+u$kkaBt*0L}-|XS>7*)8|I(y zcPoGI3~|cmz8~f@;N%Sy%+J-KUoTjQ9GOpdmTz-gGV#Og$~w>OW<3 zq!~bSaDHO|LubI_)jSmF7x{23Y7q6nJ*IJ}P3M9s)^7pF7@ML5i+yNotw?n$n4@}c zyP6fbU7vIE0-e+w8h*jf`+b)i(H2X6;r*c!M8VObq6>A3LUfDzF0~jO<+R-@(c9e` z#P7Ijn|&Zg?sI*xIVQS2)9jstt^Ua}s4MNSj{?3PpOZ z4S|1ZkeAoY2oO#iUj`a46^JU7BF53(BCmAcytldAcfNm|Ar;5Dr_c)~3Xoyu{s7hI zy+Z`|eIoC4^SK+eb{D7OWGQXZ|GuS@;Dd@wjNDy3m!276NW+r4^qku8?vM>3atJ$1Ps0!llqQD*p5h`8%#|( zNxFuRMQUFuAk^v#QsY>tvRDWze`Cx<%jZrUT3K9@j|H`X=Le+1soSSlM9j^3W#wwa z^zI-?+f$EasJusj7!lj%C)hjF_-wg;$TxyaS(ZL%i~UPk=DaYn0y#URn5hnEcb+2tE*`X{KrXYLtY50HpZvVJ;rG zR8@z(1xkl=*67C~`>S!f&2i`3@dAiem$Vyw)KQjT=V(z=oOC`4EMEfN70>hb3&K~c zJ!7O7vHng}7XB)1FKJ=TL!~=u^etHbNVFD|Nzd+`vAEy}BwX+eZL#V)v{)7`GG66a zO$#nm60NddIGLMyJl23LT%=HbDL@_)u3$j^)YA$M^dFZPNFG5+;XOgY3ROVf2?79n z`?u--Gr!@#te9{^#M8Pm1*eh2dCYWO{i~!b@L@_CU?JE#Kp`Oa^P$rp^>nVICoKUG z$KEy=#gWM1H37zp43AhjA%oxs1&y#M_3sdge3HruB&AG0h$f&cIp3S1Es^JF?UFc$ zw51NU62hX+gjTh}l^#eONtVzGQC2%0?8J%Kc<`IijW$;hk75#P+ZdjZafy-?tsA=X zPhyEZHMlNc^`52QiOv08hwPY{xEU19$QEF*&}d?;KC zDrUMj(NXpXT|UyDGIq5Ch*mqhDh+A4XijWsRs0iw1TfUlkdPRO1j zqOEUMx1O+l>F^E6>r4^~Yp0)>y$TxPm&D^{7-6#K*lI!mritoE#J(ZmcdH`$-^NwE z{|PU&0nvk%3UKq|$g5@(k+UAk&!>?v4sizzK#~kF6VMC0ek7*ZpZQPEXyTwRd4XWRLR#8NMISmL zv0r%F7Hg-u5EZO3U@W}AVPK&SZur<3X%p6c=eonSpw%}rpQ;_FyciQ?gt5S+RJ0*s zRyRQ+VpMeppLb1(|0T*8ya{uZUABIM?E67F7f|Ao#;AmiJ2b(EJcPfF?Ddj=StC{! z0V%dv{G%*O1sp0qv^F9{P8|-K-NuYrRWs1BlZ{mQ2j_Ym2spplvO8=vEwZY?95UKgIL7pFSc63cU~s-XK;QwLxDLVBg5_al()$6$Wr zEQZymHf_6j0kdw6C8qgs>|1UX4f$~NM>x{fhU3;;%3{zjVG`kP!t`~?>4Vt()|*>q zsIACTd8@dRm@fpBo*yo=*-Os_fWVh z<+XbUuC_4fA)aQz`TnqQMi&kZ@(j4)<MhcGU*kq_u7%%L8a41h4-!j zR%gLOcD!)$(YIi^^JIs&-7z30s?pg8h-JGJ4~Xt2`5$Byit4@>7Plu2>KsTP?ME#1 z*T2$bcv3=Y$G3GT6g8o&MVvFHHnP*Z^4NW>gRgTkXeVcElUguQf9-lnu4l~nT+;9A z>-u>r_H$J8qcKV-*Ez;7=!G<(J(}dh^@mxNk>amTqOP6I+JX~;TQ~Wk7-qzIm+zxp zzME3!!(9tDsCwjG&;j*0{n)mdt8c-%R1h)pEw|QD-1XcaAio^D$K8j@D0a)~Kf>Ki^< zH_as&vC1Pj?Li2@LNf1Q3W3L8i^AC2P@uk~5H&%rZK9`u(+z+rtq_5TJtB6xK|d;H zN8oYtQx+a=XkLM|DK4yTRR$x0yQdV6Y<(${_$6QU;WP3Y%XMk*)4f$yRvl-!Lzfyl zi1dWkV2aJ@)cu*!;qXUk{;mqR2J{@?5(4h3w&B~P;bhrT&`eDda24W^}bUNXOP5nr2aP z3%NQO4qLVGTMGn-iV}m78e7}hj-($dUzjoTEAJG1<(+UC+$oWLqm>pcsKme^7gR}S z8^@||C`jvvUNc`I0)p~y6XAWMz|r*3guvNUE9Typm5xQ^mS{0|#2mAHI1r%*)d1u@ zd5}NoC7&zMu7n?Jh$n=o>0qt8Cmjxz+S{KE8qRfah$_}`3-?Pak)};hh9*ZY_L!~H zkcze)aF>m@B6rq3kC=i`G@V1Wug1|O^dV1N(lu@xK)6`akdg}0f3xir@lPkMNma_H zIO{u?LL#E%*LQBdQX@%8BO(f0PWbSEwF!Sk#z7*S3A%}n$eFt=#4(8f@w6o7sXQH; z>pf@Jnvd5_s`l~csB=y-ugwm0qvrNvmiZUow`4S9$F?@%^t``xT9)pPhzPyOduJJv zQ%x&FhfAK!64u)Y9`1{}4v#q;7WCT(yO&o^6zq3gODA0{Fk1y3N*ejc^KXDX9h+FI zLBrjl`8QF)Ou7^!ykq1$uVBb z<_Q!;?AL8=BR{k$z8<^-$xC+<6x&PcK5S1eaKP zUUp)G^6KmWfss3N5k<}Sj$Z@Ck2&UdF|f!mdI-Dxy*9_NP~MZyQdDE`lVPZ-rso_S zc;BbaXWkJVeTz{vCA-omWT_V971Zr7~xSUbW5;YFu;fud^Ey&FPM#Jd=|5m$`B zZ~qm~=EO#r)h50bGK%3aH;8a3Xl3-JE7=mn-SU;$q!nL@=U)@2eh)$t*dN0k%cVL` zcR&b$uIt!&zA6mEz%Ea?THUl@R?O*X6=5uY#|vLdFr8yL*z*w5fm+3m`&z@V+VMh# zII2#Z(R{27!lKyg!+RN~Iq(@?AEbFF2g|AjaCIC;)$?l?OkARn$W>8FXX58PoCA0T9UFl>5XIkw;71ip~e-_^8$FJsa+2?QeUAzw7@A_u%Ykzg4?Cam6i#_gNOG#iH-Y3eg#`QW< zaRIEvPOs~;a{cp8YqO%(AJ>`v{H=jQ4}fQ60}&zv$%OXrv!JL8?YFX&Td~&>ci1GA zs)DO?lJN~*X*YV@{ozz{=p)m7vO4Z7M!e$>mrO>1D9p;ST-0Qu&gfgGvc}2TVyIuP z(+LPq11WkW7moOFu=T>P#xB~Nz}bi7$2(jJW2}Mhl(vRFcltAqF@0CPG|vc|PH&fG zqEE1ExQE-T&d)ygVzSfgLYDCFM5uE|9Wa3by5(twSeCCN(PoO%@0<;U!Xs_W!i!)8 z-;+gmw+HD`OgIDR{*S``+4{m#RShsvJmE?T2JMz5jBHs^a%ato0NO;uoea7S>4QwIX=C2iN)C`q;Rp

LF)h(`A|m2MW4BU-$3v42c-baJI#-RUQE zIHd`aHtaV)kqMr5h92!{>w*r{N9*Z*eZG5s`y_mm{PA$iIBVAq6P*GHI%mdjKL<5< z(#D?RMqk5rXatn#M*2g?mehh0+Atrh;d?sx>P+N)(AUrUKFp#z)dLKN=|GvJ~+H*j-N9Wc%lAB=L6!r6EE~vyL57m{fE~h`zQP(?50$ z2xzwKgcKB0UJRGdX`?5zuJs)~y*xR@U77^OOC+(Vnb~|EFytAanBumonBvjqx=jSd z)t4b(@s&3_L%$J2P`s^C6Mu`XhCVHufoAsF^w&Ot z)TijK&nS-9SQOk~;HkF`jQfpWcbfRMtb_4K4rTuUs7)0)XiHgQU)v=160DZN*-4ua zef#XdySwOMom*^4ph|)}nzi zBfas~^5?AFkG7`L{4|dqN@{R@*|pkf$yIUm#aRxc`eNi;rd*`bU#>luc3E1+y2yRpSJRUXX9?r4=N!gzx-sqGgSjlT)3caD z4D#f@AZDw+Y_u+$Wy}O#byWE6P{aP7KzLc$F3KMx*S;$=cw3~cd#gz{L&eS0FR1$7 zWpUU3*!VZ^#zJq0e{~aJ@J(^@Vm7}GvpD2&oT<6)%Z|iAMT6X+-YZjrunECKd-8)| z^%-6+Z1|w5$@bhc58Qj%7mxeV3&xd&tDr2c2PIg3yU(0I=<1jhtg`}GuO(l@YHP0m z6GLIVu<{dsm+vj`W`lo~GQSKzsP$_@V!9ZUV17svmZX&jFq=2IA5}>r!n9AxkQl5s zjNF|VFR2fsK2K-#{V@-7ZrD0}q7(tV2Xye@+2oMy_1ablG`ALRo8YyBov{_%HobM~&Q`41a= zmV2_6;kGRhF>ULw?CiCTu#TRAPV(0p|+1nGQC!@I8J5_k5~%Gjb^q))}U?Nx$#XZX<9)t2)2y) zn-<>$De?;qC6V)0h`0r7?ljm&tg4#jLEX)t6r-j(;P0=v&n5qgd%9I`u+5KdiFJZ? z5rZZ=VcIIW3<%q!Z)9#EYeUWM9}#e@wayU4aJmOb^SXOT_5QQ**LrGjGcG>K-TN z5#hadj~nCov>`UMYwl>oWcmEgd5yTvc>~FQw>)}cg<}&5^%;~1NGp}ue7**|LG|bO z0>i@KSweRUT;R4jcUjR3SXm6eFjmLs#DK!P#qoqx*uNGxSAxmdT%JHM7MHkthSduz<>3|I|*ANYtW{l!sVgKE2zJ_2QBc&&G*p z+ArHxXU-zCPEgDf&Qd!qhDqLPO&9eb?}cJyY@9-EY_Ph%I!T(gb`XEVlot}wTRHtR~P|2^JX22uB zCroiL-S37PIF;tM1^z@~z8?*4lZGbw#IRza?64cQopK1SX2-}PdRb_G$3ahOZl=WQ zDq$P0e-lQ9v(KZBOHI|MEF8X7@wA?9d*zjAtdqpj5%(jATs};mk3-*#CtYSC4hyS4 zgSaj|ZQ~Fb4EkF>(KMb;tEIuGfDZoH&@sXyRbxOOQPM0KgA~<{h0B@Q$H^rx1-8bp z)v_T!YHXNJWkcHFWATtBm_TuXG%QeUAd9jjh#JpX zXG;l5p^9*`G#V2+VTUG%8-BMokICRN&a|&V5=0%@SG5wLCjW9-!)!@iw2n9d)Lqut zGjrSPj2;52nD6;v;^xB@RLfymJfy3;>9L6M@v`$F#02^AUUsZ+?EQ2BhC_lWPI%CK zGtKBn5Xg%5Bs_qnJjf+^!1SbcZcX6U8P1|VC!&wJ?SLIrtCJ!7v*st$#PJ=?^lNI= zNR(Vc=e%%18M$LB*o%)~C>O>AE#h?~Jli;^3hVx*%Rmo`Atf=r(rw(OaP z`IW74fisQub@cY(#z^*KdR&5ne^ZRNEq!nxf1tKK;qM-qO9KbqX{7|k6GXC~%n$`Mc!6Bkxm z!H}Jf*la2h%9*Caor;ehQP>10i~-4}u!gWVd~6d6g`5xo8VCs8xL@c;*oSWx^b^=~X zeT2$$?sQAB6m3*_*lvAxj52c9B*bQ~FZOm2H&)7XL&cwhsLF34Gx<^rm@$AuupV*; z4X>CZW=1~?5i>597iB0$1}ZX4)1p(x&<%~Ps+q}`y)c$%DAaV+h3~WI?{CB-2=UB?+FE! zc=MW}uN#S!8>*88ExydG+re!g+Or;Gh1;8Rq+oA2{w%4FT_w>MwM{tZjA5KcZC_1~ z+b^`>(UV>Xk6JdDy7Hz|rI@1_v;Mb!yZxpH?clG=-BYabE*FEj_g8-$ix0=c&18 zscFHrY55t)QOA~l-+yoXsz9)R^HM`2Ymy($Cgh@S83gP}!BXblB~jvMt0T*g#V~6f zmJZNyzR;~p2yG=3s#lfza?nAO1f-2N1a-Js4v7ujj&qxW?k1pMPuD&BJxkMKKM8VP zz4%+b*QoO!7;ls`{7lb+>zatE^OJ1&>BB$$<$efykC;Fh@(H!| zi$jZacb!TlyCy*GnHeC(w6%>lvX+syOAMYNvcWG=@tu(L5ck(6z4(a*Zu9a+S3lKN zBgA5ISVeF)M-oMTB3leqd68lNd2Kq2dp?tT{yv_3l-+kNPq)~n^|2LFR3_YrLia#n z%+}G$lD5gpuZYrcX<=IB6OXtfsVqT<1k&9tEG3}WpZ3}TCK~k@hlIfWT=K0FE<4m z(KcJLQEZN;MKN)SH43UntNYKXTT8amR@>;3a5EFFj+GzikH^aa3 zCNM_B2TbR^QtYsFz~`5d=l5`qIvvAZ*ERPm&HnF{P8jRRP3mZ#!#W+5u1h-Putp!h z(dM#qOq&WP=oD=@Rpe*;OBd7@>!i>$OQg|6wNokFqA5Gl7!v8T#I-!5B8Ipw_1GKZ zSId}&=jdFWY31}+$)ikmY?kVhZ@6eS@K zhLbZP{HOMlKp2cUN?v&=?>ubD;5QZVZej)yah#A}>8$gEi}(Cv{&9k4OmN6#bacZX zYXnq~!CWFem=1ZFp=Ih+8`zWqC?(c#uFult!PRc})ed1GSCEJbOc0k& zSKClcL0sTh&fu;oDuK9h$WQu%rT#e8;GdnifC#iZ`R1+;f5@O-e_ri?9+)4$AlKnw zn?SWh2mpczo~m-{^6GARkn5-E`JusZyPI3R8(^mfhMxA6H82is~aFxc>5?yjJ3rSh1k@Ss~;tyoJ}HLHCngbuk~lZy(? zsrOZwDD61{!!MioKcUC}gu-m3;_lLqwqV|e>Ze^M{MU!Aaic3{(W zf5sKYHJj5x48Jk<#I`)Q^gQ|teonD{Ui|$Wy3|+vV1)SG^4j0P$M>_&@c;8Epaq9L z-*aaF&ZobjbJbE6*1QGs^qF}o@}Z^99)U5B@X)12t{(kLkPx)S_2wL@faO_2+5a8w z6t?j_n#O-5_g#w#nhL)l(joA}OCbOsV0ZaBvtf_1{P8j4&~mhAkFoD(`N3O=j~`S0 z(x3}`0~3TZH-}^Fevi095txQ{=?YUrp4x(ka&qiNseEMUetmcgScEa}uJVM10c$bw zi}WKUwgaRe3P?Wbncpy?LOBI~3Uyf>)V_cR1?VIQ02mX-4v~hT_iNw5|AM#V`3n*Q z())<6`BBdGVOr%OKEXFBh2KCu19am2yI(~o|M_C@7X$^QpAlVm3N#69`{G=Fon!%i zgaRKuJN)`STm7ql*4@6J-FgdLhTjssz5WRn1QHu`kCTDDvCUtKSd4iVqNhR+y(BDS z@3s2D!i7)8IG3%F6N-~ai+Noa+-9g4=~MPJsd67Gk7%yqAoZ7uGZShr@CV$vI+XZDIZlnf7C8u6bqxrwx*~Bn8KgFqW$02Mt zy+(0P4LL*}-4BF3`ut&tmxhJ}4<+VCIHlg{K1L%tsUS10rOxeb4_$XOZhDj4v?q|H zfc;3O)d(uko94==iPW1P!s8eda9^vzd)YaMMLDRGy5h83mIfOoP<-O#sA`dC^#+G| z@TIVf`gX=Y-JsuvmBL*mMXrew0k2ZzFGEe?Hku;nef;LMn62iMrnUnuru4kW#Gs=^ zuj2`9!2PtdW>_YrS+qHpK7?-_nl6aX07(_}BXP{ST(_nx^KdhrOIpQJLAN*$@1y7` z;s&{rWnmeuDp%1MYOq0hXcRN1a>FImuGq?QQ>;e3$gLi-{~-lYgt-177C*bXSvQHZ{4Yl0qfqPQ%aAYjrNLK}t8caTr z^XQti>dGzKV2kLr__mC^H>HoBzoaU|n7dA!YJWnJI^Zv?ca0OL;@SXC_D@a^913U> z_Wm6SEHX@We5gShNuRT%8CcLcMcZ!r_XJGVRZ8N@@?gF+%bdE=T4J5HHa zY1JkWWT*Eg*qr)-%lS6%sk2mIp~8#Yoi)pr@tvMrg!kmA3ue>Rb$mf6*&CO~c_N=# zD?z-o5b&Maew8l}=YEKah*!dn>Gy4kX*oBRa*#BylPjm@Zi7t&TK|c$(ovs#)%OzS zGVae;#KFVrza&~|W6D7YgDcIx%k$if_Ez9+1L343Kl*EfPQ6o7 zs!G~G7Ae4YSX>z5uD3_&atx5ukgf`UtlyXGJ|n_zoiyjaU=e~S4g84`D3ee~?x+8Y zH2bLidMCxMX=u?qkRtC7Vm1Anu)2NWuD1^}=K9r43(omh(w2Pg-a zC!O`+=8@&CHH4WNCNaXOzD_P^6C{V_;U&})VTgNwA#+@SM|nU8z1VWx??5bl+MePA z@1Q@^^gCJR=d=lG5$UUCqhL43V|Nhd>4bxXrAw;a%UG8G?kg_PgdHm9NKR zvBDVFCA8+ErznG2*}3s(Rh@s>lu+i{JP+|moPvSB^|ZMje}7P3RA6VDek0@Th5NlC z&&5gAHWIc`pXwTk!aU98F>%_DRg~voPOGm!`P#QGp3FnlCZA`l18bBeuc=f|orexrG1MCdd`i%G5?N7OQ z?p@5Niq^xSib9Bd=DKD-!_n_XN}25Vf)PK*;0)}MV5*9lz;x}4pgimbK4&}Q6%9n{ zsDf1-ho(@ax`+&~Q;#~%x>DTg%HIprQLUzc<4Ep7|Sow8vOyRgoNO;Dk3EiIJhpy;Yz zO^svcs~`BO5@ptF=rK*fO$)ZS55MR1-Hgu71>`%llj07pwtZC_bubZm)9xRWN}|pN zS&xHDOE3|s?V*)5lS1cB0r^tt}Z(=;jtnB8r9#uU?5&L52%4j42uEf zIuoRLBHaPaAJ+3WZ;q^QKaJ7K=oVi^e@9g27IN42d!KuUCLO>?9~4$3H*0b( zh|gI6egy6T5?Qwz8iYTjf9BqbW~=`S^jEV(Xt}qsJsXA~m9igh;k-D3gKQwD|8%Tb z%6x~e?L(Bb7EmEN<$1vNaZ}Ob>&uT|0%x@7KwHrlt&QH&qt`*tXof&cH8BxGwYkT; zjfN5M=YXw`7M_vQuFvP>7MyV}l@(yJp^DMAMf7>CA>!vqBM*MDJL`^SAVqaP3MSyw zp876d<#_sA{>?x*Kz-NDv0y}!wsX*v{~#+Ie?OMAXmepCm9e__QEQ}sy3~a=yR8v( zrqQslcpRX4>3#iI(HdKmjpOW5c(jp?F|V}B|Afklk?I(iX{h-mL-QPO2qkd_L@p%i{3wy0nXq_f#o?ezBQ zReVeVa9JBzQ|+D^{SnYMD_DD7@TV!^v(_RyZ&TvW{XJV0*G#}t@WeJ!1WHEc^9HgO zHDL|n30&m+dRn~8Dhd)UD3R^>%kukKr5}&u=rh<(MBt8zZeX!O+O0p#VrjQc^@K@ly-^y&>F@N7LqhJ5aj|nsLU*>@RNggR_rUX4qRa{tgh! zzVp{nq6^V6z4|quf~qe|x1{0Uz*AF6$uYMdGM2f&>go#y_jK^4N*Fy#id@WhK3=oD z$%(tCAN)#1w~Xp8B}BvbqiYbF9{R>j|GG1Q_^3v(?`5unL_P+^%|VU$|5TUoYQ4KL z_t85{=_lw^kOHx5JX;R_uh+ud)Dk@bX_zy<|HxLTwjz7*;I~e0pexw zsYzclZqbr8yFlUZ$S@mLVrO$yPSP?-)uP)2JcD&zn>tKqe|nuL?B%8f%RVLMFCfO% z_cqBvNxt(O8A|@CLQ2cV1>*U%(oKw`=lTG`pg+vSI|1@X_1!T7G_Sg(bZ_$$ALyx5 z)f0EoWXlt{k5{fORcS z{wwIAOy(Z(Zg&3pSTKEvq@Tl}IptdKb8oXRMnBl9xqh_U%=%X^S8#uC8J!ey`+-m9 zvs`9W%2?tRKCbiHu%YKDJ>0?@V51&Jn^_ON0e>qt@^E}=Op>)Y&6FUU9?M<*QFbsB z%+o|x-dcviM;l`IOEVH*L_-MMAw^+9!HjbFFYhL5kAe&xw=`(S8a+VJNaq*Em`@iota^Zyq!a}9S5Z}NJ?m}Q0VGdRG319({ zrY_OhhfNxaZA4V76i9yc9T8TdV@QGQuXN=~O)d;|UYs~>YZ%`3la?;%JFUHyN6qH{ z%t}Qkwn$_jM$#ZEJno3CN7ok0itnVbrGn`C9$()KX~SiW%eAmDhwQ4QoM<9<%OAXN zZt-ooqsM`CIo?Mn8ZZ3{x7sdmRF3iSeUb0C|KB1ZNfKmzCsCKz9Ritx<2>50*Td$0 z6B=zjek_{d+aV{cm)AL@?6-{>N9U}*<}m12Z%rCp&ZiWHp-o$r(>EqAh|c)*l&?dp z-d8c+;l3mcts|bxLeVX)@+l2SChIu{8xA9#1yv#S2m`MV`poYoPS>qq7OO4rqXDF>CgI81q=$ln+|hWT(hoW=qgKmbD9_Wn zDb`}O(l0A7>~14N{1`@LhIJfrn+R8axz`ey-(MzGj}IvRhc{zp1*M zJrpPAZxL1k=!y#5Lpt&VcpuSD(zoR{d?@k{`G@)+F9p;4!5Dr6cI1tYl{hVWf9%O5 zv!sRTVD~;ZC0j^)tJ#S`+NE@{dDIX2Jo2x@Fa?B1Avl<&#J z@W=;s5A-^*W+{Iapr$_?q&bfj;)P)oA50(Jf9sIeVkkvB``|ip9OOp5nBDl(F`g)j zwgY*J{YU3V6Xu2ajx%F5&F@%Ui%+U}LcZj7Z;N{OWix(ojooaAE3SAy+}-4QX|YTB z^j2_!Pi}C%WgIf~`X)^|?o713Q~k67F^v}hGtiOQl-=96Ms?zT)@{-w=Pn=+{-J+b zjSpszTHKYuH#Q|Gpk9=~)*T6JhoJwC`6k(C{*1^b(M+tZZ^VODsbZK2<5uAE3~HMQ z{2Tv>`cEQgPVzKfFmr;)Yr+oHN_W#HDzGUG4?~$QsZ6SgjD}kcNF9M)9}jlc;jTcw z?ba-CysQn^<1H6&H5fPYxYOP3)64Wj_nx9dQ+eD{B@lW07-eFuRvjtoUc0A4@x&72 z_K_8ul{ET&Ne8bzp^g%1b7)i+rSP-{GL4+648a7@z|{6`W<&agiF0T~%*?-swNC{FN`oUlW;%XZi%rVRPk99~MhX{575Q7@Cv6>I!M0JRj2?}qf* zbunz~17<;|baza?(`M&B*dO^N8k62?^MCskA|W3l(;sD?U@`D^!e2ifFWbYnVy7HO zZU=_!F2W<(VN*y-VWmgn7&qm&Q|C0|kunE{aL;}A{VFy3ht)@lIEo`qPirI)@gqN; zoWPP-u6l{D_vdV)L%UoqWB*Wc#bI6csU0U9ar-0T;su9MJ-N5a&brFU7$d>4$c zT8p^1nMb6RM``&~R+I@!vZ`L(zb~`VPOAX9&(H7Wo?S4)aJ0G9TJot=)lqYf1(QMf zz&w|1*obK=^Kj#4;MrnQ&m)P8h=|&gwZNLe}0}Y6G zO5P;&ESJ#R^2Z>xF7%NlAx-JKXL3j)lC+Cmf7i63P10~ou|K0w*J5S!%6HjcW!Y{B z)K2}L07eV1I>Zi$hg%xCG<*cdL zJZ)~9i|*WmG;@errW%IuKwc^pR}wu9|J)T-wD z0p;X)0gO#&gg8Hxf&4S>>~SA0pPu^~`6Ar?tAR%D9kvoQ_scKg4b6~UEEX2z3zGx-s@P?++5*-tXuMJ?3ncd#22w`HQC?IIFbnY z?%nE~lfnJrl^GuAH|>l)j_}~^ChsZw)53zh5I(s(q zVdQs9UXqQA!!3fho|NQ_acV(By`U}^vU4%crtwBx0(#J4CzowdnaRb#e64qB8TiBH zPsgIk9CN(|`Ze2L1iKEUN=k+)#;`B!j;pF}z6&EIH~qv?CD8sD&`@Z-hG7xM?2bST zuWVVwQG=C=m)w*(dCVZ}I#4YvM2}gim-1gy&R(zm6>C;mNTMQU?c>)h@Dtl&!qz)e z6%rnuz6*_H(l77~gXJ9ufInluUeMxELyNa)p|uFEqzi%&g4<;vNK%qwncM{Aa#WZT ze()QRTAS}m@-1Og4^*L^H@JvX?qz1J59#IlnOKa%Mp04r2o)<+V=);JQ_-imA`e}? z{0MruTqM(jr?zZ!g@tM8%6U9!0TJRT}I8 znn|t8XsC7)>(r5dVo{)WAB>c&Vxcb0=DL>Ka=hZW)mj8*1Wr1;MtzY;PPvtf^X5ib z^vuD9kMxohzO0s9<@1{OQ;_-7N7~SVB%zy zn7i{=o6Ps~Ljn#e(3#0oq7qJG^!U;h;8n6rYIf1W>EuOdHm+?7S?gY80_zKgQ7ORT zQ~>Y%HxNd#6F~u-@M(7M7pMqAWo`9!bcH6;T6Ye)|1VLvp44_*;&j9sxJ*-wDg2^> zrW8n6`Q$BN^L4UTbHDhFoX!(+vZ~wNO^s&{7NgFyYq~LF<~6&u>i510gAer@G%h?@ z_VUt&Jj&5`){t4gS6nKL=m*%{-nb`da)GT&wf$doot+Z}=hcA3a<#nCGF0%_HyyuY4+ zB7!HUZ4q#K%_4g+!*_70Tq45ac=!u}Sr??yh)d$3%0M4A{`hGx>0J3J6;8vqf=c7} z7&dgFqb4Oj*1f$zQlrq;9r^l9MbJ#oC&y*>!W5rYkbiA1=aAt#G3!zUrEE>|u);0I zeZD|iVdQm@0UMe76OY1L7X%8BmNVbxW;d{TZ8}xz4|QgIncTZbrT+n}F6K zsgglLo9zPe8ny#k98w-w21@>lP-KK=bO-R+Z5ZHWWPaO`jnxGMhpp|*NJmhuDF%)w z?jN?=>qdY=IS~x%ZLd~QgLSIg75WgqfjZ>NFtVe6w>&BqklsK!Uu@$;q+gdOyf}WS z%5RB|@aYk`zc-#HjB?0_%^+vwRqNLJ5 zL`W$WWEM5Ea1&Epm_G~$4YvSC(=A`cJ(z;_J1EAA<3@@6b?+pySI_yo_Q}CL`avrS zUHiVrW-7)P+MgN^PDbWldu?a@et|X5-Fv}ba$)tp8=IgUOkfq+s@nR3=ft|$ z1Wgqx_rlTgWk*`K2Tge3EHU5EE;?j_l4CvL*W4D9W*Kzuk+5-)tx)eQ2ruI8jy{o9 zzV`^@Q-TUxm04zYIiQ)fEJGmNqO=iJ%-J@5CT<5^*SFcR3}9HR14HRaBA2AyJTR%K zV?`$3D+ok9+A|<7C5Br^`XAZ)NF3Bk8k8X6+FjoZ*pS!@5fFRI3Nw%o_SaPp&LziB zbiE&GBZF4L=rowxpVgo(&NXDe6n2pJ?L{+*7_9k~mmdA}e zVE%ZIgRbN&7 zQxf&cSU4+9*fs`0-w#C+GeIBmP`p-~u@c3d^}*!AEIQW;k97;RJq;FT3c_F9rJ_bV z`JV-2rRu?apXTzo86$ZQ|5+dzB#p~tDe`R<-nAX-=TldsGK`3h*;*5TuV;5a*=Jl&N8w;a# zgv=6`q)>8wCGXYH2~Uv`?0{j|J76Zn1UqR&d`I=&O{pP6In$Ppa?tBX)mP^V%o3z? zBT35}$=wcc3r5xq38D|-YmRXaIab(CWU36GWDa-zGl6Wd=U7Mw@clPFH&Dov!Aa4R z3qHl$`Mx-kfgCb)s*`pHJ~vbxgh7HXZYXm>e{yfg9;jGR31PfY++~gOkg29S=Ic?P zH^GvAw~BJJKazghccWFg*kNjuq4m3S-z%ELE{82IN5*~+4~4%hnOBQB$E+Dj?7mbl zi|KFm1fs7xK^0dn1|cbHT36w$7DSOH0$(3?z3yePk&I7R9|Ab9QY$Qii23Bv--RgwkSbWoghHU80LDIZuQl z&tEtax_@GRBs`;j)U*)NZ?#%4gDS1ZE)l-+bE$KSA^=T45i8jv$v;m4nGLM>>DXKq zwPIYqAidZvFw@Y2Ra2g1xDp^a2I~RmiB@sriiF9N^EN|LcB8erA$PW;TE`HFd=&VS z_kE<7r4!16qbwy)T;wg6sCrSuKx|6LZHE_pq+K>H~oPSfjtR1X&3uV~R{nWIs;i@&)f+gMxtsNn1$G~tt21K)u zJB!YvDlw&__w{gmalJg|A()c$Bjin3xr=&e_>^5hts@*L@>b#jM1ds-39cF{E^jjB zp1q(2_UK1_8+!3PM9stpX{W#}p^e+JoXv+n)zsXP`0>VLkTlBsR;3|*7C+X5r7Rt; zhanOYy(yP>q_}=E1HwY_ZVI#IU}{s;sG=~=j#5mYWT~x*CF%!D4@#mk?i9n^gQd#v zq`|s=gFDOo!hC$qPCG%E@?^A9?MpC0io$CxwYTaTy8yPVaLczEb8}~EL*%~otKssh zO-6inJ35H^ksrJGdlLHJ(X+&^7ZO3`bhYUp_K(!P?|$Xv%}TX6WVI3RpWQg1tzBo? zuJfVrf$TLfOF764Up%sg`xaWVf)68{C37kCeD5wjlbt`Istsms!>&s`qzU+CBktAkHHN)yER+=;9F7 z*oM59ZFMTC1qqmg8u&$9_MTEB3VU8I66qFKe^ZX+KVquh}UMG4X;5Gj`TqHas z*hcdG;+pGgAL)$9k#j0yvzcXj#>j<|PhR74=8eIyBTJ(U;A2^XRhD&Xhds(xCHk7WRY=m}Cyjm*%|Hzv2=wG!LMy1pZ$jc7T*FbcN&qXxEfefS44^4^8mRD z!qxi$gt1hjh7ju7V7uG8Quedk&ajBXbsiJ{HzmPaYlZoyxFlYrcazg6s9ICSw7(i* zJ?l*d_|ahf2{BwS->W{za4Ewkp~wF7kTi#PS4Y(CdnGc9T`F-_1vwT$^Hy9^1@n|!8yF1t8k(C{ae^_=>gaN+ATPzCf)RN|p(5*Pb*~vHtDIXt*)5VRX(H_9& z&I2zYP{s^EUUR>+W@BKX#0qs@`#YrE;gXk!1hUU75#;LrGBj{y?t->joSUgbkH5OU z0^AU>K!2W^nI_dZRb#**q6vCw+&v@ZqVkk0sW^;wz9$JeBX~6Q!nkR$PeJimP`vr` zDYM)Ti0^GV6H6JZfbEZQTp!sH>k7k+7*W6y;8HY{&2-*PJgxkM9Zz61gcm9N1)vZ_ znQ3S8tmfdK&gI@`o{Wk4LwJQV9?P`=oU8cIuaRginm4O$9!Q0yWN%9^q6bbMTwB-r zPV~DJ1)+l0X+UxQC4Oste2tnW%#8NyP>st}J{Q`U7Oyn{c32Sh;sPCcp7#0yN0eA> z(4ELI{WjQ2FA%C2XdQ;^A+N#kY_`y|Vc*uAGpY?fh&SlqQY_&7onJS3wU)wmpVYZO zy2nW@QPjmky&KUB*V%%DZXT*>Q)G^9ovXdG@IBhdeV`v2L^eWaX}$Hw2K()5W|1W< zt>S?8@J;W@gcvW!H`8OxiuQz@rWMpM{X$F^kv1Ouw8x%VDIj;b4yqnr2@ldNqy&OK zy{S|X>V(&RA>=>;L511vZ%=r^qpnlB~id9=Gi) z$Ep(W&182Q{gJ7#fG@ev6uz|X^Rj?mR<4olynT;#8-S2YM~0_Foii;@8M+Y6V+!kJ z1q)q@s|BuYP>R8eQutzLru7MPy=+B`!X89^^xY6F6c?=Pr)5fr4f8U7&D6&ET9boh zn8Sf2niX+P!0V0*nQNRojG(S?K(3#gs!a)mrS|DB0cO~xTwtB;?&7nDYz~Dav!;ra z@t=QSQls@0s{R~$z($0VqT^Y_?pm2}fy*dY!^~sh1T_e=Fj5Y`B;qwE59QL-x3=y- zV19o~@o#a-Y!Mh!Cifvr zaEl?3g=t`5SI)0_8%i1E&WLWe(hI&|Rla$8X%DktZ9$}B@pd~C6Oc6Vr#|sMB}|5# zo+b>(cV#^nk#0VrDKc&$?6s8_Mt>f!O~-`t=_;l;fZK?*HPT|I~H#jO_o^ zcK-t%%D}`%|6l3QHc)x&HALEIu7PbZH;k?AATN8Yt!)x_`?S4UfuOD~DSJp z_3f^%*B`%SFBTQ1Q>)KTIk&vZ0%8?K6J&-KHZX~e%?^5?40U%v!w1SO08~^~QdCq` z5J^cEDKxCVd5R#Cu<=PvB|SK|eNTq6_(W-J8SM#ESsC3uIQ%QiU;xIz0303x+TGOD z0IH~{xxeTeT=zi3FEKBW8w1!19eO^+0XzUn&sTzL2OWU^=Fzt}d>mgc_!#o}>82`T7f8PM~gL6Z7yBk1#{bSF{$k5Q{Lf`n< z+{^@?uCd_{5Si#GO^Ztl13<*JxEm_UI{RYxBWf#}$|^c)2j)j?3lfj40EXVP{Ho?M zODdZRM>{J$o66cpW&DG4a-B$WB|UOwVcS-@rWPOlriW@r80=?!f{z9O4h;>B29E&X2;$EzO`YxsuJ-5* z@LljF^p)CI*A~adr(pu(>`C3u5o!2>R~%t98E%0SEz-u9?{m5G`<$ z>I(5I?1vOI{WENrt^>KAqxD{_b%SKvG!F^ z@?P`vYaU}wW5fNs&^J?6HMMy)wb^Imzx|tO8Tg~E<`G{}Qg!`nX`&sy4G*H@WObmmX7sBR;XS{_q+Eqz}?q{}p#*Qzc!!iwk?&=J6#2 z>Zz6aTbf+Y)WG)Lqf?EY4M0RjMkE*9hT2B}=g)R$11lqd>nBa`pD{7Jb36ljrIk9`@ zrZQdn8^{m9bf$L~Gkm2NkJE2`&t~j5H9NRCaB%(nK6W5u`cC&IYV%02LP-X@kzyEq^FmLDjB9yCv7Go0SoJ8z z{Ob;h1Cql^gLuI7@eZBTdZHIWHJj*aHea;hb^+`%GTdZ^GISzF)c|LD^}}p4vZ>@Fkj}vurxb_4Qvf0;rmqvLdPqi6%RAE21OF7KA}?~ zL?T&TZ7F2I4BGu1H(#bch$?#;`76(juV`H@NJfe~@@^r&{c^ zl^EafpSXPidoq$2ID-A_e>N>e*i;;-ldUjt2ec z5xX{hlH1H1RXGN2<^B5pO&z$G@Q&v}Hqckf$&dWiTOEt9##_ZrT=~q+mmOkLruQcpxFKezRQ_yn+_MlpUJ#B0Wzibf%`&U@IbRx{*nBjlK26k1jUg_Wv=v!&K(ghnCuI)UIiK0c+Fx~lcH(y}H}=u-W+JtC3? zZ-K*U;_AF>xLjp*3@MTi4=01c=zA%f=Oya$g*1@6|4<8S4-@o;Cr zU`iW?XbH9x$5B$raDXS3<)+{cu_fHE#HZ{bP|^>0X#$GVlFMGDF~%h4P9!rp8BpgH+ye z1}=NW^l;)($l^3!y4DIel}nUBdK&(mw|DcY;)wySCzz-a>nkemOgk4X#BO!Tp-Mkj z^CF%u^d=}x@Qer@l9S2XMedv>9Q-z|RNM^1pFWt}M2&SR_-J;s94VwhxOxeL6BIt+ z@iCgTLUPs%mo{NqoNV%gEsjJ<7ll!5>p`a>zBND{XdG#m*-=@WYOj0=8)aG7ZCW70 z^&%K-6M3od=LR&sZ4CEQHqQ}MzpV%8zZSy-3mb`eQWmhOVPTuxN#`?AP+ zkrG9N9DpBccuz(`lG1^Y5+NYYyIIFX5&65WG&qPEdkqMnGin`_l|WXLg63h*g!_>( ze!bb0AelDl_!8V{@RG0%^#l?R305~SFc>aRIR&fHmQ3lHnjHOMVkekpm=$TcSB0|$ z5IBad{lIzCX@mswlloo)1UR3NJQYs;rz7#LMi~*WNVLCG4m2_hl!DSjD_$Js)=o)f@sX|n?*VCA0g06hX^~cf~S z2*g6uk^f%br^E&Xt46=FhV@%BQ|fu!lFbK0f107sKS0*_hNoZOd0#KNGxknag^8Vp z%6n-+sSN#F6(glEVyQ^ngUoL&xHy?HsG5JRp(j4iK7f|b@kM4FzdhJ zWy%s%Yn%U*OJcVrczgm(1^fza3@ri3wh!NBh zzGmDv_m~*x=^LYerbL*d5_%jKyx-Aw78M>^H3vC0p;|DP5gA$6b3;92j5_V`Urmx? z*qg`iH!iOm9aTkJ3Q#Vc{!DW@$EY!WD^b<*v`R-Pu)(H3Ib)W4vwSzbvPHkI2rBf6 z`kGFY(Azv_crMafbM;4P?)A?%so{=xRt^y@EURD(T0ioxk)qz;BPnqDRg;(qlW$<` zuY7O|-13k38l}XxM6J3PmG8n;(`-G-4wOsb3YKIDskdP>@vI<;IT zAjGA$%`Gd@)CYkpA0rd9yA68AlR-QJ)!W%Lp7juxp-P*VgoUHnMb{+gW54z{9lQ&{ zw_>vQIkrctUGT|6`|Jk$wE}S%?&1u-aBHXW6D>C{>hJZtY|W9-Qc1OEDtJEOF03UE z1O!D9E}(O9_}ULUfv#p%$CEPRY2JVj(Kzo-%1qZC)TpSdq7E>E+VR2asK3R3QQeg_ zvc$lzIM)r-^jQKv-mTHJDHM)=)04D(M`C4gTESQxOGL0FfQB{7UzzA~T>q3AJ5jE4 zM=~WMN;mtzGlbR@s8Ff!P**DKMHC-Cv2WioY+r<{g6T+Cn{>#mg;Zt;B8pbF6|oX{ zv#=E3{Y|A<%E^IMXnJK@|Mb1D^1fRQfO!*fO;c%sZy;yq#;DWmy+Xw|Adey)L18hySTs(R1Jh<= zavF}+b$Wmh!DX(5GRIDl&6egOH0w2efUCP!b`L`lRfI5HMeH%ky{hdEU{w?AkK7zA zV2gFX=*#uf4iU$lC6sx}B$ttxA1qDETs<@WNPKil*uLH2*WgO;kAmWfii{_fY9{?K zJ>V7T5KR-)yV!azz%h2xd@tGC=ijw(N;!{tFRleR6*Vh4HpbWu6$iTDkwg|COV_W2 z%^8V$eG@$6%8`YY{hN+bRTOO`R;$X67nAiZZDQ9=i6f~TyKT;hAynQZPvH!7?5?as z2=2z1p?R9&p;hQ8CkSelTh!jubiJ#CXLNjo&P^LP54;wte=WP40;$O@;u&O<;$_0; z1Csc=tKD7EZLfHL$31N}pv}!rOCW==7Qbs%-vU5ZGWx1`+dQaBI7);aL>1HS zx%!*dR(AKv`Ax*2E~H~Ak?Y&bcPdD2)n`l#Ff+}aBzc^#T}hx$l1b^I3m_@Vv4dCKkW=Yusl3<6KRePdiMVhDehiGBAl`OIjM zyZnKzrNf={#ixE?f?RiCGKI58SwSSOn!^&h#XPwVCLmTgVKOeSm-f+2I^V@*Hv0aX zpcNv+Z!$+F=x`okvuL((lbATXW+ScBm&Ifh|szC?Nz49i+jvNizIN2`7&0uwC= zblRR-{iCkprxznl`w=|m2A>vSt7N~`WpKH&X=TzU9@b^=Br4~_0|2DGfz~TI+NG4KG*T$F1>?pw7oVl+a^UMAVl~>Pie~G& zA@&pMB~az+3XMV{2emt10yi%%>p@mr8W7I8L?BHcxt7hP%`N7JxMZi(40_*f)S7C| zfoAekP@&Fi{KT)4GUbZyb2~YPovsQa4VV4+0LtkQ1Bb++{e1ed<`@8vEM?lQUDSaw zYQUhM<`o1rF!{Sqpc2tKp!`ixdNHAX+AZRm*F}u+njIAz9f?e>@5oq%_)VJ`d63q& z^sV7g9bX^=ZYitBVIz->mlCH{{>8PWy4H2mYrUOyj=hSx8K zN9NB&$8tvQ$sg@PN)L2#Jjy)x3pJq*F&n)d0jCrXhXflA+Po#4gorMd30yA)vc* zS`U=RriO5cN=m5SYOEiQi6RV1{SQ{x9d1kskG%b~^S(U2KFOok+Qu#R2bn7vyR+lZ z{V#`7cAZu2*`kW-BHw>viHv&>Y-eW%-hDF~-pZY|Mg`#arNTRw=haU&a%ffSUm)Jd zK?l_vOb(NoKY*ruep~0>pNJIPP^etZYkRdcI280|i)O2>HyDx-bJa~ zs^o$ z9^MX+%3K%Y*u;1_x-na-xh2(Ui~;OZXnts26}F}=ylmYE_8EaAefs~#kl@=~Rd(3; zby$X}!Fi4hDm7QY!0%qN(IzWk*N&#^mVKMTHa436*&l3skC;53=|+!cmr2ituuAJF z9qwCOHA>QRL6Io+bT692{NCZ2w)xQwmNPYS)yQXPhsOgVR=Ma}>Vv{-_BLduN@ElW zp+&}H9z6>r?)%K108vUwg+FUxcog8>me@rt83!s_4w@AX6+K-=2_D^PgNwl|i zwTon1y%q6@XP@!nTdydTf6tATn)Erb2l}wYF>Qgomyv*1u|uSwSdge!!km`j2c`59 z)u#spIuF3v6F4pE#R^#UMoQ|ev|zm@38oUGaL@;XN|`t@aATvDqhJ}Pnio zp@4E7f^cV8Q0-P_&P3cs$+FsbTLbN%pjjID{h-C5BH;PdSe*;a+^&{(Uo zcL#&6DeF3ZVYBLkP-4rTciZ$Vb-02;dgL^oGlb2?8{lZI!19#EueTjI?s?l+fRtk< zZ@&W-Iquzp>LR&jK$Y zV~5^Km}kGDXiM8VN~|Dv!%HdW1mYnajlzJ7^*1Hj=TyYwdgd+{CrzCHs&QJ-oVyicRfUUJkgLlJv{I+ zeQg`#x>fLe&YBaeWUroS*x!uk)~VC;!vKcETG8{EgfR1tBw*pPON8#BOxUAV7d(W| zEY|zI$<4?butrc9t}C&}sAQmUTdE-?dNOe5Lz-L8Ofvp!G1c9?OilrVyE&q;hx^R0 zoBttlHt_7fJr_7NE_u;1jpNNg(rjO?PtbF+p8lByzp9Y;yWapP%IL}0K0fkSP1Q_b zU#ZM)g+UqF)$1|I0K`>gN+&cfJwfTZ^mYVgTF_CV((Ri=0}Oa=VzZnbsqS*!gS9Vu zu18zWy1;KW@uRT(r&6=#&#+ReOpX8vhKO%1ZwpQJAD89%Ll75u#r$o1iV5^($~<(j zp2-`aM^eU}*xsGCDzeE;tSw1QJ57@NflbsRRc7Cnyu_Yi`+Rac&z*f(vl!vW7PnE_ zen(Cy9Ke5EsR7z^6ApN2n`r`7*{nx5eTJx=?-NId@FUI(|@LR3!LdBMxY$&+_YqZEo7SfhnPNNgI zCa`h{_!ur}vZ_MgO9EF^91?}uOxh)|B^lkJvT4)x(9=Un3gkj_j}8p7TIrNX#Hc0D zW_Min^vLDS^57Vl9z+CuM>NgRTV|O&kM!rsk@+p71+fzVczG4jSEfP%l8qI_lNTG4 z?>0d6^(r+XaePr+wSaHo2yI>EkkU-xD^PKhNnW~ZPw^l zg#8W^2?=z?p9j#nCXABp2kNuKHu>vs!mtzF*2*N+@u5Si&w0)~_L{9XDG%>3dnS*V zSpvuqb)h)QeA&9-w+Gzrm&?0aeuVwDWpjOht}Szn1M2jR2b)i!Eeq!TOZ66q#yBfx z(4oYbVU*6Yn6FoxnMAV#N}PhLhSze@MJGBBUyZlhE^GDVVe&U&_-`sgah8YPvX)30 z4)O!%CvN<@s*($!^SHM?NWz9dCslF4%+Pq22l{wPM+>zAQgWdA++dz0DSH7l-J%^g z`lf7ajyQeDL@-tyNnB;UH zv3s^^t@t*eDl_G-#8fB;_^}+7q#Mh?}3ob-ekWO;wta_IZv5$ zmX2NRoZ@9dxm7m_xAjPAP4;5W!OUd!v&qq4SUBSng%5zafwmzj2IeV;$ALK4Qx0cT zKoJ|1b+r!l{+GV`r@`t$-=e9GZGOnqv(;WA*WznqEG3I;&f0J^E-BJ4c(*Y20bPs? z#Ns4ldzi=XL83WOiDV!%5e}nc?UZzJst3K@z@H#Fh_b#khCKvk`gZ~TRC{f&Kl;_V zyTgxuFZ2hnk}D&u=^IA`f9zf8a-yobm|;; zCEM*j!vL1ju>Bh}~nv&Z3clEt}uYv8o?GKQKt@cGEJduPL7hRfr$z$p199V)WX$p)Db zc2v^t3<(lJ)P1q8=lw!uza}&j%AEqP`^AoB*oQ;t7CK~ERd~7B?XLGqgBUnqaaKF< z;+okx;Wf~NRR-Ht`Z#zzsm-Fv%$DJcp08;0S>n%F5Bb`8PzhM6NOawZ*`9eE{6Ybj zGrT$wZtK;QHKl~Zf?)+=pk*JprNqN}eeC?OXXfv6Q%RxRIphsP`%TvmCFy+l#|_FZ zT13>B+5J)u9clLqKz(RmE%aHMQa$v#A94J3&JUq{HfO3+RBnT(r_yFvMw{xA%2oFr zaz)TWL!_9olEP-j4xwzV@yrNiFvFBEV7)oef-rsK1=3meXVy1`Gomd_pJiEO2Es2B zeN>5H9V3OJ#a1}==&4+G3&$1v11_&6rt9?mj`2B5j4o>T|17usEAzE`8R(W$-lY1d z1``T!xzM*{?uZVv-w^HjzwlbnQ;hdEV-5rbgq+bYAg+2RrL`Ms)Ketg~kx z-U$Q*uUtYz>0GbEq<|%5N)6sQ2WmgV=QMkSXeWGJZRrrC^p89wN;hXeKXI_wK)AgU zN0^0^2I||T{hMq>_j>~N1cbP4u6$l@XsL30N-B{mN&F^Jym`UF*5W)4NHuRUnl+?` zuS*wIV8Z*jOo zer^m9;*$Lw$^$m$7if?zgh@ulo;cQoTSQLQnLC zDymBFEHxI__{2Oakhwy0h^g-ECMu4-S(F?@CF}!%O+<{V6-A2tjMnvo3U{Nx&F~Id z1L6|W8G?F2u(5B?lKv^1brF&L%*ULr9u?af%q>iCO6{(zZqw+{*5H29x6c2@Qt~7=-(P8%E;tT>e_TTN>k3I zisH$`@+*P7HpXTfxKN9`IbKzr!OP~Lco8-2R3m18`HsU$zo7#rjeTpe)S{_k{87qGjuaPH)L8Pcu`VRL>C(7Em zX0iGy%i_GfYf0Q;f^3f|OctfYS(@hUu60;3;BIXD4-_LqYLT?5@0%BQ`ErN4k_JiE z(SuPFO-B4v5yx_t>#br>fNWD}AN+yG06Z7ze#w-_@#zRzFt&!H9rGn(gwO`xPn1=7 ztDVEu_KFy)zaE9*O<%+XH_I!{s`!mgEy}(<8KQLeLvL)~tGb%YLz#oAs;%6c3y|25#(83^$f%$gsCWZNadcTA^*Xk2ffFxFbC9^-L;D0nZT@!gEB#vttWE$;JK{ zkee^A7hUr0X^|oDN0P0AsPMwdYx4Cu*5!!zT&!f7WJJuPNPmdD?`U5L2Wy~@oU8v; z5gJcQL=rf9V|rAB$B@I|V@qCG2(t|Q7rwA=VmuAp8g~=Wxk7I{Jw71dQz%Kg!!A{N zjbgev_^$*%fE(EjaL_}PO)Gv|8f5jbqs#M(mNZ7+9yV;r+L~M*teP9tXM9+xmB!EsQ?(0B|x}eI6U0zHF?JXE5D-DNkq#ZTlF};_3BB z(Wh*W3;lyPa8tO`+K3yPqU$?eF{^B@eMrqNJ;bpsJUhc`5&$%ML?wPZmY*NI7<0yf;a-Nt2#co)A!rrvDwt4$%O|hZbmjIUrd5}WIxfmmuoQQL+$7Hz} z$bI%K<1DE&wB=l+jMC|sXccBKgH7P2EQ+}BxxU`F+A z0Is^!)i~kyKbf2k4`W1q}tD442Ffe?suKUeOx%?x5Ia;A~9xUgK@2x(4NDtEPOo zZ^%5a3FXZOf!2cE$R`;h4N0U$!?ehNKWnstD^REPaW4zjL63rZT>}l=^7W*e{v3MA z2xshDwjr*YkSr@P}21u`QdBqYWi-=`@tiLh;k^XLdBO#RI*$XDdSRVFI4Xalb zEd5cJuVb?9#}Wgzgn`LarlzOdkiZ*8>(t;zTdP*YFLyaPwMcR*)c7Y$g$k8VSxi!j zjSJg1EZX>V25jPykG~9dFryx*6gM{=glLaQG9&3q!6qMU@}`q8@yvI@E~vc&p~W#k zcf5e)Hl2)8KH9yXIvulzKodLzo|K|ns^kO?Yba~YRs1}g6>{J3Hw-u%r8F2VOZ8ZKAg*GWV3M^U zyb-O%I^_f3bT7_}_#v6Ba(U!aPbK1Z=&p$tw1;vBY_L#EgQlI^RwJ) zGtiWAdLHZ>_7e_;=Xv%fMh`Cby;53fEZ)eB6rUFg#_QtQ$bYZi|Fo`zC;mO(ajH;m z&zr#*f^_Gv{+ryf90a1)#qKO0(EL&*oiRVHNs>~@anbqS;^q7*^aK8!7dU%#0L;3W z?X+-1=d{TwsTZ?!zGVm3)w`Ed{MRO}fWkhX=gv(kf}fz{7GvppWtv&Va8!Z7hy(c( z*Pno%wP*-+5G`ZjJ+jEqjg8HMyqJBNA=yHP`y*+NGkYH6Z zwIdlRme1$dwSM?~P9kGJUlQ2-#R{)0R!$=;xLRl~UhnwGk3tSr2ti>P$scSK(Qy5*Dmt6fyI%lpGS15X0dD@! z814TB-287WImdrNmTgo9Y!B#>yHBaQ!z8Z*47rFyp$OI?6WFg>DVHtl;?r%3#pNNw ze!e}wAWAoJ`43O;AESBFyYT2P6KXeVa7N;?dp4B3ZX~%TeQjgsw{><>PlIee^j1_` zF-_&V`@qk?byQiavE5$%sHSJB=f#cn zgg}fIjRdN=o_=ub_OXIbjqbL0G4Aljrb_Uk7FSqPd2!lGZrWtJVa;&p)q5yV6K*R1 z&QNGJY{M!amwQLnsgp&S(;9`DL;|_3q0nPsQA+C&&|=G$@7XiUg$zl41`f?@8z`EX z4}*G|KmBdGq?KLG=a&H&Io_3Vo1Zi|l4A#JjwkF!AChj+3kmWI`a#8=*W(}aCxHzq&HL4> z_}50LFWLE@*N6~im*IJ7Z+M9bjI5N2@o$ngp+A#Ec#?k-^#mO=G3dMCTrv_Krn0Qd z9m>7alS1+0Zple8(rJarcuXn*8z)@Hd{R7CPVm+l^O0y(JXVd6EwhP;P+YJ3>lgQt z#O?|3VU~4&-hSSr@$f1)#yg7~DVzsmQao8wFn0#?(L{MX8567rV^cg?kx*_lqz9wM zc+!MW?lj}k1Tujf2E50l@VFAGP;TSI^XwPh?(f1q>pn^kujg^c<(Ai3p62i0{fH_o zFQ1sW>pxXrV|<50d|;w;B2VzeLS?@HLsl67w^?ESuXz7|&q~05%Ss_J_Q&hxJyE)? z7eGwj*c{V~{*7<9HCd(gizyRBf=?%BXsP6E^Zz*})Hf1;Y5qxgdu8gXn=61T#AVmlR_?HEV5>Y9W z|NZtNN)W_a3-)ihx-Jor%7s-XFk;MRwP)Sk28j!TON9S~!jnlSCI2y%7w94hWEiAK zpdicsV}Y`tjSk`%U|$27hCVwTHYBugc}-k>>UL@AD`g82-B{|d9NFLCMeXS3u|c*- zV=YfRW!XLJc#4&Ol-NH}%7MeC5rm3CGvv685Ql3h_9jf!)+<-{>e)p&PSP%>k`bqa zbb$vCDZN#?o^oy006vJRcQ+rRV_H!aMe)tSgFota-0!5z1xU7 zWKT%%+isJ)0tcNx{3`Koq;hmT{cZvFMci)GQf0V8ZOJ#Z_NvQ-Hk9=9KFn6sHADX0 ziE$q{Q{Trn)Hwq)3I1eowQ8t(_~dLa+m=vdePbEdGoTbtO2H6G8f{*JB-Q-49E(Vv zO_4ZId=!aWVf0c|s<1-xu3x?uX;Bacw-Eh?WrzkSS%35C4-&Bv#dZj21+`fG9#D{? z$?j4YY94z@@0u*q|Jh2PisSd)SXVC+N!=2WxJ`22#*6w((_70`0@v>Q>?#%5U(~g^ z`{qvH!nlZ^reV?_(n$Cbu5wQx1~I z_fP#HV)OOP6o>Asck16aWE!{gtj(Lzze%LJJM`8rN29Ep+|84|&2*W5A-hQT<%EbN z?mw-1JHC`y&ycu!YpT7?+lrp$LWZ$5M?BO7m1pt>*@SoA^U!z|=y&+2<*MR#bN9&3 z=^D}VcP8yS5U%_|RDZ>NSNTK+oAVy*daC>}Vf*Yyu`T@%Sk67*p0qDF^SHTFTACUgn?`9W=z~?{7b$3jq(%U_zWFJ*)dqyPM(DYf=Hw(L=H&sis76Re zX0ZYg6{MsAwd*K^r4|(fZBsDT16pBfX=G+?gJrkfq0*dleN|QmBKn#bO0h9_UN-QWyO#v1Mi8;lo zpt2w}F9lStAXmna@+BfDH4R?67=cR=EQJfCkO@dE$}Lu~u>pojeokp_UaRjes^O=!YvrD;O#OxAG~(D(DAiR;4N!E9iT=C`8+sq?($VC7Br~S{j*} zrlpyhTUw+Uo12&#S|+EOB&8VI*(916B_1n46`U z8QR676l}>!3`}arwu!K*u^o%&Vc;}pe2W>|3aEgqxFoTtq@pM_jmyZ;j7wG3)!&T^ E0PWdctN;K2 literal 36304 zcma&Nbx<7J7cGptlQ0n6gS)#2mtYAD1cwB7$l&e{!QI{6-3jjQ?mECX_ulub`l{YP zZ>r{0ch#xxwf9#cyGqEvqp-@lF_AjDvld+Q782&^N6hvWBFtIjsG$&(Y zV(xuxpi_U%#!<4gn0XI z7zMP7*Yc+Rr#IXP&4GO74e(?C``c~*{gFuG`!nE?#l+z{^X;}6t+%t@ccbV%`~4-A zG_|k5abm#B9d!gDX_dB8gLUahdAZ2k{!6Ck+xZOO-BwErz3L~&{!FUoWodt4cc$1& zif>~H`Egk|rqtlZ>wTEl18G-uk^Smz;l^9VTLR7XijBzYjLqBI``cE~%Src(PTRTIRA~+@@qqNl^37hFIsX(uCy3*TC-eRBWO5^Y&Gij^IL4*bg(U~* zLW%<*@jzo%gV(U>CaBN1T^r{4lTxO3$@hBFGuzd>i^dxvC$rwGvCC}da3S(`{fY@e zNX`2=X?8&3PfIQr-uyd~_k4HRa&}F2i6QeW?h(BT#{8hCli3q}@eh#kQNu1SO(&pa zY`p#bXo0j75*W|Pn$6oyl-J{Psy;~?2%KLEWvxf0B-lcro8!wAmZa5P$j5Tg`F>-S z9N9<<{(6T74xOpmP1N_cKZBF?Y&$pxp^THW$7VOI_yG-O1qiI zYpunzq8@4E} z7phukKom}z^+>`93OLmb)yK2WDBcDAd*eMC&4-=?9eQ?H{0GkqG&KGO~S2K{#8OVmOxeVytpgecr;(*G)A4Y_hU-h^YVkc(FJD zZ?v@34|DKPcw2su_M*)ZlXTYFNdujrBSifFAIa#&n!8CMMPMgTQwrb+^@9?LspH*P z;~G}8oPDM&l>Zyjsp%*ZYZs!aXR}Rf*82&Rx0i2JYnocki^%)aed)$F3wXf=3H??P z@zX%@A5CO(#61N0Uf^zExQORX{+j2_%SFfQT@cI0txd;^rte@yq7>qHW<(%~upnsc zg7R?sG95eOTn4Ck_*lo;FK!?DYS9@Z)ks5q~`*^=ptHW%oZfOZ+onU z(e#ekltn4<$jk5e74?2=h02qee2ewJ5L@@+1&r5(maW+1f?6f1z1n`g47OemKapVe z9&F={3xot20NJLc&q14ret||RnG!@&VL*l91R_8WEgOq) zqD;XP*u5yvbd!g!USVd<{@Xa^FncBpEV2~cBVhB5?3GN>iz*}iH zA0mW^X&in>Qc$lY6MNYs9<7I)4#WPgr_{xeoZ%Vo;{s@bxK!yrW!-AjRG+qMX5`9Q zCaIh1y3kaz1JuzE%}ES&GLb*s$YQuDdT}9|&MnzT+bO4NY6D*8AFu#JthS`v%_M`S7tIfFu!5-*Qax{>4Kkhhfd-%Y&s5WQEnulN~l2Uh*wE>y`bB zw=U50%nkx=!%-AwW5xkd3K;ze6-j99%AFlXCN{_TW$H}{jL?%BbwTAhnvXw*w%thY z$mS_AH`#Aa#o-yzw-8@o6<4ptUm8!E%q*v~ndk_+ zF-zTQ1*TYO6b&n6h~OqDr;Fe|Apflnh?2e77`&==5-s&>AE$R<;*{=JP8Z6>d3qZyIP zO*OuuZj`u3Ys~rYt9pO`hM#rBjwTK#=iV>KC_KeO4C*Vtt^3xG2pSAjb(h0!!N1M= ziAQDLiH37QW_`^PZToN5w{zJ?HAcC$gR2nCj1>DxPn*?$6Y9G(VR)79`z zv6CIpI7Xy}{D(Bw3f5>Em5S&KB%EkV&HlYxJjBY8sA-*)DXHlHq9N)gc-*|YPv^|C z>&T11#!84HP{x@cn5%8g^b6A1o z9-<)Pd)xEw4q@q%C^RD45xi zoF9$42;F!I9(PLy-PNrHe&|zqNpZe{U@@V^*dq3Y?Jw$MJ+KjgtL$3%XU~7E^C}`7 zE4_EOTNglHK-G>pL7X}z6`u7IgR0Ndt@4p%wLMN)tnmvs#xopOc33uHi6^}yrRRqN zBN(6CY`)Z{ERK`dWXs*lyoIh4?KiWP*glduK|b{l@Ir5}GMN?(I~mE>N; z-m_``9e4VXmRWqM0%WUTy4E*A&% z>Z`vRJ7x?MtB(#HF8+AJ}%M~)U zbbB`l=X7UU)6wT^_KF5*pI|>#>L@%y3z5!c{d@~;F!d}f&XIebYYw?6UeujA87%?Z zi^~UJK1d@oK|DoNg=-_VKAB~K``g}XsUNh?a$Re|*QF2fOPW#R;`HAx{fufM@sky$ zFj+2-16(*7UF>rk(g<2NA|jHjZyqc}5{Q3arpL?VHC&bm?A-*X{Bq|rjSF&mWk`y% zckf%(INWZNm;>by@G0Yp3m~EEQx{qqF9=fhQYvRm-%Vl5`+`WOoN-$MF>+EQWM~e| z8F}>b)jlPihB|bdH`KOmf25=b;pz{I6!a8TBJkb@ z4@b@+AW4g!8QxMVOgr(X+Y4Wt@qOqU#Y!RUu{B7{DNDK7_@TEf6eb8_({_|ws@ApG z0fgGVa4a_c5(m&ylYR$-6LhmVrJQXBy7Thh5bvzqdXBg#wy{mPX7ty7Wctq&c^Gg;jG zoJS-lnx0d*mgaadDUv%ZXkJ+>3j8s$;_Ddwz@ku#HG7=Qg5=&;nFSleIixt(M;j4w zC4{#sk~;gJ;tLeUInT{VZt>l2TnGD<*sGFiO7?PvbA3wMR`G<4HX8e%+OrLvvn6(@ zoqy+_Ic>7VH6~GljqV)jkEpzSE-qS7fRachrsTf&VOVa|@6KfGF|Va!8V#jvYBdNn zH|E&I;s7?^lBZW@5EM4m!U&u&p7a1b+%j)4Orpg=f@1-+_&GZOx`tu@%4a@|Fvsh! z{pp-1VHzJnUb;)588$0vSLN{F_ zDBD#|FF^3~fw?$<+_%IncoQ}lt9kKd$L6PtW5G#Kq}?@C394_JK~3aP9!kW6ObGuL zNFX+jTsY$;%voAD;-IGfG6?a^DP^kOHL}Q)IfJlX8syY^tk@mmti^vaOxdyiVa!|o z06~4tzoNWXl1qg63VPQ+Pis_=kKAIBW71OTsYz~*HGQvg;MGJcI}8gl?~xq(7sdA* zBLm}{qk_Me+*&SIHRG&Fh+JSuMMsex#Z(~4G- z)EeeQMk@K)IdO8XQ@DrJqrC2>mw_KOA!T?JBJYX zT=|>|y~isaZK8K>hw30Z5@St=U3(bLw?IBww(TF9DR z_cjM%hWkwXY52&%a~+xPDE3!kWdUH`oa` zH`tkCx{VU*bZyIQm%L&JL%hhI*H8^nad5xV2(N!9w1h&y?!aY=^~p|;ENUrIMEwIc z?hj3r-ZSrT{_ltAjnY|-w5)&AMWIylYhl8x4Fq?6$&OK@Im~n;M`yTl9juiy%S-7) zzq=u{%%r&~k{)-dRn*mKhVkc3)h!`eh)yP9Qe$&;7>Vnc!N%z3B2Ok^o|*mxQL)6i zIP8i;^-UK_5j5OLzPxQLJs@)`;Xe^Wh@F6X7@@Csq|iJx5UJTh?-X+tY~MkEE$p{g zF=DRWr5A(!FI3!g^~EuEB}>g*&l|-d#5!L5_wciqQ<+`41ZBsG!E|G$CqaOFp>03scx%}ZY zj!tstB~Jt)m}C{Je~UlpqfPq3rBnJ*eacT_LI0cIrUE|fdjRHF^uQ(D@OGPF*~P}P zzx7}K1BP8GR?GV7p8Q7y)K_;eV^o{hQ8w>v{eC*b7w$G$3G-O91bzas2Z~&`9Q)`@H65mRE$Ad-RlH&34_wbP?=V?f3d`GL{Zs$!M{8yM)Rm|lM&K6#z zfoTxP+y8^SUFYrrgT%VzL7CfEa4>m?B-c|AP8jPBNgs~-L@q>Dk|99=LlJXWntv42 zrs~XByDW)%<5UNn$}{y9P#@}iUbDRN7Ua!s_^>X+)*SFdO+ogj%(|laeQ?@mkBUEO zO)5xPTZGetU?mvyR;dI-61XYFV?!v#co728T$ZPN#;(b`Qn`5j<0-ytH2`?G`G;3I z1MupGm9<1oiw-m4=7dDp?~B_%t9%Wrf0-8eeGTaapv?!552%{Y<}q*ke+HbN4evfi z4kDN7(zFQ=xus<}7^iiOw1XZk)(59{?KT_Ay;Ifh6_>iP=}jgW0SzMBh>2x^0{19YR~7UQZ+3<0rfXsTUzO9s~m#I zr_$s)R%}SoO3r>G=+ymWNX%%kQpA}j3j{{0@`=!05%j??xtrXS-p2h$0GES|hsU3I zyhppC<^L3n8TX1U8Q+v=2>M8M{TU+j&vpjaRVA2l)9@RZ7VUDt0A%_D1K&xqZ7Tfy z_P4ApV&S%M*i4^?g>Te8QqDv48b4{;Bm%&#GOc@;7`}v=8}gZCU3j3TD99ANIBbhp z_08BdsAHG*yMJaX!0HAUJDpOw&s-gC^kaIyx$TPd$8?BXd?9j?4Vffk9-=F5YY+ZU zF0v?b2Ohw*_*e!3Mq3LtfSq{!zY=FzTMuVH%3W`Xz+~AWI~eYb6~>U;cwwbDr{NM? zl_Y;Z|7(4<_N&rYne=vTr*~AVLgEX%3)HmN!+bX)nWuEJo1?Y3fxKzxqcjGq%n3#za>IqMlYH0l*mbfNCma@ESt*_^FlLd zF;$$I@OH~gfD6VYL+SZmayhK-OPg2lYeb+7S)!)y8Z2dd7Sl-psX zqqYcurL$c=c971xI2up%`huX%wgtF5pZmjf(-f6?~>ITC&ZT`r#m^(|@?CSYn2ZWH_pvKz2yw*CZ_{KO=9Qoo8qZi;^EyMvK~nbG0$k@JX<`B#EZNKK#Bn$+#E$fz zgB7gUHFo#gdhoVVFMQm(gQ8Ys2RC@*q+aRRz}TL%K_AR#X&u200m(B2UdGxqVNh2_ zpnEl*S;K^|j!`^~T?$~9VI)iN)rlTsmNJ6g(r|=hTQ9)`UFr^nSzlJ{0&t>;LSjNx zgV8Lj`6RR=8 zA=@A>N7?i7u(E7<-d+17?vyb!8!Qh-yR5&XeRiX9irss-c0>aN+f9RqWC*+9Qy_UO zo>kO>5^3@d^Q`gt+sm`py0D<|JNWfL|NZd`@u0rjX5>p$$QdSC-=K)^NpP4a_8xYPR$QTOhFKS5^~=GI?Qz2 z7qU+ss@(<5ew@kV0azwPL0Dl6=`N!~imAc^QITOp+eXFL{zwJ0 z2TBLGpJXubT}ay;H0`l6 zs7qL;Tj{QHuhrk)E2d5v?A)eKK14-jio9R;?hwp8X-)k0z8l0`DfExTw5F>2?Fh); z(OGjrc~%&7)LnD#i&v>1pW&eP2~?@1Th;$v!i)bWFojdX7j0_hkX-#t;;Ni6#*!aB4YfQU1;3 zz}R37)5E!f-N;$mgi#>3|D=Ke{=jVplSpFF#F^WKa)PnOf%(NLdvrp>*f(93U~t0x zqUAtN9?|MfLgmY#z$sd1Oq{;4SuL~x!ivcO4M*>UBXinrDYelZijQYPu(S_B?lzM?A=G__&ATuyX2tMW6;)1Rxz9Ptbq`s`ZRt|kT;@hf~7vr z4iVw;(6swX5?WOp<&kTU$Vi6nmr}6ZO3TU2AkcV>q?JBVaB5YfGoj=DZ?glE1AbDm zMAGl;ZA0rG1o^>&)?s7~V+sN21iM+E`-r%l$g^gcjY<8x{YV#bDMxGzS#^+7`<9e**f}K)1jEHLSkcA||jrKz|B| zS3v=g#sBC)q!6zEVAL!!;d3$JnYY7^x)KY#vLwg(Nhga>=WNk5jOO;|^G@&|?Y8r_ z73zrYOr!4JrZ4^6U5yz!<2Yy|R>he#u7KoW+|>j&h4B4~mosPNpPsga1c@O{jO@&d z8Z?2;AL1@J>=Kd<4QB`0*x20D)i8Ga)mn7hY_^$V*sMQ0FS>3t zk@#lNCP7YJyi!S%yn-fgeQuV_lgt*7#hxfWwe56Z@qx9=lUAuCvV%9@Rw22<{u&Aowr}AR?cNpZfGi*6cx5~w^3R1- zhG_KmnNW2^6%ujc1B{~WBp`k}GDk$uzxxcHI~n!2k0etg;ESaf)YjXr44PWu)YbIO=uX@0Pm2Q;S>l!4uNjTFySLT42nZx!_JCQo}!7WP|qU=L?__@1xLuw~tSH|r7 z%ZQy{nW+cIg%_XJb9_Q3y>!)M=D~Q>xg>I5f~@PMGgfTW;=GJBo!aY4ogij7w%nqWRS9YhidVf#j>~i6$1A zK|ziL*Gwqca*)&5+tkMQecHx%AuKhQT7K|gagE4|ogp=M_rey^7?3P9tdSP>M?8l_ z>fldeZhUZT!cF*7mZQgHVoQ)Qe=kpvGB#HPr%|hlyxe&{G@U7#gt1GjJbk5PoC6Cw zFH2;9v=6Pl`==W#JNd}s5F8W4kStDjHskhA1^Jl=X?_&VSuk;5SEF3o~FVn>9WuRQ!x zP!JeB$YLG-YgfORJySu`9oLVt9a58a|rpr&4b0p8&b?K zfU*lmw97onVW(p14yR(L`Yt9GvL)jZ<2?qtrcr7cv8O*v+F6c_S~7ob7!REKjPTx* z;Z+J$*1guhrR~cENu5uTba>Y5?MAA_7#Jl9mJGrD&SDP~h75?F4wp%w=>yIr2>arU zASj(iIdW0t+_GyCbUt7n z*IdOWH)~Ir+jlR6e;(!KOYVe9%)^TDN7&|wctC*DP)@e%XHNTMzI|4v`G#@DG^7kI z;Lad1G&dMK>>JSK?GS(R!Ib}{iF+ndY{K>``9i~yhn*9ik6q`w=C)@_hC437D={cV zF?^X{!&G4IuNJ%2;&!iSJVq%=&`W84Ub8XMuj9#aFcp9?N(EEu#9i7Po6nKS)iO%1 zXc{OHEDR~u{ZRoQC#XiKeDrBe+qNo+mLxfshA*jTYn15>@%s;Q51nqyj8ci^!s4H- zn6m@^jwJPT1+|zHCAvK8Hg_FfaT(6sh-*}LEWT7yDxo+sE-xN=;f_j!-5K;M1JxZv=^T{Uvl`0k1N zUj*ma=tIXz6i|lJgHxV4KCgE4tbO&ZrQtZY z3?5mmP5XK7M7!2*$L~w#H+`&!u|A)8k8~n^zXrOeVb@y@VK=q#`Zcfjpqy?}m`BJ@ zU$J-j+K@k|oU1KIWGUj-K0H>oC%K_z*?ePtdpDOB_3~oib#eiS_u@ac(Xn7loG+?w zO_(=kw#>(_U)5YDT=onEkn&s_NT6dz@>2S3@2Nt%hl%TKP~Fa3OjC@+z-n->D}_@aQMGImN4ND)YQg!{g?sXL{|1 zIR_}87}<{mSpUkUVXuD7Ww*YP`K<-k=&X-Ar|_ddm((V?KBkjrG(qt*Jy0|aMNlD? zhc&<5V`3-QvQDE%RGRN*uEQ&v>&0p*`s`R#&aP;zEu`ScHrH#@x6T1X2~zF(7H|83 zi#OzF`;%O;lwLWJ(w_aCCuKK%O^s2Y*B(PdI=S$OTMf#}a!-ZxTDvfOgQGgtY}u$? zH$^Uu)enoq!efXlgv+VdhKJr)Hdm#mra2R1_EMA|k0;=kO6e&gBw}t%&f2g`=uwYo z>rvCN@K1Nuv177uB(=9{48OUK zU#Fu&86=V>?CU>%F4!FP=#^T(aRZOv_Fq$A6;hiQ!U~xaw10*Ryj~FyL zWZ@>vmwHgK_n~p$;ub(gUyCf^ElIP+XEmlO+s5n7pL^HH#9~7UVLBOQXdNf640g(> z@}$4~F2q~M#=nYqyd7O>?!|33^ESP)8D3coem%_mT&Mh@g*GykHj&ceSDQVgm^?-f)fMTTz^~Z=mo*0Ud7vbWyI2~HDof@*GrA(y(dhM#zuzn{$S_rct z3m4jWFtIa3yx@3m${@Gs<_l>ZH)0`6SZ@`6VSE)`^BfM#B}rL@Usyuv*c>msMy(x+ zn>RJ>JPBc8T19UaQ9fMdn7yW_Qg&OFXS|xpfGP_8PVNUzw_&S?0_Fo#mLLN*>5$8# z6FkC1W2CRZ&MObxa#^Zh7HS^ni(*1dLH^xpj3`=ciDG$6C7MZsKGO^Yd7R z*&#$a^T$sfNW{1YpJ=}C$mvaP>wUJ(*V0@$H$7x_G~kJ+->*gc`^EtmkoZe{uzp_q z?AFc>KM_}r?6}(V$#-nr-}mtiU03n&_@k~QUuJ^uWYyvD^6Eu=iakDFa_((c_~Zk4 zWwPFqxw6~~UJLirMz_>#^{!Z%-YxKq-c2bqrx(XVTgO^e$137Nr$pf&!(K=kK=*%`aIQXJi<);#g`CL4_^d{dBEUkYS%cL&!N7Af(m0oJk}j zEp`0m+;rrV)1lg8)m^2gH9PLC*lhKz4>wCoxn7BFq}E}T0x^NG+Ud^`0R_fCLVkf~ zty3Rdup$IqvbN+~y?Vw+8~_X(jbuB9)wXMgr}|}WsKC$o1))o^28Qp+J^`bn{;i{r zrK8V0N%f&Rzv62>@6`5UtFU6vHcD3g6Du@myh7ICsW2Tg7QyLXzzJW@_H(~}_Q1y@ zSUR$=exWD-g{sVN?%jzBq&Ch;qc#TlQ?tzfZd6jD%B27#=^W+glygii`^?yPPW=FU ziepn9jAg5KAGW#6Xms#EAWmFd{PwtvYLO5j|1tDjKY!KObP<2f&Qifr&t9k9>@u8( zpV8j#NWMH>f8P*k(6RxRxkB7QH~iB#W|}~jX(X?x>s781dE;;$A0hVj#ybpS!RC*j zquKP9?P-i)#NIw>ZsE;4FC916p~#r5d$ZhsSO}q%>S`s$`iBpqqBL3z2p=NzC!We7 z%s~dpLO<;P?1g=W;v{UV_vC+N<}}63i8RBkbN}mdmvO{_bW}A&N-*!&^hd2yvACIa zE$ta->MIh=pC~f5&ox-zIuYfWn@iypf8O0)*^o0;@Bw(cw8PBaPu$9#$QL~PYiz4r zD<4KBlOcJyN_RxpdU~kzA-^jnULHZ$3$qFtxCBQP`ebif_g<}6!?&rDP{!y*Mteh@_u~%j{)}JMdK?i{wB)XA>ej zEI&Z|zDM)3fq)bPBp>{OpsdF>1>*ci!!X$EB5{XXpHFTuV!cTX&^{6)IPM#!16EzV zRq8Ory3KKvl|-=ock!cms&qj+6@b@ycc?#ww*zUWcv~UQTC^A9MhG;= zt_YCGUlWBGbIx_Q?I6nK_2aUrR)aSE^doy?!y_qq^G8l3wLzWRxSfIgUPhKf$e@8X z)z-8tpZ}a8yp_DrXjc0RGpAIKB&B>$-z66}AI62{wAogJPlIG{)BD2CmIup)XkXlm z7Yy}<*ON~iwm%{ZPMvCJw87UAsp)3JeOAU;8P*>rdgG)E^HLvmMSMVj7CBN$zERR$ z0z4t)?1mLEAMQIVqy3kvZ~gd*d{pt#E+NWB3 zckYzmt>p84ZagrG**S=Oj~6pE%x`jbeCaYduWp}yL#~jwiiw}(0Bu#wjbG=o5wOn- z$8}BQ8^~gh1V?AUQP`m1sJ@DbhJ^rkru6_#3`fY7ps_XuR@FOfNRvC~F2Bukdt!D>5DB)=5V<5s1S7E-2Ab@|&p>Xy zM5%)$n}j<|461e)_(EkPZgfv}?0PR+swD{E$yHz$`W)5%a#+`!o`l}2)mxR`?HJ9F-UK;6G0GdDc_?qNbjQV(^~0Le zgIXPMXcM9qL zzeC72a4vSX|Hp0M5smQbACB?36=czfr`h5;C6XLntGd{9Bk?X8NS(!}`T1Z2~8B*WJ@iZY&dCwC>)?QCevA zsc8WG^%e3p z1E#)m zolQ-jAN0>f`Lu!&XYtTrfBIlYVlBLcH~au(L9gPWh&{e)Avw#+!1XA?z+GQmZNay? zU-t+RL0u$Ro9$ij zKT&<$)&*R;NK|Lz9E|yLb*5vbYW$9Z-75!lVGj9=sdu_&S{$AuOi}I zJ}i--)YiTOebbW&50TN1&*4?Sf|L5&kuIagpnaiGZmzCELT{kS&qaeP%P9|CY$Zf^ zhV1&Wwp%wg@k zd!XJWI{^}>?*k9%58lr(nb&KWBqGrl4+kQ&VJ}NHe!aTjH@5fEW->Q;Y7;AsicXZb zC^Amyljd<^!ee-=(W@)s4kA>;Q z=I&hv)j6Q$@m1bSq*5>VWof~8!v^ZqOEH4ntFjcY594_6x$`?0+@mMr?hg#+_h!kW zLiSmJVIiv2BLABZz1L_aSdSI(87&9(!T-%u#aj>z0=?(9ZqVx-yvX$4c#^!UiJd3y zcYdYsw%l^=Y?K$(hC{l)gnEHK*8xTO`#^&qewia)z5ep`A=ASrvb%t3V_`uu$9#YS zpBDyy#>%_Yxdq_t!1_AA`}JKoZF)uHV;SFI;vo83zWaG{ATGT^KlzXiiCmH_t-Qkq zcuE|S&ijf+_mW=fT|6RwK=6Iz>?qv2Mr=FSdX_2pO;RPY>0$avsse>%{{p*Cd;R!N z1BMNS5(^gDd^K@>g}$(GeTOuUU|9I`o99>f_tI|-dL$$d%5(aojvK>XJDuxNNPPf9 z)IX^{E5e@Vw^wc_{fK;@NHfM&i)H5(cN8!(y!oQID;Z$QI3pjLCliGx_NEb9LpmxL zsxyZtI93r(dFBkIxC;;KbrILKsZW$G8=y=FhhGNtE=K3bj%>}{&`cU(Y}Q~SdeZ); zstC+}LtSm}LvjrJ!UA&F0R4*oh?+@Z%6-?c9%jC|t`6D{@xn19(d6&{ZhrGKB^DXC zTOw#&)_z-_*U4E}Hde%WFe_sW9*I8~0K)yzKoM=rch>nhuhLZ;7aA}U9*glBzB|*G z3-y%l=oHEVZDNxcS~%7&mjmDFoTFU?H(9n7EcYxH*I#0SFh$Tvr0GTCxXF#t+oX|G zvOlA5vu3XqsNS57Y-6=?nZAeVk3|eWHl-0g>t%f0dd3z{+-T|M4}SI@@ChnH#X!wM z(D({H5{S~+Vq&s}`iUOxJdQ2QEKv&T-3kTecruNXcjKffCyjWN_HUXa$a%S=g*0m` zjaOt_X{ja_dHnhI7wbr31|2+&gC0A-6;VP@Oj4{c@u=vstdLxgo-gjjYFx+1I8zUN zoBIm#dPK(*b5Y-@)CoR{IL#meL&D(tm==q0NAE^jQtAz*ub3Jhbw|FTeBy#E%OZ!^ z;*}Yg+^BY+0W|ut?mQUjW1jJT}F_Sb-En?|$gyrdxh05Gz0uIM5@${LtUDZ+d z$KlGh>AUr3My+`KguPCP=sTutsq(^p<=T-hA?sV1?sUsBQe!AIhX$EuLtm2#7GKhoGDITv^C@RN zQpD6ol{%FvE9hOmuxzc!uqrb|=68x=LgY8KCaDHVlevp48M({STS5_OZ8uUw|} zhq|Q%((CG-!$Qr;{aZDwR%us>r55mA34vb4kL>EMGbBVQoJCI~+30Vq72{qJT((?H zX9AT|z`xZjfQ+-`zxmR9H=LHgoUmeARQwtvn@?LaKjOE!H(7uSc zzmiGNh*b{|Z?7k;D}w1eV)0r73#+owRTk%sK=xi~Tei-W&nt+#wncp7sI4P)_^ zPklIUVE#ZSg!i$ZMgwbpsG8I&bHXW8 zOYzC~(NIu(ugTJ^h05BsV=S{@uNMSl#*XUYvGKP*&PFLi*W=q`^42)LBH2pi`gVMu zZ+8FtnRIXB9#yyhLqW&uCgCalbOfD+aq*V#1naR){NY3GF<0C)A)ENeoUk6IU1=K$ zn^sW#SHf=RUkXuT1x~Te)Z}--d#(k-FhM-lX@5nnZaODDczKK-cq|^1?3(6^qIY)w zj6^pD(Le7dnVL?cTVb#02AE0e@YNevKzu`o$FCJqp_}I{t7WueJC`ToOT1~M%E;MsK))4DB{m*XC_{8O(w^YrN zyQ+oAn0M8K?v8in%K^92)Z~6sl$Ia!!UqX&L}Sv}eaoN~F@lv{kWH=^G8EjHqv)Qf zR?Y(2V7dXob?>zBj|0n%I3Q>}^%SV*j2t^Y_cHjxEGQQ-BYC%Y`v$GB)5g5`0viM>m2tq0QXFaN<&o}L^jpm31re6Xv?<`b9ri``Eo^PXPb#-XHrfepa4_b>B9I=8|9&Fz$BuNU!{%RU6>RLzzR>#<$ z8!XgjYsHgEahq^+KNt|(!z)5JyOGx5H|f+o=EB&=Pvl~_n%#N;>mkpq(vun&hgCpd z98z@Qp6ZxG=%)m(0S%ht2`Yv~KLw#&1kCG47r&WVHwIA#OLR&R9h*FoXWvpoab?{C z7U_39{JP!DwBR?34K=B4p0N$ZBY5M~ENae>obY*;DHzvD-0H3Bw7AmMns=#w!ZpBP zI=}H6Z6p5>P7};qq|e_%ZgofEOrY$@luH1pQdzC|*VO7`rI-Beh z$l+y8k;O^pIh-3N0z4jPIXLTTqmQaprw)0UYo$aJl^b>&7}+$qZ#dYa*DaH(OpV{9 z{z05tNrc{k%>oyCfVNoTo^qTWSj@hQRfAyUgLq){RDr6iMoJ&Vit|+ypoHzmfvI`#m_@G|DvIN^IuOe4`j+c!TBx=T6OorV%E?CrsH(z}~9i zVHo&ZErCH#1-HM8FQn;znx7Y*5yxsxVbrA6B*4=R4AYDQD@abvazy}8JQ>ScRYZlC zE+WhZ;(F1yKTGXv6MK+P>Kbj92#RZmG~r1GryHeI`nK%P6I2@y9-q>pH*m0bEOv1t z**sZNXf{iimjG>|E)N4kn;I20IUF(aEb18iQ6ISzA8I8jQ9?NqGg3ZWF337;^n7MQ zw|mFZBa-QjM+9AsN?5VFUNXSS7uOx&%};NAW7~)Az$~aSNg9VW>CxH~kVJ?6X@y*C zKAo2dCb1NGK_b;E0tzCTMdL;v$9Kl_(OaJxPDfF^K^@vxecHvSfP8Q{QThSNzgr~2 z1V2uCSE9+n$r1eif9LO-77xF!i*coksiwcOd0gYMZbuX zJnf;VKi0|rW}Fv@{#3QCyIGyAFuvvR_W*eSOj~qu$$RyY+G*h_D4mfxSIhQwZbg=5 z8U>H-K~HYRgYs+MMAF~-76Iw-UQ`)R^S(T4i-D>o&Av3Qsq8eSEl@r%k}=pRpNgX^ zp5|oR?IX`9(VsN$2VP^xvtnV9=Y5c>Wy&30mXao(o(M{-ZJv|kU)M)( zOr1UFDD7U&dp~STknu72p^Ba8vCZfY4O3MQimbA`cyrq9%o|jhI(%i@U&~_Mv@dk$xE2`G&7Y$`T8FJGTfW=AuA76|tU3m+>i_F4sb8@#`aR19nS)5j?E64K z^sq-rx~;gKGA+gR*ys})aELzGAX_A=nFw<)qTX3%_G6|q^*l!o9z(!*qr-LVFSP`W zmrwj~;4B7P!X0v>U3HY!`sd457WM76nAhk2UK3BSwvsmWhVBo76fTkS%2SrXAqj>I z)s9qTlH$vsA*z+m*Q!Lhy8sb_sVYvqxi$%t%9quxvKGpHAGB;<6{!B02cz!>okgqZ z+GbS!zkZW+Urg=%K(~Cfyg3tV*Wy=ty-SH9UacA~Q468Y;e_E8%dse^A~mg*sS@W* z`6D^3I&yl4s@7K9>hMFriDe}M(yyhId%8hYr5Fa9wGTJfRcTIG%=OqW3FBszYz4CBd<6U$ zl~|Z<@9>GNTglircq`k){UV!@5j-Q$$dZ$5KEMy&#gQB;D5l}5onB|TxZFx!k!DL) z5nr+!25t*zC13Ak94!4>i)f4^E|4Mkke)M>sQgIr(rNLnaWdI<5z# ziDJalqkVu%g_W1izBZX4;}pM%gA^Y%xJ6P8#rB2;Kq#!XAfkEc?(cxA7H;+iWkITl zOw@sqqt)rz(aJpx>m`-EQ_1o3=bwrn)$r-Zh`_ruAS_oA`IWl8+;yHy#(9F$)fXJC@1H{;uWqYHqWYe0qo{f=@T|RNFuOxz;_hH zW*3z(c%)$}*IB*RFe3|+Oa!b536k-I5c$EE)MtDPkN^16;@3d;R847ds4wEB^~fgmnVQudBT(FMM0JQsu8$W-`TeR?joV zQU1Xnhi082fX*e1JW{BiJNJhXLJtnh(?|5*ecRz>yR^XTwBQY;5be9YKl!xIl%Jw42C5H;UFfEw|~T9Pp#Spa>(=vOIRlOvtcz_YN+qP}nwr$(CZQHi{b*Al1XL`|_{Dow9pCs+u6@Vk0wCQw- zcun%{yo^rE|AsuHRg~tmsmcfm>6GUDufY?x1*kD5a8vU4vK>XVQt+Zp;HM{A3S28v zopCTi;eEjoUntkq{rpz5RZqaO-H1r?bF6lYzp~E*1&63>KBE&1CW0KpHrTUFhDzyvO2@qdr7Uo;%b1UYOgU@!I`e zQfg3;s0-@@A8~6lex!fLA6ONpZ!{*B#DVg5MiFFRB}-Gw;{FrJ#9$l?dLG7JI1kbL z!{R2XD-0gw<3rpyr53Y!dB?Hr(z?+Dys2vBA9GTh-qHumQ{G~JNam>BBjn|a+!iAU=f1yef zog5qpkex)E6_%NE&!)DA&^R2fg3V%LQ>f!>RLsQ=AD8eXs#ovX ztDGh4h=Vol3!2~_8&?7o0ccsKn>2Etex%n-jC4m=KDI>4@A0{1tAOTEyMasJ!=PZN z2E)}2=J!d1pTIsNPFY3&%0~3+41M4Lu1Hrlxbx@p0XC4jWc3vtpGYRR*Q2^pIwDCP z!rzg2FmUpn`L~EBk9SlXs5S}0VNLQ=mG*qcDT9eR=yA1A899V3N$9=PEw#^-7Yxfv zmX-$U0}z`m>i3~2$}UVVEwn~)k|-TTYT)G}8h#A;%#q#+6-_bhm}+qKCCkDnwlHE% z6P#3~N~reV!JbFl|1iQP*zQ7Nk(K)QVL#tEYG;$j=wr4`9zI}Tr#1?Mk1L;*#q<=yy7;Oj?VwE5MIL-j#hbP}vdeb(T9L@Dc1I(3 z!%zSf>N(?Y2}~F`keX8dcE?Te{NG6NQtQP27Noo8fW`Vq5mNOKi}zB8`+`aC;`&;$ zL=0GRvEE3$y1cT&>=Csp-lsP#tgQd4sHQV6NM_Iu6w93A`L*x2T(Z`OnMx|r4*3ex zyONi5WY8wtf`D64c6LqB7cnE#8+^NP)kYdfIt2)`DSN-5PtRtv_&^*>5m)@*GcESQ zua8i&x`{|uUa0URm}oz`?trGZBx$fVwVez2sy^YO6x4Fn243l!*V zoW6%erQ%llanlJs-D@61Yz}%Q!x_fB?z*RNI~7rxS3h~!IS-Paz{cnr%9p3or7POI zbXI_40HlKRb#}H?DM5-R!)ErjgQ9sH(ww>(EjwVIXIQdMU1{?8lv+j;$Sqc#>Gy#) z^IDX_mJ-lPvAbV>Spf1N1P7d+wf+--rS(5#l{|Y_`uLYH{c7hK1J|YT+B#**;PnwL z1y!>J@4#n&0#j-4we};(#gRYq+sseFEV-)Nr9TpoAD=e684Ia_CM&4%x(e)OljNSd zxm2Vfo=!RIUv>t$fsYW9V#m5Une#$sVj6fd6I<-BkSshwCS@YG>n#ZEiYHiCiKQL1z$dO<9ri?k*G>&iTwEIq5qU41*r_Z#As?JG9ilZ{bRbhiXywNp z8FBcxz+5wATWUWNQno5@hkZ-$_t%}T7mw+vay$Cvd~`0s(xgPsQ~)!c ztOK-TXzHnvesXEW{B*B?mM(HUnA+I1o(cg%?he@o6(%j)JJ(Y8l!23P7Z zl^M}sv!?=y>ab2WCPB2TY@ERz!=FAsDSb6m1-jEXE7EctXsAB^o94kaQ)yaLbA~0RiA3G+Q=1;9?|#I~Xd52VSx` zB+dd!xKfB<)`vTVyP-Y99i9ixxJ3!zk(}Wky)k*OF+A#|zGW6UN8H$n&kSWfn$)Vd zyu|PPX6{w!?hhl%Hs!7qbJ0+8l{xe)d8eQ0^lf?q^kq-1FEq*2z^1d~F*6o#f!yV0XE!z_t z7Izs*0V8UCBZhW?F>Et5znSp9ixI%(!{SvZW5lO3q!g`H+lN+M-TU+2>`k0op?Vto z&~LNaYa%=EWKl|@D~M2J;Irz83E%Y1p7gRAyDHaZp4j=631ZpRL`BSD?4r&$>YtOD z6hjosD!KSMwTZYkj+FS`%pBRK+L93IK-BRHnL+CrxVj@Lm(Buy1Eex;EJ^3@3LM3a z$yo66o{%EH=I=7ivemqs(;OY@f_XZZhQ>+$>+Mc|dN6xZOc$m!6l?c|+&iL5iV=I9 z(8n@fT086n5$%ir-n(^)O2Of-8a z)Gh}ImLByCR4%}7hlYIdiaH&Bqw*vN>?hh0{PpxTePqxA?kWDtfaA zv(hVs)XpU!$&2(Use5}pRpEYq8w=Y&X+m7Kh-i9|)%)$cW-9j zj%bap{YnBCtK)@+0-Uiz4NubTftPnWXXD&i!7TTTGQQc4ph6McCftmnI@Pz@cnStZB*e$68(XGqDLYI(WHu>1G4-C74 z(&JwPAlE?>ILmp>_R!T)+o^TA*%7Q26w)(f8V_2f$N?VD7pd?jj(PWxMwA)z$R%es zJBD7I&ztT3NF~A9Ul4MM0(4Qr_r3!a(tcOj`hk@zrm${Pb+M*T&ft#ua4;#C2FJ8? znxSuvz%=He|Avt2K6JZZRt>(issS1$*!#3i;7KX!>MWBQYj5E@D z4%b=jLTH5)K!M4q^G#32ipXg2`=Bu5oNdL3@oUzv*{{>kRJHN@iY^%^0VbL zdDn&5_VNWwPE)nWgb;P)9tv3Gq+FS+r)UsBSF_60o|J6*I<^{eW?g$&7?4|_UOH)M z%S_ZPf**_z>F>dZ04fl?QMjw+^&{J!=Z&c z2b?+d8ImFo!IFGRa?~rIzI+aOoRYc=`B;tC+*knQ47~3v4I{dHzxv>O&Xo~}gZ(up zADIc402E_FVM_t5pvJg8$^wj0WJ!wVhJL9}rfVFhw=O73jh_L}B4^shmY^lqx`dnj zce=T{hd(z$_41T_r+NiRiz72-^srp^+S4L0Ry4<#$r81pb|c6!57fO#v#ScmnGWM9 zm9QFE{u?0ZYPB>nNTRyF?QwMUf}T=Iib*J2EfAZ&oNsPdjrl&qef#uy-X;En=p}*I9V8-2LS>@u-~fXf2G1tpN1B1t8w{-S zPGG92bY|_TldY5*%K4~s6+@YX*FQVx%8OlDf~z+9b3KbbH?e0>Ch*vVvx%s>UlKVc zJ9wxhrcdp>O^DO^1uX~x$J&uL5jxv++1a}n=vPIsV%$2n7SOWp-TDPd7!3Morv>Oz zNAAU$B{x#7EjA4K!cuPARHlW@0}=-ug?~^?8bt03_nj8d`E&0y*Psv!$2vAxa;SRS z+-=t75AbmdVuL^pDAS$3$90RJyaNP`dtO=Wc`vgJGjhHM7u#~I>82y1{CdNa)}K{} z`=}$MT3dvxc(-m{847F31P|FkDAmLYEPO-Zw1Z1ce3zbh3rJwnYjX?P!(WI`tzWM3 z%LD{aXUCqpu!t3eVG!g!au57oWPDDPg6)v>-+3|dDmJ0nLbRF zFY(dZTOSo#&)j^#mkvtR-oB+*Idi9kDN_Ea4}fg!vJ68A_4ksS>hM29Z}e+r6EBzI z9k^wJx=5^$7Zq3EcgExKdSm+6xG52qRHiUevC!4ioijEQg{=m?Cr;?UNWZBPPf@lE z1(wkphSe*hQ^k|~=3-A#Fgi?U!R|tZZN7S@F*;tSA0moxK=+xmoPwYw{qUYE#4-SS>D>uxwd9l!+SGLD03R!`9N8ZaR*ndvf66=dhX4CG^;27uYQ-G&HXb1ps}oC6^XDdQ_27 zS2A~K4-@Xn%c~qmtvZwJoLO)rJ=ehfI1WXcR_Hk9ABBN)bCvbxQDJ^ElucXe+5Yis~Hiizl2J$;iE zg*LKwxVD*4x+Yg3tk6%$)d(+yUuG++o?pb;9KyC4CL|A~NI*S7QlD7zxqQS7cUslw zG=oZnLD~`3tF%y~daJ9xtKuoE?*0lK$(NSy#?tb2#^&iwt9LK{lg2>3cD1?pCIarg zI!yL%V_!LugegYkUX-C&vZB#Hfj~q(=we}z9!jHAOA-N>2YGYrSxVJ#kn5qJ zwoH&%cuvuLJ9mgWXvUH)q0l|(RjjF-rXCy1Y~lsBB{R|<RfQ~I)OoL)Pqfr% zcIq`e*jiWq>lL`YH(bpu_E{A~Zyq?43}aE8`(NwPLHhHLI+?68m1P?dAxnu`Bp(0t z!1u!B(EVd#qe8?8J`XH8S_FPXXo;BPo2K zjb2@H`B)rB;zs~F^kIUrECw_b!((B_KgPOXaKB*rDf5Y~IYB6P65C&qTkq%5rt;zs z@1s=mMLaBKAVINtC<57Be`aE4>r0QS3fhp-*OR+uxP4|Kexk`OW<6ilIM_Tk^2WF= zKZ>Xcv`H}Ka!1AMVVfo+)so2hn|$L*yXto+R(fKTN1@0%AOxJ9P9;2H!6732nKZQ& zK=sANh^19$N=_`$ zemn#RXvg^}ISNe}jMP9$(winoQ9HQ@+Cu&Ahvm`Sw(}f0>pZMTD3Z0gMeRNoy;2)v zD2=G)djBgQPPlyg9*Bbe&F*v@Ex@AM_6Xi%0M;@8&CK!6%4ov4NgHJde8*$4NU}#ok>qB zg7I+@>@;KudF+1O(w7QJX1|TR;?Y#XkfV`w_It4X>3sV!xy#SUL|7TQ*4)%8;IJ*U zJ;SN!oUNM~If*ah@|^WboNoVuQm$I^f5{iOHL1>8yMf00K6H`Cg2~95P%$$l3%+de zB6RRfE8V}l%I(em`cUdcM0j*@REx@;cP(L-t2(B)G!NOpRO)L*k#4B%U2f6(cUZ88 zJYlA+Jc(MF6^I>@5S)(6^UIA<9-{x;l*{>Vb`}kCH?LunN5QLeaIrvvpcn1W_`}2b zV$jzqHSCwfTQAma9w9eGdc)0}BajrJD}%dB6quD7&kSGLHluq4gx$N>NxLC85aqiB zO7C2<$sw-(o0uL?(r<5?1+vbzd7H+s8}9A%g%f^m2^^J*Ylc|LfaySwfz1%JX}^bK z4a~$_Otj&^clNWox?VPcbdsq7NzH5hZ#*|den{FGcdL3nW29f9E2i?&ZgB(}<6Q9H5`xC4 zvjM*A6z&ypFJ;wT+j5-ZZtr9&^4y2$y<;oYKFbQh5nB4Kb5yUsy$s8Zt$9%7`C&7p za@C@DweYGz7IoE|37QlCHYQ{PG>7DdTV4d6wS(6V3Hn_izn7FrASWybK?67b&03PE zs9q5!9@(e2`=+>^Js(=m&&x6j=s#havl!QGD&o+j(`uul-8vtr+DI0SC9`9 za$!!)jY?8{U18Z95~HTcf_i8ZH2dBBPrr%`ctQlRi?{66sNbwdVU;oU6?-Y^2D8OE zJDYfe{eaBQ%hP}EvY`IGbh5PjM*$&R?$LzcOo?Z{_ws(@NN^afC*-ZoM(RPPZ z&he;QBy$IICYC^*+6lpwC~nIt9v_mG=}Rg?9?wqJsd?9Du85wh1$n`>1tVUO27T_Z zoLW@|Qhp;@b@Oq8GImaTd1HNA7s*<2++eNVIs9gEW#pQNlq^Ap|ln= zze{$XS#iIX?>?B<-KD0$F!spXwoL+KNg@!9n2LA4yLNs&{-5AA z1H=EJt^aTEnt|j0_x^TFE2uoSCMr#2SJzU&{_X9pY@iizjFi#94of?@8w9*|P?wPX z8UTU&yqKfe>2Ahf)oxYoC9l;M=a+Rwsb^8;0I}(-+}jvHsj2Tu(65Jjgd?5;I_5CI!bj@PAV-pfxrCtF139 zuCJ;p02dY2ULPz@_6J}hsV%;fKOz(V?f~w2pfJh7{`mz=V>3`+W3|0J;o*^tabbVI@6Z}18J!l5t zjgBsk_RUPdtiPJAe`q!#{|JKlUs}VV9$2)$9}ld5OvcUsLaxVuv~BYHmUgpjn*!qohb*pT9DA}*>1@}jZ;ibs|KNb5d+sJPIW z%;JgGLpDH-zqo`__Y8FLG$wbo2M1>VnZvmXeERT7#52ubzpU_R{3frA?hfqiUez^$ zj_+xzi`O;HEv1E5h+QNiJ10i1&Xc&2MKeE+MxxPbUB z`X=)2>5EG%3L@%1WC6{G8wYy-3_3nBJOl&r&(R6s)%{ccW)n0t0!|N_?gvoHCmF}R zxI3>i%pcKvZ+V=>hx5n1vN~!2{4WIjbz*eCp>YED(wgg=`9n?kd8C-%|D{QkEqwz;zU8khRo z_W4)D(g3{S`78CeSy#KiwyWmoo&)gp$KnJ2ZKa*!e~Pcx^|vw^Afs!>KfSy7$`=RW zm;mMhFry-%&s5c?c|zB*dI#79x&f?$qs`xk2IU_Slk(!{T&HAW`qas+t^4&52ldX$ z{3k(#m5(GEyDJ4>1?UPt09q76XTy2ii^?)iP84*=cN1N^=MdY_pK*FQLb zapA_(@c}@s*eBu#569&%@@h8>sGsl!cX$F+Z~g=R@BpAL{VQ6hF#Q|kdp2PB3pWm? z5BLk*o2dQ`>b){x;YTwN7C!AR{0qT6~qQyzYIOCFS#Wt%N>VL)hpw-gT;b^N zL5k{yT zl{J*Z@Dg>Amm=uE#*CP6kIl8E*CMu{P-eJ9 zEa9%773VE9Ns#3*CG`uv_)FmDEAQM%nOwW(8OCjeA+Og3yi3N=IN(!fF7qL3yy zmhG>5#U%YjNK_oVf@n(;6?pHougA=?DQ@*2SaKuVOUAhaQo}~V)eO$|bz;E>01Go< zj*Wq4T)C*-UC+Lw#%R~k#v%|?p}m;_&F8>@%T0O;)54c=+u4iVv0l`>RmBI|rF2tC zVYP{|B7cLPZkc=O1u1FNB0)@3-72^8;&u?cgK zL08~IU3|URc~?cNA>{dYWSOlkZlOez?TrN zdsJXBW13${@8`g8Qi5$nKda8MDj|}2QivQ^rorWHHqNVTGHHs&*h=lqWuN5#YRJ6{ z&#Z)9ICes~Sy3k}4~vi*1Wi<1pg_aTI}053#EU4|k~sW(JvPmWp?Uy^J1(_@2K+9t z{Re_9vElf5Y{B43kfa)JJlC89fjlNWB%whMJ2*i%ct0DMdZTD<6DoEg{-`CNfPr~hk2()Z17^;yC*!R@$WJxpvlvd zu7S@A12K{~I}S!pt6q%tEc*AjqbDN&`Hg)gkp23m-YVv%owb#g5v$e0{c3U#rc5`s z2^kSGk#pX1#60VdIUs?`eX)0kea^aE=!e6GB$;^EASZoJq#gcc&D>7QOz;X<5w_0d z3|z2dBZVkJnKG<(V=QtV2E|MF5ZXm*5*cvfHCf>>n*!z)MAIWQe?jW5R<#Elv%Z`ux} zIi4AfCvGkk!NP;rf^*j`2n{dOh{zX{hqTEl6*t{}u05GF6lcFDAWLZiL_RhEwP>$) z?aD4vhm*4}#_dd!azzZ!r5Sb(dac3CiN=|EjSGvXrR5^P$EeD;@yhi8Zv?~U7$I=Q z*If8D6+%|)ZVY%^Ok=0)zXuqZ;ATE=S8_KIzO~9`qAnPV<)Py>^MasV@Q`8b6HXgK z1&9TxI2Ov%QB*QIFPDQiTM3r)@<`|U3snmPyaTE9kY}M{fiq2TpkG~hBxOR2<_&iK zyewniAP|a4@PvxL1UYM|?&N~$X*^S5#ieZ3$OK9)vYC|eV3GEpzd7RUhDI4~ODXnD zK9Waxbt#5PLfDk!PCUq3Tt$SY-a26uFoB!VrDbVw@&pd=rRiZ)B4%0RjNwIK8rZk^ z;Eu<;h*u|dm-LgNqJ}6guTwP8O=i>u^FDK4)-+Y4ca)arZ$I!S2s1k>*Jf`FAaK7w zG0m>Vi!s5;kzwBFJc%vMIu7+HI0s(`|IX!zpOg#~x?==_iWR2BD0I1M?|aG>2uwkr zy?{!J_!CT)dSV11v~DKN?zSMM7Y2JRNTED zjvQ5Co*V?{x!szYQq|Y1=v6L<4%?)1q3ub($A_uBV_c}9>QBj{q5cwCHUi0q)6?bu}O=IYz=kaF^yqh zS8&)>FFCkDV%aIfY;EwOS#Wlah=-z=jvhU~3?zw}Rp;w^bjy4>PU;(YwOl2n^S@i< zm6eH_XT{3|X{En!W4!4`uwMiFJ2?fd?1Qqj=zsfoh6_J@o>Tr8^TH8w72sX-S0zkA zr&Sr39Pq@9&w?E$vCKo>-NN^t{dR(&mbB)eV&N4WtzD0iuu!N$Q^wVWHM=51#K#|w zH@qR#)BcDG!~}@N%_Eogv4@t;5}8n^HI@NL>y!awdRG+&Rr4z!Mqok3SGr; zy{w$C$`$#Wm_Mhk9T&aU5l~`=nXp08ysopQkdd$!t7=;kI;7=IUc3?|(Nvu9_3#kU z4GcWzVVP`WYd5UY_m|)ra3#2AViw_Xmg-^n<_X|ofm61@cFotz%MQxEI4+V1R2KxG z;%qaAbu_h+*t~ic%AY57PlkD4%<*gQgVdQ{4i_9fnRIu*9W(<~7OcObKZKJSTqc^o zq_{L9M`W}t${7eHN4%UnB|?$Ud9w5;IQ3@xdIleK)^6XZR$pi!dKS%$L~m!@9Klr7 zzwk$@9V53_CH#|-EApjF4mzFNfTL4iy%0HhwTI zR+%j$##$qAnB$ZTecWVZ-9Qpax+^7$Z16Ac34e~x6Ik;C9>0^Gu!22bHl#;4{#);(}>5tN&MJXaLB_Pnbk(dr@o@=)Cp|M0X8w>bV; zbFwXa#Us5LNo#6bHZ!$@*?tN*dq$>rEw11dSuWj0|uGL{gGMk26f z+-~Gd>Px$URG4ARy7m&J3?3Cx_MnXTYxG+xIIujr5FL2&5P1Y%6r7-BfF)bFzZnG) zuFqtnd=a#`l7F*Ss^Sd52!nmG{z~-L#f2){0l6&MZL{r(6H?tp0xQ;7*Y3hH68C3O&l>Pn1%B+w1=Hox+c`1}2`tr^k^)h~_3&M5fjK!|>nX)b1nvmk;UqN;u?!s~` zIt!zTx#G~e#CaEoZNhGf6U%Bb77hGlfnhIwS0qK;pG2)bmG$%i zY)eddkM)P%CfYNHjf(4-%2f0Z`EiDEb#qnFW&$OL?dd6!Y_1RWNdhbhqErsqIe@I5 zipPz#%GpS``CKd|8a-#_uDP#vTh6#hYyC7ryw~mexdiG&nYbQ8o=$qob9SYW0=EL9 zXriXk^%*mj?)d|+AmO6~KeSlT4pJvy`G^JfTR)2myOAGvkY$`V{Wceqw;Oa3N$HHz zO~EPja0z$Pe;la(L7=i3oj}8^HlDCmdJ|emqG;Y!e99Y4@wP6$UaSs!iyLGDg8UIFzW4OlS_FjI<= zy*+C6uhg;dcljgz^jZt!B9KLNs>^uVG2dn4)I!;t7M& zD|`wpex)J}@qh3Ptw!RZ*&F;x+InFCF1x{%|IGFA;-Fa|ZO5=+Ci#{I1hpVmY<`_z zilq>lxoj{DccaQj*rpnfel9Fky&8pw+u`bGz7<$&`wY#X)jc4UhC88~hLB)8apc>~fOP{y_7IB4P*;s{pv1_hf2A0*As z11?p)q|X_qjaAu8fEZNmB}M)L?@`WJ9?p~5ee&E|Ow0-FfF#_G&$Ra?k7eq#CG{2T z##`j-5Di182(~(60W~izUX5QVt-~VRD1w?t{ySq0o0dE9S(@Y+W>_v9 zjYns~#8~iN>knMG3Qf*yDG*vpQgE+`nK0GJ@U_a1#Xc7BO0E(gmmQytWr9-tygE}n zhhuM^Z011ffjgPM7&XIaPPex?VOpgaL`>1~gvSypUmR1~)2!sd42x`MFs%c85mx@hpq!u-9F6#ttvS-ECRqu{r9U*Z zYA3e%ZTM_)hbBZ9=E=g-9Tm6}#Y5A2laJ_-DJLtse~6{-pR+|?bg%5@>vllI$me^f z1b42bhluzRAwMwK?bOm9*n@K7vE~UAaZ0jPevhCr8=nwc81`U@*jVjpL3}q5(O-d&I5HVke-~=BaGpsO4$)!mY zGR~^AUeB;P?LIBa4?RQkQK~WEIY)}OJoC40qkIcnCynXG*a-3$l3x}TBe+TtYjNv7 zmBBlpJ{g{ud`{eikcbIK=vV1=7dtF$&)B-%eh-A^hK=qTTa6>~U0PT1+WPfgi7iKc z4wNc4)WX2+T{F`pFJn{=;%O0mn*lSo8KN8&GX4S%8jCU^K=+6w{vhi1S*@(x7qpAB z@m*0t4jDa&A@GV0^h)2_regr?c*!6s7~R(;B+r+wm^0jiGMrzGn20uG}<*V;&0z63Z@VV8!zJGR0^+GgYSWP|Qp{+&Lwh4L22*6lrFVOErQZ|!0m!LsTb z{*Z5{=@Z?w%2)czj+LM?b>wLJ=;oWYMM6kV#;M-GS5YZQJ1l0*#0i6xe~Rum1p}e4 zci{)iiF>aG*M^RkJGUy{pcIc#jg>zbdO@pHm>#&R)yq}1_|Ih!Q5GF(H9ZWSy>4^Q z?S(|sAE9bsHKir8ljJS^8BuHN{4tMxFC~sp!KbAS5rJ!@yHreHoG{qpUd7iEX~&X1 z2S(BvkrFB5xX@`h;nK46@&g(9;2h55T69osWXkyLZDk&&GiMrzC}OA4;`5Wf9_iw} zwzo?4=}+5i#bgjOP_L1E|AY(|7td14it9vy4*bD0lJzi>fZ^ zI(cEa;*DBl&Sr4l@+ftk`|e`VfLsk-eF7#tD*5&X{6Dp3Wbv7Advy0UwGV6*YeR=OrgjNt zJfxlsm7R_@7sh*eD(O=!X8>yp18RF0*PzwcC0V~GG^KJ@kkkKhs*9ijRzlVZv7<20 zd0WwvwtcKnUgd(9V$R;+Asmgugp1vv0TXsL0pg13E}s-fX7ssnT-xF&!IQd}&+QwY z(kj&>$5tN6uGg}3{gMgOENS+1wG<;QUW9{RHQ?zu1ytpXlVo@cbh)#(6->il<8jvVI(=^_5 z1z1*x5*N`jEtSD_EGTJyU_RjOd6PtO$7YvXq}w-SM09Oj%`4szH9&VwJ6KpYyJu}! zvA20QBNL3UrAFg|!M86g)0#ykPN@}qoUnHN>Cp7=-AS=k!O5??_Uw4895>6S7k6)X z(}PZ_rtqaup$KPKEmbHU4c66k@5 zWhaVLkDZ=eCJ$GA2J>pO;H^wMi9nIzr!hN)U&PIOYxjjk7GE|G)Y8}hXdS@X2e~u) zdvJG{+VYqKHvDd;Ohqc^)x)$kZWF?}kMtU?9c%PAM%*u$Wk>Ukx)K0@N{hk)U8UW@ zSIkQMLN`+|t5kRR6Q{_^q~g6801^|VW>2$IM_nPd#i2BM)i#@1FrKH$S+KJx`sAA| z&-8iCVeie5n`*!jh1pD+)lVkboY68W(~S^}WJyXyqqANY`krnE9f}Y0%Js&f-@Yk@ zu2UTX4{IeU0oO4@iz2dl?(jYRU5-j|*HmH3EGV{qH3VdD)IS_MEfK@@u8db5qnrsR z)-~*GDaX4Df2BxX&3IiK0e3a{l3Ta8n`i^4we3&DFNi~#8hg|$wdZU-nIhlfcc^KJ z3BpWbpaCarQj0e4r%+*0pdMX!}aeS1kuTOGkoSW+pW7JIU{jhQ7h@B9v!1yM%qnD z9RrU|${Xt*Di6Y{MWhJ~m45nAph6r9-VGM+R{IEnNYw_hN(m^UoCbGqBIazxtQg%h ziXlB~@MDUH2||z@>Zpg!m~!TyWC{FQv>-lwIMlP9k#3jXqzbEj-FqwTSIZcqRRLNn zggDr&PVBGQdA`{{3`J7-&ErSlqeG|pW9@GN2ymMLbHaT0s=aWoGTbxEh*QMW7)YhL z(fgUJz08Nl2Z!uPL-O)(sL1o+6?Y|Yl;i3vlaV{Ng`FLkk#1kygOquVv0K%yCHDGH zrEK-@excBF-Cnl?Uby{dh=g~Y=2SzEWQUqvrH&FI6$Zl3JV1mGt0~=1V|M{Pbikz9 zMXKXgHguo<7Tg>=ZW7l$?p@!_xV)qxLXu8CY}RO9>J8`Fwo6V;rJ zyus9M5W;Wy;r=AO7K%V$>i;;D%GcHYg5+1#)WDkGw`JmmB*dutiiecE#i z)&RAvcVA~YbEh@?J^)sSGJ-+;jbucF|K5N~amr3vc_0`@7PsvgNaEvNa18hW+Or`M zk@0+%tQ48M=5bMe@4ZJT3z70IweG=v9W7Mtxuc}0wTGoG3yq)u0}lU-P=4_+W%GD z)pa42 zK3F(L`PFu+Ub&r%Jls~SQ$7F`*9;u%}%#(^Z|?H#5SyHzD_kE zqt8xN#|bmo<=kB?*(xWmL%7oO#U1qipdPMj_HWL+awNyK5n*~Y9lc05vG#|HQ`FCk zv#MAnt+z7heHp8sB~ghFdN8ZR2_w5CVH1^p%*{$qP7z3*ZQq*M4rdq`ohroS8_Uz{ zLyq`-!-yr^94(F1!64EU;RvZF$mFF=r`25U(K6uOK%|GsRbKHRLbDcTZZ8a3$_Jf_ zk1!Y^`eouvrw3Uv9T9m83`)yPRf1Sn*@*r`LHYAs(+@X070XADB|-@MppKUKxdp=h z-rAt&+L~O(lluw6ll2^Me7yERoVTpjf_GVro)LD!*bJAly`fP(5U;*JKhB-=`PEC0 zYCf)9^$Wf8ObTyr;PzwJ|1yj_W+5Ch$c+z90bP^>2b4{{6xQq2Ah_nKe)^US+DGefc8G3k zwIqtzUlwHA1?@!OGz-aM{dYgF*PP89x97|8bk%B9_>?w^vv}fO%EgI4B+F}(gSBFJ z5bIF=ZfN9xVibxuFW4QD;t{qI(q61ts`GdZsrTW9ESi%%zj|CT-Q|6k9f}|4&pCNw zcf85p6(4Q9{v&;VLfH{>PgcO>DTweY5I4Ap6Y$p$scI{!tPz9)*_{$0=Z#GxQb0w? z>g$w)c$o;Uw=06LBI{7tw*pJV$3xOYGi&%_y8CnFO5Q4IcaW;kq1GzjvyYtHT-_b7 z@6YrQOgke8L0oHHkeDi!=pf)S$@oKjYpmX2Uz3|`N$sr^rz8K|;WdVqf;4B>k!Jw5 zg6M~NMKjP>x8bgfEFl(w=UrChpYG)FWzqeC&PS4n_Euz(?v9^1h;gwnR-E10gi@5Q z42O8~Y-!u1oc$R)_&TK=f^`R-4ciouDF<^G@$aN%j%-h(jCprC?};oM4+4o{ug_M< z@o@SeC6O$K-$#HZFv4KE-3KU*G0Yf-1x-_?7l!<)n4klV>F2u3=7i28=wKL6DMf`x za;u+FdNv%SG@Xdq2z7moIbI6%G?HFCbZ4C=3s>fSSmLv@Of#yZuo$D30x|_Hd?CAq zwO;sShF)B(2*L)&`K|nWJ=u$_NUzymeI}cgHwDA;nB@|>6nx%i6L4w z?wy!7h6BMrZS z?|&b=KfJ&aln83B%=I?Jmi#IYn??sk{D>a zetXsQ+@OKt!9vs0aY5Wg8(8)??{@}!Cn7q95RWhNsd7yvR8J7jz&m9R>1VccNYXp%K?AAHJ1?!!$GMB*BINqv2i4jVh1gM!R z_5huGRpz_-XtEh;rPScS8GkK zalT~6BF`#K68wGJV?^Y}0ntIZuoLm4>nbwU1;I5ZS|^`Ai!+%3yyKG6y17zu6Ll?) z6Y#5U`)!ms(5hOA`*!w-`ykhCC~A3pgP?y7xE<|65@qZ?g+53Iwe!iJpy?k4yn}SL z@6dA}qnmPhK7p~|4YoM5U0WBug4eL=-|}84Vhxklm<;vV=jTcigx8o_o%{=iK+4=b!KQ`99C{ zIiGW$&mYhEJ|7~ka&9k<-EDEu5^ENf84{szVN2MJ>b&o_B{TUWat9BneXHkUwa0(a zDhd`QWs85!+j=x!&U|=z%JpNYUBuIV^u^YCxj9R|LJ3JYxsxe!!}nrV{X2~2_+j#V z=OPcC>P>BQ?%}(Z$A~vb?yu)zw)*g|(LBe+$xkY>M!QQyYjW!p&o_WcQXVI}UhVxl zAD8sSXdyl$WU(tOo2N@7bEM5da#cOqQG9M7R_I=p{hIRct1rleN*+x5_j{@5P4sJm zuQIzUZswy|s&$jTZgpU3329(C%lLluOsPTBL~qW@safU{g;Qr`mS3u9=G71PjZ)LG zqBh-^A=)asLJ+z_w~tBQk?My%Pgm4z?C45&Je-pz=?!xL*~h~V*R9t-byhQZ94ctc>=-C60W8%g@#8@ zDj{K3g@YYF8aht-U1DC#4U!|r^V*Q-{K|&i^c^e1>(@Win;u00y-t=x*^$LbiFF$Q z%Gryc2lY5CKa4}EZ;jH>tCKzP;%~S}xhsPw8Xu-t*Ax(Lj2J+BW%+h>a4Jo;%66GX z=UQMz2;>Um4~!how=?Y-X)dgJ^aJIf!WVFt#=uoI2CvKgTg+O6!K#pQdTTX*X4zv| z$IM>;j*Z@V|ETFsvxL0-yUWxo)@x^K6{)PT_T0VH)}rsC7;(SX^N6bX@RDu`RZE)! zu1FZC$=jb>C7A{I=L^zM{w3wz6uC<-a@H2V4{F{&=)WS>A}KS8D=f@<)3|}`$$g}v zCH67q0O8wG+^4gA=1&%RzoZOvcXdlT*0f7Mw!hqjd8FU`Tj1-IvIX04m3(@cO;+W8 zvfXS)2K6e#m{YKCFM@t+ z+e^zBCEc9QpWHq1w$2(oRhZG2$uN5UGQ~mX?sj^#t1w!u2X$r8C`LXx0I_JSny7ba ztw_&#_`OJ4(#dBtZx@Q9E_ZqKE8oLu=H9ZD^bcp0$UOgOI3!HK>PmOUEvl(_2{%9L zRSo&n+@3d?r(oJ$QeFC??})d)#K5+ho|Dk%4I<@0ykP%+iO&j^hM8@3!`IGyqYJE5 zjoC&oz@TkyG=uO~KV-wKS8<@j_l_t2`#QUmMo!E+Y#|e?>p8=ol;X|yWhHQ%D5p!< zr>@ypm*yCzmW~@GPwf$ZG{lPxFYVzvnj3aJ)@xQIYHTk(nMD96y9n?`QPflqMV5vk zuf^!ya~PG=7UQ#>=5T10ENK$+Hd=I~Qf#-v(a{-Xg@t-;%%)|W6?b^Ru6EaJD&Xt9 zDW}v2ue=YIH$K7KSCl<3A}DXZ!00Lc#;20Im|_)=+GNEVsgPqi0JCQ?5a|hOZ-iop zUGS$SU{y-AMdM;Z9yz;T;d8+YWKJKA^aLMQ*)_<1gw!)%8j&v&)P3EuDh+;{k~24N zyQQ4npGTc?l-Q2tNFVJp`G8Fu>5(1(CGz>u(jiotOx7zzc$phyTDss)CsgEbF>!H3y(W(3cFE3qMB0s^p} z00@oo3&IM3ENxEPYoLSu{M<2k{0Xoj$T1`oeoP&z z0sj;09|!?cpAam-1_eF>_y%A|-a%M)_x`VSa1EFS^oW4A_6{36Zq>-YP+$`tfCWGn z?iZ{{{sJI#00I*Lp?!!!BmnV0^J)MIhW}wu4FEfnek3+Z5ZaGTg#p%s;ECPY`j;Pe z*ziNU5BO>Hp6K`IXdcq1DGja{-QsG+2~z&?zz{xFHpVjlvO4gXZU1Dp-ONbyd(}{= zQg=}|5Rs4iji^fn_i75p@hc~KiDBJRjLUE7X5KV4l0r1UF08<`Okc3 z=0l0kB)G}7YG$u%I0I$53w0SkmlP7+k|ST>E42nry7$-XEj`nKt9f3}Dzg~x$ zNK6s6OWZW^fIKY6=%q6&7r{WuPPJicZo77-n~8q$Y@6_nnjJivG$PpHR#X2$Gj%_F zlqWHBz3Fx*x$mBgp4r2o60F^a{xvA#eD`_Pa+97L^!xkwn=DtZINnT=neVQu-HqyR zh*7V%tUpp^xPB-y*_&58ea(mTTN+#={Re%jg*OQs+i1pEanOnJ#_>?9QH9C7wa8oOcbWN;Z_?B+ zwO)`>`Yik-frdaavClxxmR~bzQc2HmBWbYEJ&{Mbnb)CD_2>>I;PEfzCx@<>U%C2w zm_uULgktcCjg>C`yYHI{t>fO98K3=LZ#;z%HGV=x3|K234o08p4c$J3CtD{7Xgs9 zPsEOt2!PH3P7r|oe}bK}A`nObM2oE(Ry*Zh1OT$5qdS2C;B*p#hM*8IeK-;Y(?_7R zV5d)Oo;E;eLJ-K)=wm1pSR45F680&kSUis84Zsn<#OD7{8xJ?P^*%}qm77A-rEyZy zbZISJEqxrt4Ht7VAA7))dxR(zy0nh_n^F`UF3p^aE~iU-IjCI__ZTO}#WAGFcl7T( Z1(7gBQW%lV4D1*Z0T)nGI&Fa#_z$>r0z?1+ diff --git a/doc/graphics/ssvc_2_deployer_SeEUMss.tex b/doc/graphics/ssvc_2_deployer_SeEUMss.tex index cfa607e9..61cac58b 100644 --- a/doc/graphics/ssvc_2_deployer_SeEUMss.tex +++ b/doc/graphics/ssvc_2_deployer_SeEUMss.tex @@ -46,60 +46,42 @@ for tree={s sep*=0.33, l sep=20mm, child anchor=west, anchor=west, grow=east, calign=center, tier/.pgfmath=level()}, forked edges, [Exploitation, rectangle, draw, [Exposure, rectangle, draw, my label={active}, -[Utility, rectangle, draw, my label={open}, -[Human Impact, rectangle, draw, my label={super effective}, +[Automatable, rectangle, draw, my label={open}, +[Human Impact, rectangle, draw, my label={yes}, [, immediate, my label={very high} ] [, immediate, my label={high} ] [, out-of-cycle, my label={medium} ] [, out-of-cycle, my label={low} ] ] -[Human Impact, rectangle, draw, my label={efficient}, -[, immediate, my label={very high} ] -[, immediate, my label={high} ] -[, out-of-cycle, my label={medium} ] -[, scheduled, my label={low} ] -] -[Human Impact, rectangle, draw, my label={laborious}, +[Human Impact, rectangle, draw, my label={no}, [, immediate, my label={very high} ] [, out-of-cycle, my label={high} ] [, scheduled, my label={medium} ] [, scheduled, my label={low} ] ] ] -[Utility, rectangle, draw, my label={controlled}, -[Human Impact, rectangle, draw, my label={super effective}, +[Automatable, rectangle, draw, my label={controlled}, +[Human Impact, rectangle, draw, my label={yes}, [, out-of-cycle, my label={very high} ] [, out-of-cycle, my label={high} ] [, out-of-cycle, my label={medium} ] [, scheduled, my label={low} ] ] -[Human Impact, rectangle, draw, my label={efficient}, -[, out-of-cycle, my label={very high} ] -[, out-of-cycle, my label={high} ] -[, scheduled, my label={medium} ] -[, scheduled, my label={low} ] -] -[Human Impact, rectangle, draw, my label={laborious}, +[Human Impact, rectangle, draw, my label={no}, [, out-of-cycle, my label={very high} ] [, out-of-cycle, my label={high} ] [, scheduled, my label={medium} ] [, scheduled, my label={low} ] ] ] -[Utility, rectangle, draw, my label={small}, -[Human Impact, rectangle, draw, my label={super effective}, +[Automatable, rectangle, draw, my label={small}, +[Human Impact, rectangle, draw, my label={yes}, [, out-of-cycle, my label={very high} ] [, out-of-cycle, my label={high} ] [, scheduled, my label={medium} ] [, scheduled, my label={low} ] ] -[Human Impact, rectangle, draw, my label={efficient}, -[, out-of-cycle, my label={very high} ] -[, out-of-cycle, my label={high} ] -[, scheduled, my label={medium} ] -[, scheduled, my label={low} ] -] -[Human Impact, rectangle, draw, my label={laborious}, +[Human Impact, rectangle, draw, my label={no}, [, out-of-cycle, my label={very high} ] [, out-of-cycle, my label={high} ] [, scheduled, my label={medium} ] @@ -108,60 +90,42 @@ ] ] [Exposure, rectangle, draw, my label={PoC}, -[Utility, rectangle, draw, my label={open}, -[Human Impact, rectangle, draw, my label={super effective}, +[Automatable, rectangle, draw, my label={open}, +[Human Impact, rectangle, draw, my label={yes}, [, out-of-cycle, my label={very high} ] [, out-of-cycle, my label={high} ] [, scheduled, my label={medium} ] [, scheduled, my label={low} ] ] -[Human Impact, rectangle, draw, my label={efficient}, -[, out-of-cycle, my label={very high} ] -[, scheduled, my label={high} ] -[, scheduled, my label={medium} ] -[, scheduled, my label={low} ] -] -[Human Impact, rectangle, draw, my label={laborious}, +[Human Impact, rectangle, draw, my label={no}, [, out-of-cycle, my label={very high} ] [, scheduled, my label={high} ] [, scheduled, my label={medium} ] [, defer, my label={low} ] ] ] -[Utility, rectangle, draw, my label={controlled}, -[Human Impact, rectangle, draw, my label={super effective}, +[Automatable, rectangle, draw, my label={controlled}, +[Human Impact, rectangle, draw, my label={yes}, [, out-of-cycle, my label={very high} ] [, scheduled, my label={high} ] [, scheduled, my label={medium} ] [, scheduled, my label={low} ] ] -[Human Impact, rectangle, draw, my label={efficient}, -[, scheduled, my label={very high} ] -[, scheduled, my label={high} ] -[, scheduled, my label={medium} ] -[, scheduled, my label={low} ] -] -[Human Impact, rectangle, draw, my label={laborious}, +[Human Impact, rectangle, draw, my label={no}, [, scheduled, my label={very high} ] [, scheduled, my label={high} ] [, scheduled, my label={medium} ] [, defer, my label={low} ] ] ] -[Utility, rectangle, draw, my label={small}, -[Human Impact, rectangle, draw, my label={super effective}, +[Automatable, rectangle, draw, my label={small}, +[Human Impact, rectangle, draw, my label={yes}, [, scheduled, my label={very high} ] [, scheduled, my label={high} ] [, scheduled, my label={medium} ] [, scheduled, my label={low} ] ] -[Human Impact, rectangle, draw, my label={efficient}, -[, scheduled, my label={very high} ] -[, scheduled, my label={high} ] -[, scheduled, my label={medium} ] -[, defer, my label={low} ] -] -[Human Impact, rectangle, draw, my label={laborious}, +[Human Impact, rectangle, draw, my label={no}, [, scheduled, my label={very high} ] [, scheduled, my label={high} ] [, scheduled, my label={medium} ] @@ -170,60 +134,42 @@ ] ] [Exposure, rectangle, draw, my label={none}, -[Utility, rectangle, draw, my label={open}, -[Human Impact, rectangle, draw, my label={super effective}, +[Automatable, rectangle, draw, my label={open}, +[Human Impact, rectangle, draw, my label={yes}, [, out-of-cycle, my label={very high} ] [, scheduled, my label={high} ] [, scheduled, my label={medium} ] [, scheduled, my label={low} ] ] -[Human Impact, rectangle, draw, my label={efficient}, -[, scheduled, my label={very high} ] -[, scheduled, my label={high} ] -[, scheduled, my label={medium} ] -[, scheduled, my label={low} ] -] -[Human Impact, rectangle, draw, my label={laborious}, +[Human Impact, rectangle, draw, my label={no}, [, scheduled, my label={very high} ] [, scheduled, my label={high} ] [, scheduled, my label={medium} ] [, defer, my label={low} ] ] ] -[Utility, rectangle, draw, my label={controlled}, -[Human Impact, rectangle, draw, my label={super effective}, +[Automatable, rectangle, draw, my label={controlled}, +[Human Impact, rectangle, draw, my label={yes}, [, scheduled, my label={very high} ] [, scheduled, my label={high} ] [, scheduled, my label={medium} ] [, scheduled, my label={low} ] ] -[Human Impact, rectangle, draw, my label={efficient}, -[, scheduled, my label={very high} ] -[, scheduled, my label={high} ] -[, scheduled, my label={medium} ] -[, defer, my label={low} ] -] -[Human Impact, rectangle, draw, my label={laborious}, +[Human Impact, rectangle, draw, my label={no}, [, scheduled, my label={very high} ] [, scheduled, my label={high} ] [, scheduled, my label={medium} ] [, defer, my label={low} ] ] ] -[Utility, rectangle, draw, my label={small}, -[Human Impact, rectangle, draw, my label={super effective}, -[, scheduled, my label={very high} ] -[, scheduled, my label={high} ] -[, scheduled, my label={medium} ] -[, defer, my label={low} ] -] -[Human Impact, rectangle, draw, my label={efficient}, +[Automatable, rectangle, draw, my label={small}, +[Human Impact, rectangle, draw, my label={yes}, [, scheduled, my label={very high} ] [, scheduled, my label={high} ] [, scheduled, my label={medium} ] [, defer, my label={low} ] ] -[Human Impact, rectangle, draw, my label={laborious}, +[Human Impact, rectangle, draw, my label={no}, [, scheduled, my label={very high} ] [, scheduled, my label={high} ] [, defer, my label={medium} ] diff --git a/doc/md_src_files/060_decision-trees.md b/doc/md_src_files/060_decision-trees.md index 0ead80b8..1ea6d5fd 100644 --- a/doc/md_src_files/060_decision-trees.md +++ b/doc/md_src_files/060_decision-trees.md @@ -5,11 +5,11 @@ The definition of choices can take a logical form, such as: - IF - ([*Exploitation*](#exploitation) IS [PoC](#exploitation)) AND - ([*Exposure*](#exposure) IS [controlled](#exploitation)) AND - - ([*Utility*](#utility) IS [laborious](#utility)) AND + - ([*Automatable*](#automatable) IS [no](#automatable)) AND - ([*Human Impact*](#human-impact) IS [medium](#human-impact)) - THEN priority is *scheduled*. -This logical statement is captured in line 50 of the deployer .csv file. +This logical statement is captured in line 35 of the deployer .csv file. There are different formats for capturing these prioritization decisions depending on how and where they are going to be used. In this paper, we primarily represent a full set of guidance on how one stakeholder will make a decision as a **decision tree**. diff --git a/doc/md_src_files/080_workedExample.md b/doc/md_src_files/080_workedExample.md index a243d2a6..01213665 100644 --- a/doc/md_src_files/080_workedExample.md +++ b/doc/md_src_files/080_workedExample.md @@ -23,8 +23,8 @@ However, since most of the hospital’s clients have not installed the app, and According to the fictional pilot scenario, “Our mission dictates that the first and foremost priority is to contribute to human welfare and to uphold the Hippocratic oath (do no harm).” The continuity of operations planning for a hospital is complex, with many MEFs. However, even from this abstract, it seems clear that “do no harm” is at risk due to this vulnerability. A mission essential function to that mission is each of the various medical devices works as expected, or at least if a device fails, it cannot actively be used to inflict harm. Unsolicited insulin delivery would mean that MEF “fails for a period of time longer than acceptable,” matching the description of MEF failure. The question is then whether the whole mission fails, which does not seem to be the case. The recovery of MEF functioning is not affected, and most MEFs (the emergency services, surgery, oncology, administration, etc.) would be unaffected. Therefore, we select [*MEF failure*](#mission-impact) and move on to ask about safety impact. This particular pilot study used SSVC version 1. -In the suggested deployer tree for SSVC version 2, mission and safety impact would be used to calculate the overall [*Human Impact*](#human-impat), and [*Utility*](#utility) would need to be answered as well. -Conducting further studies with the recommended version 2 Deployer tree remains an area of future work. +In the suggested deployer tree for SSVC version 2.1, mission and safety impact would be used to calculate the overall [*Human Impact*](#human-impat), and [*Automatable*](#automatable) would need to be answered as well. +Conducting further studies with the recommended version 2.1 Deployer tree remains an area of future work. In the pilot study, this information is conveyed as follows: - **Use of the cyber-physical system**: Insulin pumps are used to regulate blood glucose levels in diabetics. Diabetes is extremely common in the US. Misregulation of glucose can cause a variety of problems. Minor misregulation causes confusion or difficulty concentrating. Long-term minor mismanagement causes weigh management issues and blindness. Severe acute mismanagement can lead unconsciousness in a matter of minutes and death in a matter of hours. The impacted insulin pumps have a local (on-patient) wireless control, so wires to the pump do not have to be connected to the patient's control of the system, making the system lighter and less prone to be ripped out. diff --git a/favicon.ico b/favicon.ico new file mode 100644 index 0000000000000000000000000000000000000000..1db26945baf6facfd3e516eaaf832e23151ed595 GIT binary patch literal 15086 zcmeHNTWA$W7@m?AT6#gH7Ycni^hS#mf{67}+Cq!=_SAxSL1=Alqf)C-`{IKLf=`N~ zPlCybIcY8?O*9vyQ4)o!iD_a}b5UzT3~AD)#u#EQ&E@ZYvzhH?GrR7dJ!iKg8Q3#B zv;XD$XJ`NU=byvaLo9{OnZvX?!qOgQY!PED64BeaT7SCMmzp}&euc5+&oK6yMx#B_ zIP`w4Voal(`?!AbHvh>W#u9sdup*Z(Uv8)R`VJ~N@he@p@H@p~wX`5Li0DweRf`y_Ut*!eP~@>JDok#!hPb&@~d>@$VHm}`cco{xEtK?wOLuU!WB?7 zdWn`U(S7#ZC!(}^bpaI@U7`N|dsJK7Mypm8a2$&k#;Bp8!xyG?>k8@a-62Ew!UZu~ zd2cPtCaeW0ckbNdwVmI0WB2y&%eV~j^TYOXTis@PU0r>Gg*rO^cEw}n$Nic$1%?dV zU~H{4c5TcPQR316+|yB-oYdDnA?H~BFRt|i7v?F-ty{M}@qrg{g0-ywqR6ux%!QE= z`MPg6b}N?WSXJ{FVBV8a&-!z6>bNXBU9x_}N7mBQ)9+a~WPkKwE{%?kx#oQ_l4(`V z+bu1BxRznH3BJPGXV>1bqe7~`rl!rc3_ICw`b$e1rTR}*GzFr+t?e(Vey7;eja_bO z1_p+u`n`VpZuME|!qy-5_=i3J!v6lk_CJ`9VftU_4}1LqhA`J(=np&o0ERH*FX+b= zX8b8Igc*Me3}Nm+1P0V$?Z3@)TN%lzpyUMxNs3**wLAHOJ(6p3gqb zr?S#UzCZ2j8>FG3Q9^y=Mh~T@U!*tYX9W`Tdl_rwQ!+DacrHK$>d3boKKwK7+I5=t z?>|S_tH2JF#>P(Cm?qCHV~yRrw<<6jGcqm-$h@wqYNbb});ZZ2e7U~J$Uz{7v2*7s z?tcYs<>_WFN3@ewBd65ad3zf6{5>0Yyfp_l}x0xP! zAah9;{=vZ!vl`=m%eN)I@LR_v8Tf@?FhEb;;2bZ-!QYt2+36m+c2N?I|C5jNgyU#+%Bd`aF zXKaGt5$E(y_=7rsipO5n@vA<6RR4Ze_n)e-U#iCs@L4LyZ@{m5{H*%^1@A!R{Uh+J zzJG@eD(6ptU-kSIY*0CW2>iHI&ffyRHBT(|2CC%GVS~!&7h)c%e10TsQ2G2$*nnEq k^HZ}8DxY7Q?ZCZ?{~xg0Fx!^@H)Q6xXnzozEuoFTzZ;zNP5=M^ literal 0 HcmV?d00001 diff --git a/index.html b/index.html index 3087d9c4..65421433 100644 --- a/index.html +++ b/index.html @@ -1,469 +1,11 @@ - - - CERT/CC Demo Server - Dryad SSVC Calc App - - - - - - - - - - - + + SSVC Calculator Redirecting - - CERT Logo -

- - - - i - - - - - - -
-
- - -
-

- Dryad - SSVC Calc App -
- (CISA Coordinator v2) -
-

- -

- - - - - - - - -
-

-
-
-
- -
-
-
-
- - - - - - - - -
-
-
-
-
- -
-
-
-
Exploitation choices
- None:   There is no evidence of active exploitation and no public proof of concept (PoC) of how to exploit the vulnerability. -
- PoC:   - (Proof of Concept)One of the following cases is true: (1) private evidence of exploitation is attested but not shared; (2) widespread hearsay attests to exploitation; (3) typical public PoC in places such as Metasploit or ExploitDB; or (4) the vulnerability has a well-known method of exploitation. Some examples of condition (4) are open-source web proxies serve as the PoC code for how to exploit any vulnerability in the vein of improper validation of TLS certificates. As another example, Wireshark serves as a PoC for packet replay attacks on ethernet or WiFi networks. -
- Active:   Shared, observable, reliable evidence that the exploit is being used in the wild by real attackers; there is credible public reporting. -
-
-
Virulence choices
- Slow:   Steps 1-4 of the kill chain cannot be reliably automated for this vulnerability for some reason. These steps are reconnaissance, weaponization, delivery, and exploitation. Example reasons for why a step may not be reliably automatable include (1) the vulnerable component is not searchable or enumerable on the network, (2) weaponization may require human direction for each target, (3) delivery may require channels that widely deployed network security configurations block, and (4) exploitation may be frustrated by adequate exploit-prevention techniques enabled by default; ASLR is an example of an exploit-prevention tool. -
- Rapid:   Steps 1-4 of the of the kill chain can be reliably automated. If the vulnerability allows unauthenticated remote code execution (RCE) or command injection, the response is likely rapid. -
-
-
Technical Impact
- Partial:   The exploit gives the adversary limited control over, or information exposure about, the behavior of the software that contains the vulnerability. Or the exploit gives the adversary an importantly low stochastic opportunity for total control. In this context, “low” means that the attacker cannot reasonably make enough attempts to overcome the low chance of each attempt not working. Denial of service is a form of limited control over the behavior of the vulnerable component. -
- Total:   The exploit gives the adversary total control over the behavior of the software, or it gives total disclosure of all information on the system that contains the vulnerability. -
-
- -
Mission Prevelance choices
- Minimal:   Neither support nor essential apply. The vulnerable component may be used within the entities, but it is not used as a mission-essential component nor does it support (enough) mission essential functions. -
- Support:   The operation of the vulnerable component merely supports mission essential functions for two or more entities. - EssentialThe vulnerable component directly provides capabilities that constitute at least one MEF for at least one entity, and failure may (but need not) lead to overall mission failure. -
-
-
Vulnerability Scoring Decisions
- Track   The vulnerability does not require attention outside of Vulnerability Management (VM) at this time. Continue to track the situation and reassess the severity of vulnerability if necessary. -
- Track *   Track these closely, especially if mitigation is unavailable or difficult. Recommended that analyst discuss with other ana-lysts and get a second opinion. -
- Attend   The vulnerability requires to be attended to by stakeholders outside VM. The action is a request to others for assistance / information / details, as well as a potential publication about the issue. -
- Act   The vulnerability requires immediate action by the relevant leadership. The action is a high-priority meeting among the relevant supervisors to decide how to respond. -
- -
- - - - - - - - -
- Determining Mission & Well-being impact value -

 

Public Well-Being Impact


Minimal

Material

Irreversible

Mission Prevalence

Minimal

Low

Medium

High

Support

Medium

Medium

High

Essential

High

High

High

-
- - - -
- -
Public Well-being Impact Decision Values
- - -
-

Impact

Type of Harm

Description

Minimal

All

The effect is below the threshold for all aspects described in material.

Material
(Any one or more of these conditions hold.)

Physical harm

Physical distress and injuries for users (not operators) of the system.

Operator
resiliency

If the operator is expected to be able to keep the cyber-physical system safely operating (that is, prevents one of the other types of harm), then select this option if one of these three apply: system operator must react to exploitation of the vulnerability to maintain safe system state but operator actions would be within their capabilities; OR significant distraction or discomfort to operators; OR causes significant occupational safety hazard.

System
resiliency

Cyber-physical system’s safety margin effectively eliminated but no actual harm; OR failure of cyber-physical system functional capabilities that support safe operation.

Environment

Major externalities (property damage, environmental damage, etc.) imposed on other parties.

Financial

Financial losses that likely lead to bankruptcy of multiple persons.

Psychological

Widespread emotional or psychological harm, sufficient to be cause for counselling or therapy, to populations of people.

Irreversible (Any one or more of these conditions hold.)

Physical harm

Multiple fatalities likely.

Operator
resiliency

Operator is incapacitated, where operator usually maintains safe cyber-physical system operations, and so other harms at this level are likely.

System
resiliency

Total loss of whole cyber-physical system of which the software is a part.

Environment

Extreme or serious externalities (immediate public health threat, environmental damage leading to small ecosystem collapse, etc.) imposed on other parties.

Financial

Social systems (elections, financial grid, etc.) supported by the software are destabilized and potentially collapse.

Psychological

N/A

-
-
- -
- Stakeholder-Specific Vulnerability Categorization (SSVC) -
- version 2 (October 2020) -
-
-

Introduction:

-

- Our proposed SSVC approach for vulnerability prioritization takes the form of decision trees. This decision tree can be adapted for different vulnerability management stakeholders such as patch developers and patch appliers. In this instance of Drayd - SSVC calculator app, SSVC is being prototyped for CISA in their unique role as advisors to be able to provide decision support to various stakeholders and influence their prioritization of vulnerabilities. -

-
-
-

Decision Tree Usage:

-

- Click on the button to see - the complete decision tree at a glance. Each circle - - - - - - - represents a decision point or - stage/fork in the decision tree. You can move your mouse over each circle - to get a glimpse at the definition of the choices you can make after that stage/fork. - The path (branch) leading to the next stage fork is labeled - - - - - partial - - - also as it leads you to the next stage/fork represented by a circle. -

-
-

- When using for a new SSVC calculation with - -
- You can move your mouse over circle - - - - - - - or on the text - - Exploitation - that represents a stage/fork in the decision tree - to get information - on choices you can make for - your next stage/fork of the tree. - You will see each branch will also be be labeled - - - - - partial - - - that leads you to the next stage/fork. - You can make the appropriate choice by clicking on the text "partial" or on the - circle where your chosen path ends or terminates. Follow these steps on the decision tree. - When prompted for more complex decision making like - - Mission & Well-Being Impact, you will be presented with more choices, - you can click on - ? to get more help in - understanding and making the right choices. -

-

- Mission & Well-being - is a - cumulative decision that is comprised of - - Mission Prevelance and - - Public Well-Being Impact - . -

-
-
-
-
-
-
-
- - - - - - - - - - - - -
- -
- -
-
- - - - - - - - -
- - -
- - - - Include decision tree in export - -
- Contact: - -
-
-
- -
- JSON - PDF - -
-
-
-
-
-
- - + + Redirecting, SSVC Calculator is at ssvc-calc/ diff --git a/src/enumerate-deployer-options.sh b/src/enumerate-deployer-options.sh index 73521847..f2990052 100755 --- a/src/enumerate-deployer-options.sh +++ b/src/enumerate-deployer-options.sh @@ -4,7 +4,7 @@ i=1 # default output file in the SSVC Github file structure -out="../data/csvs/deployer-options_v2.csv" +out="../data/csvs/deployer-options_v2_1.csv" # refuse to clobber existing file if [ -e "$out" ] @@ -13,13 +13,13 @@ if [ -e "$out" ] fi #header row -echo "row,Exploitation,Exposure,Utility,Well-being and Mission Impact,Priority(TODO)">$out +echo "row,Exploitation,Exposure,Automatable,HumanImpact,Priority(TODO)">$out for Exploitation in none PoC active do for Exposure in small controlled open - do for Utility in laborious efficient "super effective" - do for WellnessMissionImpact in low medium high "very high" - do echo $i,$Exploitation,$Exposure,$Utility,$WellnessMissionImpact,>>$out + do for Automatable in no yes + do for HumanImpact in low medium high "very high" + do echo $i,$Exploitation,$Exposure,$Automatable,$HumanImpact,>>$out i=$(($i+1)) done done diff --git a/ssvc-calc/Deployer-v2.1.0.json b/ssvc-calc/Deployer-v2.1.0.json new file mode 100644 index 00000000..72c08a88 --- /dev/null +++ b/ssvc-calc/Deployer-v2.1.0.json @@ -0,0 +1,849 @@ +{ + "decision_points": [ + { + "label": "Exploitation", + "decision_type": "simple", + "key": "E", + "options": [ + { + "label": "none", + "key": "N", + "description": "There is no evidence of active exploitation and no public proof of concept (PoC) of how to exploit the vulnerability." + }, + { + "label": "poc", + "key": "P", + "description": "One of the following cases is true: (1) private evidence of exploitation is attested but not shared; (2) widespread hearsay attests to exploitation; (3) typical public PoC in places such as Metasploit or ExploitDB; or (4) the vulnerability has a well-known method of exploitation. Some examples of condition (4) are open-source web proxies serve as the PoC code for how to exploit any vulnerability in the vein of improper validation of TLS certificates. As another example, Wireshark serves as a PoC for packet replay attacks on ethernet or WiFi networks." + }, + { + "label": "active", + "key": "A", + "description": "Shared, observable, reliable evidence that the exploit is being used in the wild by real attackers; there is credible public reporting." + } + ] + }, + { + "decision_type": "simple", + "label": "Exposure", + "key": "X", + "options": [ + { + "label": "small", + "key": "S", + "description": "Local service or program; highly controlled network" + }, + { + "label": "controlled", + "key": "C", + "description": "Networked service with some access restrictions or mitigations already in place (whether locally or on the network). A successful mitigation must reliably interrupt the adversary’s attack, which requires the attack is detectable both reliably and quickly enough to respond. Controlled covers the situation in which a vulnerability can be exploited through chaining it with other vulnerabilities. The assumption is that the number of steps in the attack path is relatively low; if the path is long enough that it is implausible for an adversary to reliably execute it, then exposure should be small." + }, + { + "label": "open", + "key": "O", + "description": "Internet or another widely accessible network where access cannot plausibly be restricted or controlled (e.g., DNS servers, web servers, VOIP servers, email servers)" + } + ] + + }, + { + "label": "Automatable", + "key": "A", + "decision_type": "simple", + "options": [ + { + "label": "no", + "key": "N", + "description": "Steps 1-4 of the kill chain cannot be reliably automated for this vulnerability for some reason. These steps are reconnaissance, weaponization, delivery, and exploitation. Example reasons for why a step may not be reliably automatable include (1) the vulnerable component is not searchable or enumerable on the network, (2) weaponization may require human direction for each target, (3) delivery may require channels that widely deployed network security configurations block, and (4) exploitation may be frustrated by adequate exploit-prevention techniques enabled by default; ASLR is an example of an exploit-prevention tool." + }, + { + "label": "yes", + "key": "Y", + "description": "Steps 1-4 of the of the kill chain can be reliably automated. If the vulnerability allows unauthenticated remote code execution (RCE) or command injection, the response is likely yes." + } + ] + }, + { + "decision_type": "simple", + "label": "Situated Safety Impact", + "key": "S", + "options": [ + { + "label": "none", + "key": "N", + "description": "Does not mean no impact literally; the effect is below the threshold for all aspects described in Minor" + }, + { + "label": "minor", + "key": "M", + "description": "Any one of the following is observed \"Physical Harm\": Physical discomfort for users of the system OR a minor occupational safety hazard OR reduction in physical system safety margins. \"Environment\": Minor externalities (property damage, environmental damage, etc.) imposed on other parties. \"Financial\": Financial losses, which are not readily absorbable, to multiple persons. \"Psychological\": Emotional or psychological harm, sufficient to be cause for counseling or therapy, to multiple persons." + }, + { + "label": "major", + "key": "A", + "description": "Any one of the following is observed \"Physical Harm\": Physical distress and injuries for users of the system OR a significant occupational safety hazard OR failure of physical system functional capabilities that support safe operation. \"Environment\": Major externalities (property damage, environmental damage, etc.) imposed on other parties. \"Financial\": Financial losses that likely lead to bankruptcy of multiple persons. \"Psychological\": Widespread emotional or psychological harm, sufficient to be cause for counseling or therapy, to populations of people." + }, + { + "label": "hazardous", + "key": "H", + "description": "Any one of the following is observed \"Physical Harm\": Serious or fatal injuries, where fatalities are plausibly preventable via emergency services or other measures OR parts of the cyber-physical system that support safe operation break. \"Environment\": Serious externalities (threat to life as well as property, widespread environmental damage, measurable public health risks, etc.) imposed on other parties. \"Financial\": Socio-technical system (elections, financial grid, etc.) of which the affected component is a part is actively destabilized and enters unsafe state \"Psychological\": N/A" + }, + { + "label": "catastrophic", + "key": "C", + "description": "Any one of the following is observed \"Physical Harm\": Multiple immediate fatalities (emergency response probably cannot save the victims.). \"Environment\": Extreme externalities (immediate public health threat, environmental damage leading to small ecosystem collapse, etc.) imposed on other parties. \"Financial\": Social systems (elections, financial grid, etc.) supported by the software collapse. \"Psychological\": N/A" + } + ] + }, + { + "decision_type": "simple", + "label": "Mission Impact", + "key": "M", + "options": [ + { + "label": "none", + "key": "N", + "description": "Little to no impact up to degradation of non-essential functions; chronic degradation would eventually harm essential functions. (aka Non-Essential Degraded)" + }, + { + "label": "degraded", + "key": "D", + "description": "Little to no impact up to degradation of non-essential functions; chronic degradation would eventually harm essential functions. (aka Non-Essential Degraded)" + }, + { + "label": "crippled", + "key": "C", + "description": "Mission Essential Function (MEF) support is crippled. Activities that directly support essential functions are crippled; essential functions continue for a time" + }, + { + "label": "mef failure", + "key": "F", + "description": "Any one mission essential function fails for period of time longer than acceptable; overall mission of the organization degraded but can still be accomplished for a time" + + }, + { + "label": "mission failure", + "key": "M", + "description": "Multiple or all mission essential functions fail; ability to recover those functions degraded; organization’s ability to deliver its overall mission fails" + + } + ] + + }, + { + "label": "Human Impact", + "decision_type": "complex", + "children": [ + { + "label": "Situated Safety Impact" + }, + { + "label": "Mission Impact" + } + ], + "options": [ + { + "label": "low", + "key": "L", + "description": "The combined Situated Safety Impact and Mission Impact is \"low\" ", + "child_combinations": [ + [ { + "child_label": "Situated Safety Impact", + "child_key": "S", + "child_option_labels":[ + "none", + "minor" + ] + }, + { + "child_label": "Mission Impact", + "child_key": "M", + "child_option_labels":[ + "none", + "degraded", + "crippled" + ] + + } + ] + + ] + }, + { + "label": "medium", + "key": "M", + "description": "The combined Situated Safety Impact and Mission Impact is \"medium\" ", + "child_combinations": [ + [ { + "child_label": "Situated Safety Impact", + "child_key": "S", + "child_option_labels":[ + "none", + "minor" + ] + }, + { + "child_label": "Mission Impact", + "child_key": "M", + "child_option_labels":[ + "mef failure" + ] + + } + ], + [ { + "child_label": "Situated Safety Impact", + "child_key": "S", + "child_option_labels":[ + "major" + ] + }, + { + "child_label": "Mission Impact", + "child_key": "M", + "child_option_labels":[ + "none", + "degraded", + "crippled" + ] + + } + ] + + ] + }, + { + "label": "high", + "key": "H", + "description": "The combined Situated Safety Impact and Mission Impact is \"high\" ", + "child_combinations": [ + [ { + "child_label": "Situated Safety Impact", + "child_key": "S", + "child_option_labels":[ + "major" + ] + }, + { + "child_label": "Mission Impact", + "child_key": "M", + "child_option_labels":[ + "mef failure" + ] + + } + ], + [ { + "child_label": "Situated Safety Impact", + "child_key": "S", + "child_option_labels":[ + "hazardous" + ] + }, + { + "child_label": "Mission Impact", + "child_key": "M", + "child_option_labels":[ + "none", + "degraded", + "crippled", + "mef failure" + ] + + } + ] + + + + ] + }, + { + "label": "very high", + "key": "V", + "description": "The combined Situated Safety Impact and Mission Impact is \"very high\" ", + "child_combinations": [ + [ { + "child_label": "Situated Safety Impact", + "child_key": "S", + "child_option_labels":[ + "none", + "minor", + "major", + "hazardous", + "catastrophic" + ] + }, + { + "child_label": "Mission Impact", + "child_key": "M", + "child_option_labels":[ + "mission failure" + ] + + } + ], + [ { + "child_label": "Situated Safety Impact", + "child_key": "S", + "child_option_labels":[ + "catastrophic" + ] + }, + { + "child_label": "Mission Impact", + "child_key": "M", + "child_option_labels":[ + "none", + "degraded", + "crippled", + "mef failure", + "mission failure" + ] + + } + ] + + ] + + } + ] + }, + { + "decision_type": "final", + "options": [ + { + "label": "defer", + "key": "D", + "description": "Do not act at present.", + "color": "#75FC4C" + }, + { + "label": "scheduled", + "key": "S", + "description": "Act during regularly scheduled maintenance time.", + "color": "#FBEB61" + }, + { + "label": "out-of-cycle", + "key": "O", + "description": "Act more quickly than usual to apply the mitigation or remediation out-of-cycle, during the next available opportunity, working overtime if necessary.", + "color": "#EE8733" + }, + { + "label": "immediate", + "key": "I", + "description": "Act immediately; focus all resources on applying the fix as quickly as possible, including, if necessary, pausing regular organization operations.", + "color": "#EA3423" + } + ], + "label": "Priority" + } ], + "decisions_table": [ + { + "Exploitation": "none", + "Exposure": "small", + "Automatable": "no", + "Human Impact": "low", + "Priority": "defer" + }, + { + "Exploitation": "none", + "Exposure": "small", + "Automatable": "no", + "Human Impact": "medium", + "Priority": "defer" + }, + { + "Exploitation": "none", + "Exposure": "small", + "Automatable": "no", + "Human Impact": "high", + "Priority": "scheduled" + }, + { + "Exploitation": "none", + "Exposure": "small", + "Automatable": "no", + "Human Impact": "very high", + "Priority": "scheduled" + }, + { + "Exploitation": "none", + "Exposure": "small", + "Automatable": "yes", + "Human Impact": "low", + "Priority": "defer" + }, + { + "Exploitation": "none", + "Exposure": "small", + "Automatable": "yes", + "Human Impact": "medium", + "Priority": "scheduled" + }, + { + "Exploitation": "none", + "Exposure": "small", + "Automatable": "yes", + "Human Impact": "high", + "Priority": "scheduled" + }, + { + "Exploitation": "none", + "Exposure": "small", + "Automatable": "yes", + "Human Impact": "very high", + "Priority": "scheduled" + }, + { + "Exploitation": "none", + "Exposure": "controlled", + "Automatable": "no", + "Human Impact": "low", + "Priority": "defer" + }, + { + "Exploitation": "none", + "Exposure": "controlled", + "Automatable": "no", + "Human Impact": "medium", + "Priority": "scheduled" + }, + { + "Exploitation": "none", + "Exposure": "controlled", + "Automatable": "no", + "Human Impact": "high", + "Priority": "scheduled" + }, + { + "Exploitation": "none", + "Exposure": "controlled", + "Automatable": "no", + "Human Impact": "very high", + "Priority": "scheduled" + }, + { + "Exploitation": "none", + "Exposure": "controlled", + "Automatable": "yes", + "Human Impact": "low", + "Priority": "scheduled" + }, + { + "Exploitation": "none", + "Exposure": "controlled", + "Automatable": "yes", + "Human Impact": "medium", + "Priority": "scheduled" + }, + { + "Exploitation": "none", + "Exposure": "controlled", + "Automatable": "yes", + "Human Impact": "high", + "Priority": "scheduled" + }, + { + "Exploitation": "none", + "Exposure": "controlled", + "Automatable": "yes", + "Human Impact": "very high", + "Priority": "scheduled" + }, + { + "Exploitation": "none", + "Exposure": "open", + "Automatable": "no", + "Human Impact": "low", + "Priority": "defer" + }, + { + "Exploitation": "none", + "Exposure": "open", + "Automatable": "no", + "Human Impact": "medium", + "Priority": "scheduled" + }, + { + "Exploitation": "none", + "Exposure": "open", + "Automatable": "no", + "Human Impact": "high", + "Priority": "scheduled" + }, + { + "Exploitation": "none", + "Exposure": "open", + "Automatable": "no", + "Human Impact": "very high", + "Priority": "scheduled" + }, + { + "Exploitation": "none", + "Exposure": "open", + "Automatable": "yes", + "Human Impact": "low", + "Priority": "scheduled" + }, + { + "Exploitation": "none", + "Exposure": "open", + "Automatable": "yes", + "Human Impact": "medium", + "Priority": "scheduled" + }, + { + "Exploitation": "none", + "Exposure": "open", + "Automatable": "yes", + "Human Impact": "high", + "Priority": "scheduled" + }, + { + "Exploitation": "none", + "Exposure": "open", + "Automatable": "yes", + "Human Impact": "very high", + "Priority": "out-of-cycle" + }, + { + "Exploitation": "PoC", + "Exposure": "small", + "Automatable": "no", + "Human Impact": "low", + "Priority": "defer" + }, + { + "Exploitation": "PoC", + "Exposure": "small", + "Automatable": "no", + "Human Impact": "medium", + "Priority": "scheduled" + }, + { + "Exploitation": "PoC", + "Exposure": "small", + "Automatable": "no", + "Human Impact": "high", + "Priority": "scheduled" + }, + { + "Exploitation": "PoC", + "Exposure": "small", + "Automatable": "no", + "Human Impact": "very high", + "Priority": "scheduled" + }, + { + "Exploitation": "PoC", + "Exposure": "small", + "Automatable": "yes", + "Human Impact": "low", + "Priority": "scheduled" + }, + { + "Exploitation": "PoC", + "Exposure": "small", + "Automatable": "yes", + "Human Impact": "medium", + "Priority": "scheduled" + }, + { + "Exploitation": "PoC", + "Exposure": "small", + "Automatable": "yes", + "Human Impact": "high", + "Priority": "scheduled" + }, + { + "Exploitation": "PoC", + "Exposure": "small", + "Automatable": "yes", + "Human Impact": "very high", + "Priority": "scheduled" + }, + { + "Exploitation": "PoC", + "Exposure": "controlled", + "Automatable": "no", + "Human Impact": "low", + "Priority": "defer" + }, + { + "Exploitation": "PoC", + "Exposure": "controlled", + "Automatable": "no", + "Human Impact": "medium", + "Priority": "scheduled" + }, + { + "Exploitation": "PoC", + "Exposure": "controlled", + "Automatable": "no", + "Human Impact": "high", + "Priority": "scheduled" + }, + { + "Exploitation": "PoC", + "Exposure": "controlled", + "Automatable": "no", + "Human Impact": "very high", + "Priority": "scheduled" + }, + { + "Exploitation": "PoC", + "Exposure": "controlled", + "Automatable": "yes", + "Human Impact": "low", + "Priority": "scheduled" + }, + { + "Exploitation": "PoC", + "Exposure": "controlled", + "Automatable": "yes", + "Human Impact": "medium", + "Priority": "scheduled" + }, + { + "Exploitation": "PoC", + "Exposure": "controlled", + "Automatable": "yes", + "Human Impact": "high", + "Priority": "scheduled" + }, + { + "Exploitation": "PoC", + "Exposure": "controlled", + "Automatable": "yes", + "Human Impact": "very high", + "Priority": "out-of-cycle" + }, + { + "Exploitation": "PoC", + "Exposure": "open", + "Automatable": "no", + "Human Impact": "low", + "Priority": "defer" + }, + { + "Exploitation": "PoC", + "Exposure": "open", + "Automatable": "no", + "Human Impact": "medium", + "Priority": "scheduled" + }, + { + "Exploitation": "PoC", + "Exposure": "open", + "Automatable": "no", + "Human Impact": "high", + "Priority": "scheduled" + }, + { + "Exploitation": "PoC", + "Exposure": "open", + "Automatable": "no", + "Human Impact": "very high", + "Priority": "out-of-cycle" + }, + { + "Exploitation": "PoC", + "Exposure": "open", + "Automatable": "yes", + "Human Impact": "low", + "Priority": "scheduled" + }, + { + "Exploitation": "PoC", + "Exposure": "open", + "Automatable": "yes", + "Human Impact": "medium", + "Priority": "scheduled" + }, + { + "Exploitation": "PoC", + "Exposure": "open", + "Automatable": "yes", + "Human Impact": "high", + "Priority": "out-of-cycle" + }, + { + "Exploitation": "PoC", + "Exposure": "open", + "Automatable": "yes", + "Human Impact": "very high", + "Priority": "out-of-cycle" + }, + { + "Exploitation": "active", + "Exposure": "small", + "Automatable": "no", + "Human Impact": "low", + "Priority": "scheduled" + }, + { + "Exploitation": "active", + "Exposure": "small", + "Automatable": "no", + "Human Impact": "medium", + "Priority": "scheduled" + }, + { + "Exploitation": "active", + "Exposure": "small", + "Automatable": "no", + "Human Impact": "high", + "Priority": "out-of-cycle" + }, + { + "Exploitation": "active", + "Exposure": "small", + "Automatable": "no", + "Human Impact": "very high", + "Priority": "out-of-cycle" + }, + { + "Exploitation": "active", + "Exposure": "small", + "Automatable": "yes", + "Human Impact": "low", + "Priority": "scheduled" + }, + { + "Exploitation": "active", + "Exposure": "small", + "Automatable": "yes", + "Human Impact": "medium", + "Priority": "scheduled" + }, + { + "Exploitation": "active", + "Exposure": "small", + "Automatable": "yes", + "Human Impact": "high", + "Priority": "out-of-cycle" + }, + { + "Exploitation": "active", + "Exposure": "small", + "Automatable": "yes", + "Human Impact": "very high", + "Priority": "out-of-cycle" + }, + { + "Exploitation": "active", + "Exposure": "controlled", + "Automatable": "no", + "Human Impact": "low", + "Priority": "scheduled" + }, + { + "Exploitation": "active", + "Exposure": "controlled", + "Automatable": "no", + "Human Impact": "medium", + "Priority": "scheduled" + }, + { + "Exploitation": "active", + "Exposure": "controlled", + "Automatable": "no", + "Human Impact": "high", + "Priority": "out-of-cycle" + }, + { + "Exploitation": "active", + "Exposure": "controlled", + "Automatable": "no", + "Human Impact": "very high", + "Priority": "out-of-cycle" + }, + { + "Exploitation": "active", + "Exposure": "controlled", + "Automatable": "yes", + "Human Impact": "low", + "Priority": "scheduled" + }, + { + "Exploitation": "active", + "Exposure": "controlled", + "Automatable": "yes", + "Human Impact": "medium", + "Priority": "out-of-cycle" + }, + { + "Exploitation": "active", + "Exposure": "controlled", + "Automatable": "yes", + "Human Impact": "high", + "Priority": "out-of-cycle" + }, + { + "Exploitation": "active", + "Exposure": "controlled", + "Automatable": "yes", + "Human Impact": "very high", + "Priority": "out-of-cycle" + }, + { + "Exploitation": "active", + "Exposure": "open", + "Automatable": "no", + "Human Impact": "low", + "Priority": "scheduled" + }, + { + "Exploitation": "active", + "Exposure": "open", + "Automatable": "no", + "Human Impact": "medium", + "Priority": "scheduled" + }, + { + "Exploitation": "active", + "Exposure": "open", + "Automatable": "no", + "Human Impact": "high", + "Priority": "out-of-cycle" + }, + { + "Exploitation": "active", + "Exposure": "open", + "Automatable": "no", + "Human Impact": "very high", + "Priority": "immediate" + }, + { + "Exploitation": "active", + "Exposure": "open", + "Automatable": "yes", + "Human Impact": "low", + "Priority": "out-of-cycle" + }, + { + "Exploitation": "active", + "Exposure": "open", + "Automatable": "yes", + "Human Impact": "medium", + "Priority": "out-of-cycle" + }, + { + "Exploitation": "active", + "Exposure": "open", + "Automatable": "yes", + "Human Impact": "high", + "Priority": "immediate" + }, + { + "Exploitation": "active", + "Exposure": "open", + "Automatable": "yes", + "Human Impact": "very high", + "Priority": "immediate" + } + ], + "lang": "en", + "version": "2.0", + "title": "Deployer v2.1.0" +} diff --git a/ssvc-calc/cmu-logo.png b/ssvc-calc/cmu-logo.png new file mode 100644 index 0000000000000000000000000000000000000000..4c3f155b88d8707733b1cf3c6a9942eef90d6d35 GIT binary patch literal 6796 zcmZX11yodP_x{igB1lUMigZfM3`h(}mw-q!AUVL$gOt)GAt9w8A~}S_kRsjP-AH#1 z@WXrW_uX&(|FhORXPPLPAJK2mk;`loaK(000c&UCf1#d-vZ2 zj=W0{4%o=bYADIdGHbZNtZeL|0DxlH$0R%*Z5t~8+cRSc0v?tjf_j3Xf`kFA$BKCL zECfoAS-vux%0iv6+XKV#6UiTvYdUfJN8*sTisHX4#1agBylmPO+yycv5UREI=%0h{ zUNp|k+$MV5+@@avKEEkzT_VDb4)PC02R3F@COqu3HV0MZ(`ZOWEQ&btaJ z95O_5UT@MaC?aWNWR+7ar{1fpB!Ii90QWlVE8mj=CJ8EpT%P#|lZxX)CCT+3KS$kz z!lM0qFRWdJcV7V$m6 zduhU!4L(unnE1$~r}VHsuyPtF`5}%VE=9eY6s~ehX?mwq3A_Z$6iuqm7+ZB5R!cC5 zRGTg{1UT_2M4@fyr)m7P`vIRDGAn5tWn#uT0DZ15D{*N`(=A5LnD;d>gg@gP2MAn7 zmtc_o#PP&5xrhH;275}0RUiA=8*s`SPUWA1C4`g#_e%)uu^yO`P2iCRvMtcO!Om^+ zaw2$*mA*jgiSI29_9O^yLhuvH++)m=)=?x9^jBfA>%ee%SNBEwF++IZ{V$fGWMRzW zKZsvpeU#48!1+O)AK)9TCbRzKsRp$x(`FFv7qJ0rnt)DzlCgKa3kD_hJ@1~nSlhe1596(q{3~(Z z^UV)dUmv1^j+tdUIEhJRTlx7#Y1CElIjEYOEG=G|j#+T=;|Y)?i}vuS@LACuktjE9 znirKa>Qjkgbhq<1QJHm@;FWNeQkQy^Tu+=mV~CCxYDXtkIPm1D6PY7o3b0;=p0lD!(Pn6Iw5kvIhD|2SRN9Fdn>-Gm^_T5)+QoZ|+>0D$ z{`@a=9(}qG3?-N26^N;htBcK~j(ClD zF49eC(`qK|Kt>xftQVhaP-uYkf*h4o$v)M1YGhabGJDLzA+qx0snpJ+soDxYTe9B+ zu2OE#Bw8ifT^Toi)x50HtWkD5`)xe_aBz5>XpCZOXQ1}8*jM%Ovr+Zo`Fy{Zegpot z3l7Y}6Shu$3pldxnk+5(yJ#IE&18+5@5!PTjhjiEHQC_V`q`rjCkio9N^Op9d2NPK zhEXA^#42ma+(LOGUZyXE-Gm+_JBm4oU7K1tQo$<63J14QsBhxkQuB3V=vbWAU+t{Z zSzSw&kNSps1!rB7pt%q1SM48_OgsaBg_lb+WHPaBu0lJIkLc8jeZK@rz{s^+NOb**1lfJe9*?zvAs z+}d4l7`py(#Ysj@meMW|0|q)s4Fk!%K$#ApR58TuHi(anuX5ZN$p{PfC_9Up1A>A< z_L*FnxeaX%ujjEEuvC<-=#Kc0K4zw8w(NbK$MYk*UA^JKP?UC(c9w>G_BORQm0yTw z&Sv)2a2UAz5bX~wB;K=E)bCjPfZzsFh3GcZk-Cu>F-}n_kVcRe;3Mc9AMg^uGO+py z(#xTJ*{E-Dc{n|rH1<<-<(6f|qmJzkleNV)`M!d*Gwv>st$_|gSj5};_{+wbfUf|( z1!LQ*mM#m!Wt}CemeH2Cp=6OT|he=T~R;d zd;H4DUc3G!{OQ$@n3Q0p%K_RRA1qqwc^ z*{+8xUI#C{u=0%aa`O5wjL|%3nShwjD*Wun)GzT(a)Z9^C|!MEj5SUNC6Z@qW-4{4 z^hrI^qRxq!DmyNBDX(c6TVi!quY{adZks73ulQ5O@g|6NzS$^oHF9LRRhvs)PS;L3 za#os&TSnQUvSzltUV3dE;vT*`^m`R<&}A@H)8jOm53TP`={_s=fBCiWjgd`VnG@7c z#;K`E_p9#j0$(GCsv6gmT9E_0Pedn#M1)rjL^s8iiYP@bS6I>d6mZ_6f!cSzw9k1q z+HF1@)vBkw{i5qdL*aU1MwcRB`*Xou<@sfAtKW)WW$eUE&)>vPtBc_MAWL94f5nr(D^BB9 zQq)%QZSBMEm#7M-qB{5e{lMmQ2xheK=;X*wQSNvW0}f;rVuDUXAI(~rwZDp~eTbAa z^EO{s+U#7y{mz0ktJWNt7*3cNapOAHu`9Pe>NK(U%L6%h)*ME*r9@dPSrhd~r+0(J zhFBeGCHleh<2BVMi$U*+s;1W}++GvcdR}M^scsc}tpyP8TzdDQH-&FwT)Ef}kd zRb5?NM_wVBR-|a&>hI%UeLpYVTrT6RQP1}+M;A4;=d7#1r1ws82i2KQoiB}Vc(1RO z{T79~%F8g`1$)(d_#1cmYqX zt__Q-M)%U@Dx&40rMxmPe2--hAVo2FVANaNTZUUNQ`b&vbkZR*(ImAo=q*AxQCyV6 zN_m1J8xY8q_KEOksx9Dg*v9q%0l?;FB@)Oou;S5#9dO$c4?llj4ba#jlD5YHEN(=W z(d%j_bZ$t1I9ks!Ck8dY+)~=)XE$4N3raYcgQKJBN3j6R^qCnh$EOG}YggXVi! z193p{=@=r?>!l|m<0GOIKFe(vnEQN(WVGdUl7TDn&UYj3OQ^n*m8vR$>n_FzV1(EJ zux^umBltStX^rB5ey7DAW=D2Igw) zdX#uaHEN@y@2an=B4Gh@;5D;^nL~L!9h~ke0RSmaiM!AN>T1U9>0s{&m+%C#{#7Ay z7ysGjV`cuU#MKVSs;{cSEDLjiGK=sE^YXKT2$`9grCcnnB(&rd{(;}!0a@R;x;jbl z@p*W7@OlXG!d$HR1jNO~`S=C-1O<8SDtO>tj;>~&JdSX-ze)bXBL{_BxY#(k+Q1x{ z|L~fb!`xhftgL^8{`>p;Iia35|0+4c|2fv(0r~!9_ylE1_ZI3ANXk zvvIg<&z%NHNI*>LuloNl^RMFHNL@J8MHc382XqDf+uwh{|C{`OfqzLF{3|Ie_`iz( zllTWH#rNmn|I>)SyZqPgU7JCKQhfh?Wgx=K$R^D@+a#g=9pT~XBQNzT<3y;lte2?S_rl!Cnok~nihW*(^ zJ71&nGmzgL3YP3~_QJ7W9D!_XtT>&z%DDRG;d^^wefw6#hLxW@8UHmtW+v*xGwWoE zfUuu(3-5p0dzatiz@!L>cy20MAMxUh*!@qPDs1ehoGGi5CVtO156#~hO={R2nB~8F z>5}nPuz3jsCXac!W`!p1DDF@OSbxamS@=`u_mVs z4wSYh^%~xuAo2VfFZYY8kRb1^7(FJi=dJKf50MGb=#FEweco^2?NostU;RadHhJCEB^h$=YO)`xDAl`{dgh1t6|#1A zOk^V7+lyJ95{Ka@%1Zr3udtlu`eOGiB>F>b0t;;Afa%QFt%fwnB5un6J4F~>soD%T zJVWAgVGarPv)A*%e0NM@y-z}H2nv)$_tzh$4}Ss(nWwwmP7GCd?Wb4VHe*oXb_U(J zo*`nmaS1u7)g!DwLaNfjf?(R>-ph9}+Z^%<0T0l?;n)X3#`OHk15^eA(d06k;zK$LWrO(#_BUeG@DZmBr*(j?%_G~VqH z{Z20=b&T;^j7PSYf}-WycmcxhbmoTV=0gA*uTI+HQ}q~qd$GYh#OdvPyHK8&-`Dw- z&!W$WilHHTr@<_9-PIecgn~}Y@iQiF_`lN08VVs!_ z$ct|$1IZ*6tR+|05Xr2r=FMcx~{iB74bWFj?}GaY2)Sy3CrIPXd{Czc04FY(3KdssaR3 z+H|HQ1N&=cGZ_Idr?wf4$x<^S6q@U^^Nx&fFE3+0)y8v@e#)z*_P2j@{M{l-3e9a_ zJYf_!nPoEDqH(g6ZLzO=|D6PA$iNHHKhcY>_{3OtUXt_Mq3PTD^wh!D)bot$UN5q} ziW}|&Go-xDc=7@p#I2Zfewd_Df-7cub3}A`4BF?lr|Y%SQreYILAz{53@YYvAx-xx zafzz5bm6|Xjat{=@|`&LR;!|1O;%e?<`cS*Xq6(06WFEg_6YEA!n^w2e4U#qd94u_ zkzx|&6--7OHq22=REz)f8{>9`Z~FTf6RML=HjfiB`i>1u>r0-4+Fi$D&XOCIlqSIjF3cczCN_sk@7ui0=q6tR#M=V z3W~aI#UP;{f_iMmQUoDJ20u)Eckpsm{8ytg5_ZsANCQ!mBz2 zZR^qkbRE~|@vvdId4nAL4Zw2HyVo)We_KHP*QWVW(xL?Jn+=wLj|-eO>_6q2WX*+8 z(HFUt`&krBD%dy5kzeSi+kQPTC!Pht)t_@qyNx{6Kgwn7pddOG7qDYO7~-c^4T=!!#NG$3#&p)ffg3rC zttrWE-ibbpRJSXYVtWGYa4QZYP_Uw zKfb{vS}z=0R?(Rkj1wroW}YWyM|j_FKt_l~qe1k0?dGzVa1y%SDv*aB>!#D1C5Lo( zb(Jy0$Epy53WW$#9#D0)2Bpcr%lI^%F?Y=4HKblLxoNn$1fqVEUeKQsApz+du6hOQ zm=lIlw7Fll!wbCl=d$vGDQX9JyY|Q~aK@9h_}p?gVf5vyn^b9wRk8S1cyJOuqmOVtuvf9xtH^su zkIr-!TdUFoZ0}9eWB$694Fj_&x4C02+Fw?*Gz0F&kPguf{JyK=J}0TJWrQ}64%2Nb ze!cfeqFO!GD+WzfzrSpEDNj1K*qgN6{tQ?<$&XZ8(;(<+!^L9pIkK7ID&k6e7lz?Mdmk#bdupG1D?$&yF0n$xM zwKXI+!&_Bil6KR|4RBl)2gAJ+q%|I6^i>@@2QH{ZiMz+SY&M>FyQp;js6fQnqN)FE z?((?%Hj%+X1h*vr(!0#CecbW;CNPAlMcKkB9#9}6ck}e6-OB0V$b=DO(lQ?`rH86N zjg_Ugo9S)bH0SvWcJu8PaxYW&%#1=rG%QL2{a>{61V6&+#Cv?5`K$o?`+T-BB=x!++;za5&}7u%c+K<0O)k9q4F$G-i+eNlB)xHf zzaA=gZzxvYh97pRI6VmVu)~PkG`>oaESbvRjmWQb$bEKPWxn3MNiI*j7_UN z&2v#?Au@MaCqHjK+w_bv?thq_eJJixTmU}EZnREiuN?@DwWjmg z(iYG^OjSsv$E49Qx6fN#M0DTIoJ4)u+yh$g8rH-v+ugjZA2lv2w|$yvV5zLHb8VM7 zm`-Au$Jhxby7@*>S7s%se*Vknay0+Rx#!6bF^?kS1#gr1OuBceT&O;uWosk06t=ah z0rO#5T7SZPq6Rv%8NXiBh5fH^Y;)PqHtbAw!cAk(;Op$@66t+%rZ^v5&v-NL7Hu&1 zd$eCyPVpG<^eA(eB~z|x>796o_}&2?2pkQUZzQr*75K)Dp4u^!jjq~MrJu`&7>!DjP>G^)asv(TwdZneJNvJMz zF`_{L#OjljkV{^*6gytvVu&ob<;;3K_9U*qK4=%I5U9S;^ZQx9586AFHykHJqP^OE z!H(Qr&?#=6SMve~93L-r&K%<|1Ui02)1|pxq@90c9J_208NL2dJDDhVin{Sw09xNZ zPiJyM%jjbz6{hcDnvQbWlG#ew^A+xuA+jQ!F8BYF^qPH>pV6d~O7M zco{&pCMgyZ{)nbZ4ZHy%CH{G@o+l6@S>(0FzW!6{C;>ia%`ihDRuKdqo9N&>HkCEb zm>i*%&D;udb`6iP%Q$$k^hK&}CfDbq8Dp()Q1OvnrkF^*PB<39^S;?rggH_*IN5;V z-jR=@X@Q2i$`Sa_sBDEj(NSFcE!eM2@Nh$mo-x_!muZzN#BNbo;^fEq`o!Jj&9C4; zyfAkbljk)mSx;GgjELDzTT+nIJ}wvth4rc4P2&#O=ansb)?qL`WhDE`LnDvOV}%#6 zBL-EnR}#PD3dxL_#M-7Kha(+Wos6*20w1t&@j?g13V15llwd@!ZdXsz<*~#eAf6#d&P|7u$B~z@uR{N~7>-znj%r?eFZ1aFffW+~{eBc9Wal z`r$^X&ux^6F(JE9U)aw@{25dY{3Hlg=Xxpgp&1KoyfU9^+`h1D0z+CHi*^hxOaxTF zV7JcLm$NYD#2lCPuV^)qV>n>s1E#3*4JM!cX-g5rv|+gRN4*P pha>RLd(2)^_5(QYoQm86`1C+hQo(5R$sZf6B(Ek{{M#K(dnUn0D+4jzhr!g4E1ACAoQUkr-U-Le zdZ+E`t?w(Ba`&!ZrLMEczOh(0Kr7S0q;DN#TieC02QFyrQj?H!xz5(Cv@5@f>oNoL zoS>iT*%?44(_w?C6du`G3l1$g_`9?A>q7Z(<$w7=naOPTH%eLE3d?eQqVzC(a{jWA zD_hoX?G7v2@Kq+qmOc9X!E426%)LS%;tKwSZ4z9#Y$dDe13im+jUCfMz6*&+z>% literal 0 HcmV?d00001 diff --git a/ssvc-calc/icons8-copy-link-48.png b/ssvc-calc/icons8-copy-link-48.png new file mode 100644 index 0000000000000000000000000000000000000000..0b62abe5af831c55e077831f0bd4e6cd69d6cdda GIT binary patch literal 552 zcmV+@0@wYCP)7ogaZpz;&|R12SGcCw6`WDgoDVDewghfi6%FTMrn8eH$kbEvG~!R0Jp%a0e)b(mb0694!j$-k5Mm>P2epBzKx?Y zs;kYZkkIftP1H!3;2Wqv!E}DB0YVYonWPN(KLVS4 q`!D5RD3I#gs8`u}fhtx0dwv0 - CERT/CC Demo Server - Dryad SSVC Calc App + Dryad SSVC Calc App - - + + - CERT Logo

- CMU Logo

diff --git a/ssvc-calc/moon_icon.png b/ssvc-calc/moon_icon.png new file mode 100644 index 0000000000000000000000000000000000000000..b5678f7154a97c157b24926b16e3ae022bd03aa2 GIT binary patch literal 4010 zcmZ{nMOf5f*N6W!1A-taAR!F`LkuO&&@wQDbPhue3eur;hk|rDh#(*cC|#m-r*t<% zhjhKXi+AxYzQxJwxv#VMEzWtOv|%bFM07*|0FbDuLUryV_}&Bvaqj&`)4D4FAR2N| zRMd7rAOJu$Dmj%vFR`1tbK`1+o{ua#Nn0@$25^6lc&bVO2dOcCZi^>_wuMLX)>7+1 z%S$%DMFu1BZ1^JaW^yO5@Qo<{di=0d?Dr2+nVj>Q_uH6r<2ZgUCS3EvcHn{lP#0Hu zHV^^ms_wg+(i!Vv$_C|nH=^5%bq3m_L9j-uE5E*YcIb5dbys9@DQQ#=72j3 z&6v(qSFFGh@_|*gx(h$G3G z5vWJY!DL@?0y*8pKRN+jr;%v$wtnU1_+)AEC~pPwmVCmiH+T$;EuG}mgM;YeRr%2G z2`AP7R~H7bUAM5dz2o!$$|Dnz_UM`UoI9>(43iFR$&i*$~|H% z=!?i&n47Ij;GsssKBQZ+I5%>z6Wc6BQS>F_=WBvLP%sotXNpNX23LfBcGAyM@NB_7 z&SyEKc$Q9I(38v#vepEv2&JS(mYb$z79J6wJLz9Pl2=)hZVelW}#`jPDUh zXfN8@h-ty*JP!ZnJD7T#Z^2?xRihnGR=SlfY$R*ZmJ!RX2_NfNA&7WUs;2jyh6ewe zYt*r|{`Q5B6;E>|mw8nUSzT75A41ir9v z#>bUc5kJvUP@!b1;#VJ&7()#7)I9fpGC$HW&jxJ}!I->x2;5PJDZFtSp?OL2n`O0> zg6YL2Z5>bu0&2_Cc@rt)u7-LZJ~-Mg!g-bRFg8e{9G~+7G;J6& zApxA3C+}gpTuS_tRct{PSuWh@;N=`WE}WilX#4}7uoQWHZHOMhZXn%f#Ua5>5qI*f zus!*ALuCK(FCTod6e=O1|MT)dFAY?&s49;23D2$-&jn;kS{9C4!uOV)B|?V_wANTk zTw^oJV^M;X6w`AVv|s3v@!%(i_b8}o$7m-P(&^!Rdps7jr93Cs4Htl;hYUriG*zDG zyc=5Dgo@CZ1)7JNhm|VsE7jx<<~rwG4Yh7M(-L)%AtDYt$_2U8ocg3*;C;ofpm(Em zBXuJd4)poZZtY-*KTbjaUbB7OlE%`&s>a%+JbTjIN!AlLq7}2UHgp)dxJ~-+@R3O!KTCaW>HyIaCdsG>0 z;d*Fzq+B|kJUXE}Vcjwqvv4F6DG>=45vPk0*@C=xm>s4a&U2JRb=a??N=If3eBf@{ z#0AKFs@(Qbo{8xq59MNXbZ&-jNTKPL&=&ue#8#l_%goRH;{(H`BQiO2U!+UEBEGO)Ntxyvo1TdT`c!0^d+flRa#5-V(KSvz_V zy%d@71D=*JXoifn@z#V*hk6~E1x0l(+l;#>;GJSB^eKQNJLePt!MB#ZNKI%|6bGN zNHF6w3EHimKAA@BH0>yzlAL-mbdf%bcpAYGA)}IkNJ69|GFOU=sC7rbmS#>%pJXOB z=zbdIFCZ8&9v~k;4m=rfHgz(q}IkZ2eJ*qtDJD6Sei74uiMV4BdAGCPm`SP7g?wxecv^ES~m7g)mkjm7_T)o9F z5d3;ru$wWyk6Q0NoLk~O`*MXmzggrw6Fb>B7dw{)fgdj7?T~tR{IpstKdmswlf+ZU z{($dKctmPU`}c7y5h-!$gFVnNk=lbIVjl)a>WnATl#&eVjMdB~!VDCQkALxBlg>o; zBgKA3uu8E~D`&;AsdT7}E6GItjQa@nfVK{k4{v{Ag4Ja4XUtRMSWgOWBN*F-tck4y zJ_TiyKmX$2F)F@MJ5syn?RcGa{_b#}0-Iu-O-i*Amc;JKUc{Nt3E_CBN(w85r4+o- zG)i-o7-QB?oBkB8p`kvLEh;2zv)+-8gW1DSVQTCIZK($9#b+!%=XWUF{%*LeGj#v9 zVYA!mJ#UFx5^+%$no2hjil~#H)tsei1m^MQ$re&A`U6tdGWD||X}g(CGJdLy0)^y_ zl=z_S&@#6cx9W|zU2)xWiN#$S1E}uK4ZBq)3Wq3HCA$r}LB3Bjywwy2k!yJKc=W{K z>QPeTfWqmc-&91iQw>SAB3>8)Bn&x*+)rT_*ya-BvCx@s zmU8mZ4KohQTOJ@nQ_VCh25?@N+U0Ne^z%0BAMpt2OX!d3y)$Yz^T7CR?4z0uN(PMQ zDmoDT)m4*Kxm7h27iBXh-;K<4=9*=E-)-YxhWC){iw;bA|LFK`d&RNLF~#BYO7GQ` zZA?E(ETD+u@7%YCCC*dUwaB%UhbBHIWzNKtL|#g8}WrC$(Dm&6hW`+&<^6hZLAO0nl6 z`}Uu!^q$}nAPLY+J>u?HE~`tWtbMHgvPQR+Yg{MxNZ!Aa%^tOyLmbXpulA*>-;@-$ z7OZRzzL(vXclgi&&Xx9KI{5_!s?1JnXMNjmdWJ1#10<$bhDUwJjvcQcWvC}jqrO_^ zXU+bX$_H`BVpC!Q3mN{!XP(Qu4PGPrUHeCSr1QNEXP5rNH^T%PjMj`VWk$U9jwcV^ zw3dlBS9eLTa$W{sl}beg9Oa;A?v}+c&KCGRXq`{vQo=st;+sO=Z@Jtzr;pPI3Ctrc zVtw+D%vimnXp6WG>1tCREX74e{3G{i8>Ayw{89V{}bCJt~M-^~3#%%ZyOf(F6cr4gd%Y1%S)@R^TQ8c-$YsTb2MInFatf zE?M<(DFDFgyy1u>+jLDLLIb`MkT;JT8Us`7p z(pJ=U@{h_WuldtAG%-HCFgh{U(m8l@d;6oNg-gl?+?3s*-oqN>9#bxrR z?`)!abbK$QH0{nWF4I1j@k$#j>pOS#{jL4grEcWP3ej`)jG38VS>N1F$S9K4a@4W% zF0J}~FU86lrm(ExweNdX0~cYaCCtpjFFdXOclZ9`@%7Ek-oeq_!s_7YRPW%#;>yO+ z@jtJKdg#60Sk@XUP^>#_zWMtC<@W1 z@ja8L29?)S?L=5IQ-MDcDnsJSf}+yHlH&|X9_%n=na)ZzzP*MzkdaY7q9&)JqM}HR zXHyPIs*Eix$!cuO3eJ6mLr#~ZZ-ZP5l7qd}kE7KpMn!f9{q03Ls*zKuPfKQ4t{v6; zZnfbS{|cgoHZ^{YXCbGHjn!n{OGp)lAlMW_>cTksur+wCMGR-;_~L1*AWs!SvYWW{ znzBMzS;^_Lvdk>$+|8nfb8Lv*60&0G1?gs`E$LR3q@xZ)Xl4hGtmkE*_6H{+sG;OT zPK6L7z%(RFgBiz)WJmrdnB?f^AC^!E_&B-+()BzvocymPB|ouOVq=yml#PWX7CuZU z*4^9P+4g9JjAoxXBCnN&MG(}C-(h2T8-%Z~?r7|*Z2Pi0fRvOZw$4ZOJ+{%)6bo%b z8y(YNjSwq`$I+zm8&o~KeX%YMmL(v zNEtE&#R0~tO)qVL|4WucIJ@|`I@sB}1B(C4nB`quoRG|F zuMzyunEyL@wX!+uo}u|4V}o=PF6lN^vSjNPXIL~7_?NuGWb7w CDS)p4 literal 0 HcmV?d00001 diff --git a/ssvc-calc/ssvc.js b/ssvc-calc/ssvc.js index e125101c..268607d4 100644 --- a/ssvc-calc/ssvc.js +++ b/ssvc-calc/ssvc.js @@ -16,7 +16,7 @@ var current_score = []; var current_tree = "CISA-Coordinator-v2.0.3.json"; var roll_tree_map = {"CISA-Coordinator" : "CISA-Coordinator-v2.0.3.json", "Supplier": "Supplier-v2.0.0.json", - "Deployer": "Deployer-v2.0.0.json", + "Deployer": "Deployer-v2.1.0.json", "Coordinator-Publish": "Coordinator-Publish-v2.0.0.json", "Coordinator-Triage": "Coordinator-Triage-v2.0.0.json" }; From c670bbc0449f8fbf99e6f9757789206ad0481620 Mon Sep 17 00:00:00 2001 From: Jeroen Date: Wed, 28 Jun 2023 19:11:58 +0200 Subject: [PATCH 5/9] Two small typo fixes (#253) --- doc/md_src_files/040_stakeholders-scope.md | 2 +- doc/md_src_files/080_workedExample.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/md_src_files/040_stakeholders-scope.md b/doc/md_src_files/040_stakeholders-scope.md index d3e0f301..a0171421 100644 --- a/doc/md_src_files/040_stakeholders-scope.md +++ b/doc/md_src_files/040_stakeholders-scope.md @@ -150,7 +150,7 @@ The [*Mission Impact*](#mission-impact) could be increased when a disaster recov A mitigation that successfully changes the value of a decision point may shift the priority of further action to a reduced state. If applying a mitigation reduces the priority to *defer*, the deployer may not need to apply a remediation, if later, it becomes available. Table 3 displays the action priorities for the deployer, which are similar to the supplier case. In a later section, the different types of impacts are defined and then implemented in the decision trees as examples of how the various impacts affect the priority. -For now, assume the decision points are ordered as: [*Exploitation*](#exploitation); [*Exposure*](#exposure); [*Utility*](#utility); and *Human Impact*](#human-impact). +For now, assume the decision points are ordered as: [*Exploitation*](#exploitation); [*Exposure*](#exposure); [*Utility*](#utility); and [*Human Impact*](#human-impact). In this order, an [_active_](#exploitation) state of [*Exploitation*](#exploitation) will never result in a *defer* priority. A [_none_](#exploitation) state of [*Exploitation*](#exploitation) (no evidence of exploitation) will result in either *defer* or *scheduled* priority—unless the state of [*Human Impact*](#human-impact) is [_very high_](#human-impact), resulting in an *out-of-cycle* priority. diff --git a/doc/md_src_files/080_workedExample.md b/doc/md_src_files/080_workedExample.md index 01213665..3e5c5b53 100644 --- a/doc/md_src_files/080_workedExample.md +++ b/doc/md_src_files/080_workedExample.md @@ -23,7 +23,7 @@ However, since most of the hospital’s clients have not installed the app, and According to the fictional pilot scenario, “Our mission dictates that the first and foremost priority is to contribute to human welfare and to uphold the Hippocratic oath (do no harm).” The continuity of operations planning for a hospital is complex, with many MEFs. However, even from this abstract, it seems clear that “do no harm” is at risk due to this vulnerability. A mission essential function to that mission is each of the various medical devices works as expected, or at least if a device fails, it cannot actively be used to inflict harm. Unsolicited insulin delivery would mean that MEF “fails for a period of time longer than acceptable,” matching the description of MEF failure. The question is then whether the whole mission fails, which does not seem to be the case. The recovery of MEF functioning is not affected, and most MEFs (the emergency services, surgery, oncology, administration, etc.) would be unaffected. Therefore, we select [*MEF failure*](#mission-impact) and move on to ask about safety impact. This particular pilot study used SSVC version 1. -In the suggested deployer tree for SSVC version 2.1, mission and safety impact would be used to calculate the overall [*Human Impact*](#human-impat), and [*Automatable*](#automatable) would need to be answered as well. +In the suggested deployer tree for SSVC version 2.1, mission and safety impact would be used to calculate the overall [*Human Impact*](#human-impact), and [*Automatable*](#automatable) would need to be answered as well. Conducting further studies with the recommended version 2.1 Deployer tree remains an area of future work. In the pilot study, this information is conveyed as follows: From 863561b7bce6caa743d50e360fd97db406a1767a Mon Sep 17 00:00:00 2001 From: j--- Date: Wed, 28 Jun 2023 13:25:14 -0400 Subject: [PATCH 6/9] Update 055_decision-points_2.md (#250) Improve text description for Mission Impact. --- doc/md_src_files/055_decision-points_2.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/doc/md_src_files/055_decision-points_2.md b/doc/md_src_files/055_decision-points_2.md index ceb48c59..e65566ef 100644 --- a/doc/md_src_files/055_decision-points_2.md +++ b/doc/md_src_files/055_decision-points_2.md @@ -240,7 +240,11 @@ We defer this topic for now because we combine it with [*Mission Impact*](#missi ## Mission Impact > Impact on Mission Essential Functions of the Organization -A **mission essential function (MEF)** is a function “directly related to accomplishing the organization’s mission as set forth in its statutory or executive charter” [@FCD2_2017, page A-1]. Identifying MEFs is part of business continuity planning or crisis planning. The rough difference between MEFs and non-essential functions is that an organization “must perform a\[n MEF\] during a disruption to normal operations” [@FCD2_2017, page B-2]. The mission is the reason an organization exists, and MEFs are how that mission is affected. Non-essential functions do not directly support the mission per se; however, they support the smooth delivery or success of MEFs. Financial losses—especially to publicly traded for-profit corporations—are covered here as a (legally mandated) mission of such corporations is financial performance. +A **mission essential function (MEF)** is a function “directly related to accomplishing the organization’s mission as set forth in its statutory or executive charter” [@FCD2_2017, page A-1]. Identification and prioritization of mission essential functions enables effective continuity planning or crisis planning. Mission Essential Functions are in effect critical activities within an organization that are used to identify key assets, supporting tasks, and resources that an organization requires to remain operational in a crises situation, and so must be included in its planning process. During an event, key resources may be limited and personnel may be unavailable, so organizations must consider these factors and validate assumptions when identifying, validating, and prioritizing MEFs. + +When reviewing the list of organizational functions, an organization must first identify whether a function is essential or non-essential. The distinction between these two categories is whether or not an organization must perform a function during a disruption to normal operations and must continue performance during emergencies [@FCD2_2017, page B-2]. Essential functions are both important and urgent. Functions that can be deferred until after an emergency are identified as non-essential. + +As mission essential functions are most clearly defined for government agencies, stakeholders in other sectors may be familiar with different terms of art from continuity planning. For example, infrastructure providers in the US may better align with [National Critical Functions](https://www.cisa.gov/national-critical-functions). Private sector businesses may better align with [operational and financial impacts](https://www.ready.gov/sites/default/files/2020-03/business-impact-analysis-worksheet.pdf) in a [business continuity plan](https://www.ready.gov/business-continuity-plan). While the processes, terminology, and audience for these different frameworks differ, they all can provide a sense of the criticality of an asset or assets within the scope of the stakeholder conducting the cyber vulnerability prioritization with SSVC. In that sense they all function quite similarly within SSVC. Organizations should use whatever is most appropriate for their stakeholder context, with Mission Essential Function analysis serving as a fully worked example in the SSVC documents. Table: Mission Impact Decision Values From 859a3322cdec7d9f13ebfb2ee81ad98785baabd1 Mon Sep 17 00:00:00 2001 From: "Allen D. Householder" Date: Wed, 28 Jun 2023 13:31:35 -0400 Subject: [PATCH 7/9] Update link to SSVC_Computed.schema.json --- ssvc-calc/SSVC_Computed.schema.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ssvc-calc/SSVC_Computed.schema.json b/ssvc-calc/SSVC_Computed.schema.json index d5035868..a21f8bf8 120000 --- a/ssvc-calc/SSVC_Computed.schema.json +++ b/ssvc-calc/SSVC_Computed.schema.json @@ -1 +1 @@ -../data/schema/SSVC_Computed_v2.03.schema.json \ No newline at end of file +../data/schema/SSVC_Computed.schema.json From e2c085edaedbea1610400360ed3581a905d4af73 Mon Sep 17 00:00:00 2001 From: "Allen D. Householder" Date: Wed, 28 Jun 2023 13:31:53 -0400 Subject: [PATCH 8/9] Update link to SSVC_Provision.schema.json --- ssvc-calc/SSVC_Provision.schema.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ssvc-calc/SSVC_Provision.schema.json b/ssvc-calc/SSVC_Provision.schema.json index 91b7f6e4..e2703b2f 120000 --- a/ssvc-calc/SSVC_Provision.schema.json +++ b/ssvc-calc/SSVC_Provision.schema.json @@ -1 +1 @@ -../data/schema/SSVC_Provision_v2.03.schema.json \ No newline at end of file +../data/schema/SSVC_Provision.schema.json From 5da2fc5ecaa7b0d04879b2555cd4780920290734 Mon Sep 17 00:00:00 2001 From: "Allen D. Householder" Date: Wed, 28 Jun 2023 13:54:07 -0400 Subject: [PATCH 9/9] add subsubsection header for tree versioning --- doc/md_src_files/060_decision-trees.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/doc/md_src_files/060_decision-trees.md b/doc/md_src_files/060_decision-trees.md index 1ea6d5fd..a9eadb73 100644 --- a/doc/md_src_files/060_decision-trees.md +++ b/doc/md_src_files/060_decision-trees.md @@ -9,7 +9,7 @@ The definition of choices can take a logical form, such as: - ([*Human Impact*](#human-impact) IS [medium](#human-impact)) - THEN priority is *scheduled*. -This logical statement is captured in line 35 of the deployer .csv file. +This logical statement is captured in line 35 of the deployer `.csv` file. There are different formats for capturing these prioritization decisions depending on how and where they are going to be used. In this paper, we primarily represent a full set of guidance on how one stakeholder will make a decision as a **decision tree**. @@ -126,11 +126,12 @@ To that end, we briefly examine the qualities for which decision tree measuremen ### Decision Tree Construction Concerns -Decision tree construction methods must address four significant concerns: +Decision tree construction methods must address five significant concerns: - feature selection - feature type - overfitting - parsimony +- versioning #### Feature selection @@ -184,6 +185,8 @@ This sort of customization is often the simplest way to adjust the importance of While there is no hard and fast rule for when a tree is too big, we suggest that if all of your outcomes are associated with more than 15 situations (unique combinations of decision values), you would benefit from asking whether your analysts actually use all the information they would be gathering. Thus, 60 unique combinations of decision values is the point at which a decision tree with four distinct outcomes is, on average, potentially too big. +#### Tree Versioning + SSVC trees should be identifiable by name and version. A tree name is simply a short descriptive label for the tree derived from the stakeholder and/or function the tree is intended for. Tree versions are expected to share the major and minor version numbers with the SSVC version in which their decision points are defined. Revisions should increment the patch number. For example: “Applier Tree v1.1.0” would be the identity of the version of the Applier Tree as published in version 1.1 of SSVC. “Coordinator Publish Tree v2.0.3” would be the identity of a future revision of the Coordinator Publish Tree as described in this document. The terms “major”, “minor”, and “patch” with respect to version numbering are intended to be consistent with [Semantic Versioning 2.0.0](https://semver.org/spec/v2.0.0.html).