Introducing the NSA-Proof Crypto-Font

Daniel_Stuckey writes "At a moment when governments and corporations alike are hellbent on snooping through your personal digital messages, it'd sure be nice if there was a font their dragnets couldn't decipher. So Sang Mun built one. Sang, a recent graduate from the Rhode Island Schoold of Design, has unleashed ZXX — a 'disruptive typeface' that he says is much more difficult to the NSA and friends to decrypt. He's made it free to download on his website, too. 'The project started with a genuine question: How can we conceal our fundamental thoughts from artificial intelligences and those who deploy them?' he writes. 'I decided to create a typeface that would be unreadable by text scanning software (whether used by a government agency or a lone hacker) — misdirecting information or sometimes not giving any at all. It can be applied to huge amounts of data, or to personal correspondence.' He named it after the Library of Congress's labeling code ZXX, which archivists employ when they find a book that contains 'no linguistic content.'"

Comments

Familiar with image recognition at all?

[Anonymous Coward]

Undecipherable my ass.

Re:Familiar with image recognition at all?

[geoskd]

Undecipherable my ass.

He's from a school of design, give him a little slack for not understanding how computers work...

Re:Familiar with image recognition at all?

[GameboyRMH]

I want to know why he thinks the NSA prints out each webpage and email and then runs it through OCR.

???

Re:Familiar with image recognition at all?

[paiute]

This just in: Slashdot announced that Anonymous Coward's contract would not be renewed for next year.

Re:Familiar with image recognition at all?

[icebike]

He's from a school of design, give him a little slack for not understanding how computers work...

No doubt he uses that font for all his email, having recently switched from comic sans.

Re:Familiar with image recognition at all?

[Mitchell314]

Even if the image recognition software wasn't adaptive (which I know at least some are), an image document with this font would scream red flag. A document with lots of text but low correspondence to common latin fonts?

Re:Familiar with image recognition at all?

[Anonymous Coward]

This is the first submission I have modded down since the ability to vote down submissions. I tend to vote and mod positively. Who in their right might voted this story up? Speak up so we may mock you.

Re:Familiar with image recognition at all?

[ObsessiveMathsFreak]

Meanwhile geeks, who do understand how computers work, instead of developing technologies supporting encryption and pricacy by default, have instead hopped into bed with big data and the NSA. There are more geeks helping the NSA builds a Stasi apperatus than there are geeks working on building a truely anonymous and untappable internet.

The more I think back to the likes of the whole Firefox self signed certs debacle, the more I see the NSA survellance apperatus collectively roaring with laughter at geekdom's heedless self-destruction of itself and the internet.

Re:Familiar with image recognition at all?

[Instine]

It's actually very difficult for the text to be read and filtered by a computer using this form of obfuscation, as long as there are enough variants of each letter, and they are well randomised throughout the content. However, you don't actually need a special font: http://www.tienhuis.nl/utf8-generator

Re:Familiar with image recognition at all?

[Anonymous Coward]

I want to know why he thinks the NSA prints out each webpage and email and then runs it through OCR.

???

This is government we're talking about here. It's a kickback to the paper, printer, and scanner companies who contributed so much to some campaigns during the last election cycle!

Re:Familiar with image recognition at all?

[fuzzyfuzzyfungus]

Undecipherable my ass.

More importantly, it's not as though the NSA reads your email by printing it out and sending it off for OCR... Font doesn't mean much if you have the document in any remotely sane digital format.

Re:Familiar with image recognition at all?

[pjbgravely]

I don't think the creater understands that fonts aren't sent to a recipient, only the Unicode. To make this work you would have to write it, turn the paper into a photo and send that. The parents idea or 1337 would be less work.

Re:Familiar with image recognition at all?

[Anonymous Coward]

Undecipherable my ass.

More importantly, it's not as though the NSA reads your email by printing it out and sending it off for OCR... Font doesn't mean much if you have the document in any remotely sane digital format.

Speaking from experience as the copier repair guy, government agencies do in fact print stuff out so they can scan it - all the time.

Re:Familiar with image recognition at all?

[loosescrews]

I tested a couple of the more human-readable variants with the OCR built into Adobe Acrobat, and Acrobat did really well. The normal Sans and Bold variants were recognized with nearly 100% accuracy, so I am unsure why they are even included. There were only a few letters in the noise variant that it consistently got wrong, but it got them wrong in a consistent manor (e.g. i turned into !), so some simple find and replace could get you a reasonably readable document. After that I got bored and I didn't try any of the other variants.

The only use I can think of for this might be using it in conjunction with a cipher. A cipher could break the word recondition in OCR software and would also make humans less sure that they were reading the correct letters. Either way, the utility of this font is very limited.

I am sure that the NSA has better OCR than what is built into Adobe Acrobat.

Re:Familiar with image recognition at all?

[Anonymous Coward]

TFA explains all. It's only undecipherable to the OCR software that he tried, he's well aware that it won't remain undecipherable for long, and he sees it as an exercise in awareness rather than security.

Re:Familiar with image recognition at all?

[Yvanhoe]

Ok, now you are getting me angry.

Geeks have been very vocal about wiretapping issues for a LONG time. Does ECHELON ring any bell? Geeks have created institutions like the EFF, tools like Tor, GPG, darknets, bittorrent, bitcoin. It is true that few people use them, and it is true as well that they allow a truly anonymous internet that escapes even NSA surveillance. I refuse that because you are too lazy to get an interest in these free tools you pretend that these problems are met with indifference in the tech community. Reality could not be further from the truth.

People making most of these tools did this for free. When was the last time you did spend money in order to protect your privacy or anonymity? The market of surveillance is several dozens of billions of dollars yearly. The market of consumer counter-surveillance is almost inexistent. Yet, effective tools that are very easy to use exist. Don't forget to thank the geeks that have known for decades that the NSA was spying on you, found it immoral and spent years working gratis to provide you for free an excellent tool.

Geeks employed at several levels at ISP do all that they can to keep internet free and neutral. The fact that regular internet is quite free (compared for instance with what you usuall get on your 3G smartphone) is due in large part because geeks in their majority have a strong ethical sense and know the value of openness. Snowden and Assange are geeks, but if you look at the HBGary leaks, you will see that developpers strongly opposed some policies. Whistleblowers about surveillance are almost always geeks involved in the infrastructure. Never legislators, managers, officiers, who know as well the extent of the surveillance.

Re:Familiar with image recognition at all?

[OneAhead]

You're greatly underestimating what computers - and the cryptographers who program them - are capable of / up against. Defeating something like this UTF-8 generator is peanuts.

Re:Familiar with image recognition at all?

[OneAhead]

Ignoring the obvious problem that text is usually not sent over internet as an image, if you're gonna use a cypher anyway, you might just as well spare yourself the effort of using an obnoxious font by choosing a cypher that is (probably) impossible for the NSA to crack in a reasonable amount of time. It's really not rocket science. There are some good ones implemented in gpg, among many others.

Re:Familiar with image recognition at all?

[OneAhead]

I see it as an excercise in misinformation rather than awareness. If this catches on, a lot of "joe sixpacks" will be led to believe that a font can somehow make an electronic document less easy to decypher, rather than exploring options that are actually pretty safe, such as gpg. [lame pgp reference intended - hur hur hur]

Re:Familiar with image recognition at all?

[SoCalChris]

I've got a client that's a non-profit group home for abused kids. Because of what they do, and their funding sources, they have to send daily activity reports for each of the kids, including medical, psychological, behavior, school notes, etc...

Every day, the reports are hand written on to forms, which are then typed into a computer, which are then printed, which are then faxed to the county (Typically 75-100 pages of fax each day), which is then entered into the county's computers, which is then printed out and filed.

Between the original handwritten report, printed copy of the entered report, received fax, and county copy, multiplied by around 100 pages per day amounts to almost 150,000 pages created every year for something that could very easily be done almost entirely electronically.

Re:Familiar with image recognition at all?

[CodeBuster]

Meanwhile geeks, who do understand how computers work, instead of developing technologies supporting encryption and pricacy by default, have instead hopped into bed with big data and the NSA

Security is not something that you can simply buy as a product and then forget about. The tools are freely available, but they don't work well or even much at all unless you know how to use them. The Edward Snowden affair and his attempts to communicate securely with journalists via email serves to highlight the difficulties encountered by normal people attempting to install and use these tools. To some extent this is inevitable because good security requires knowledge of cryptographic procedures and strict observance of key handling protocols that most people outside of tech or intelligence circles would find to be esoteric at best and most probably incomprehensible.

There are more geeks helping the NSA builds a Stasi apperatus than there are geeks working on building a truely anonymous and untappable internet.

I'm not aware of any practical method of two-way communication that isn't subject to eavesdropping given enough resources. You can make yourself more difficult to follow, but as a practical matter if they want to listen in they will find a way to do so.

the more I see the NSA survellance apperatus collectively roaring with laughter at geekdom's heedless self-destruction of itself and the internet.

The people who work for the NSA have families and children too. Some of them might even be your neighbors. Surely your concerns aren't entirely separate from theirs on these matters? If they can listen to any of us then they can listen to all of us. Even Senators and Congressmen understand this much and it's no laughing matter.

Re:Familiar with image recognition at all?

[WaywardGeek]

The tools for private communication are there, and geeks like me contribute what we can (not that much in my case). Instead of saying "it's not rocket science", we should say, "it's not crypto." This stuff is hard, which is why it's fun.

His statement that there is no practical way to safeguard privacy is true to a point. No one in the world is going to decrypt my one-time-pad encrypted email that I encrypt on a machine not connected to the Internet, transfer by USB stick, and email as an attachment. Instead, if anyone really cares, they'll just get my data the old fashioned way. It's really a matter of how much money the eavesdropper is willing to spend. Anything over I'm guessing maybe $100,000, and they just hire an expert to bug my house, car, cell phone, clothing, have an affair with my wife and run dog. If we care to, and have at least a small clue, we can encrypt whatever we want securely. At least if no one really cares to know what we're encrypting.

I agree with Google, Microsoft, and friends. We should let our service providers be honest with us, and have a public debate about privacy vs. security.
I don't have any secrets. Not one. Now that doesn't mean I post all my passwords on my blog,

Re:Familiar with image recognition at all?

[thegarbz]

Irrelevant. If the font were sent as a photograph of a printed copy all the NSA would have to do would be download his freely available font and add it to an OCR engine.

Re:Familiar with image recognition at all?

[thegarbz]

Just don't tell the NSA where to download the font or they may be able to teach Mr OCR how to read it.

Re:Familiar with image recognition at all?

[fa2k]

It's actually very difficult for the text to be read and filtered by a computer using this form of obfuscation, as long as there are enough variants of each letter, and they are well randomised throughout the content. However, you don't actually need a special font:
http://www.tienhuis.nl/utf8-generator

It's like a keyless cipher that's just a character mapping (with random selection of character). If anyone used the font for something serious, the NSA could construct the inverse mapping in days manually. In fact, if the font is to be effective, the forward mapping has to be implemented in software, i.e. a program to convert normal text to "encrypted" text, and NSA could use that software to implement an automatic decoder in an hour.

Re:Familiar with image recognition at all?

[ooooli]

Obligatory xkcd: http://xkcd.com/538/

Re:Familiar with image recognition at all?

[metaforest]

You must be new here.

That xkcd cartoon gets plastered into just about every discussion that has ever been initiated on /. since the cartoon was first published. It has relevance, but it is, at this time bordering on redundant, since every credible geek on /. knows this aspect of crypto, balls to bones.

Maybe you should take your .sig to heart, rather than wearing it like some geek-cred-badge. Also note that the tool that once again taped this classic cartoon to the thread did NOT get a risk free karma boost... why? Because the link is not helpful, funny or even relevant to a discussion about OCR resistant font faces.

Easy to crack?

[doomtiki]

Given that this seems to be just a simple font, why would it be hard to write an OCR program to decipher specifically this font (or any other supposedly secure font)? Perhaps a program that dynamically obfuscated text like a CAPTCHA would be more useful. This appears to be more of an artistic statement than something useful.

Re:Easy to crack?

[Baloroth]

It isn't any more difficult to crack. Moreover, the absolute only way it would introduce any difficulty at all is if the NSA is scanning images of text. You can bet 95% or more of the data they intercept is already in digital form. The computer already knows what letters are what, so this will help precisely not at all, unless you start sending your emails in image formats, in which case, which is... yeah, not exactly a good plan. Just use encryption if it needs to be secure. This doesn't do anything.

Re:Easy to crack?

[Slugster]

That is because you are like stupid.

This would be totally rad to make signs with the next time hipsters wear the V masks and have one of those "Occupy Mall Street" things again.

Re:Easy to crack?

[Will.Woodhull]

Agree with parent: this is just silly, unless what is being sent is an image of the text. Not ASCII or any other binary encoding.

And if one was going to send images of secret messages, what would make more sense is to use steganography: put the message in image. Like probably millions of Internet users are doing already. How else can you explain the plethora of cute kitten pictures?

A point on which I'd like to see serious discussion by persons who know what they are talking about: How hard is it to determine whether any given image contains a steg message? Assuming the message is also encoded with something simple, like Playfair?

Re:Easy to crack?

[Anonymous Coward]

Can't you see that he wrote with the obfuscated font?

Re:Easy to crack?

[ldobehardcore]

You can look to see if the image is bit-for-bit the same as a known clean image on the internet. EG you intercept an image in an email that also appeared on, say, 9gag. You do a check to see if the image is in the same resolution, the same codec, etc. If you know they're the same format and such, you can delta the two images, if there's a difference you look to see if the difference is on the least significant bits. If so, that's pretty strong evidence that the image has a seganographic message in it.

Other than doing a delta technique with a known clean image, I don't have any idea off the top of my head for cryptanalysis methods of finding evidence for image steganographies.

Re:Easy to crack?

[Anonymous Coward]

By simply owning a cat though, or living in a neighborhood with cats, you would have a generator for an infinite number of pictures with no clean version anywhere on the internet.

Re:Easy to crack?

[dgatwood]

Depends on the steganography method used, and on how many images are sent using that method. If you're a spook and you see somebody suddenly sending lots of images to someone else, you might grow suspicious, at which point you'll start performing analysis to see if there are patterns emerging across the entire set of images, such as certain pixels that are always higher than the adjacent pixels by a certain amount. Granted, such patterns can just as easily be caused by sensor flaws, but some fairly primitive steganography techniques could be detectable in this way.

Second, because subpixel noise in cameras isn't random—it tends to obey a gaussian distribution, and thermal noise can vary considerably from frame to frame depending on the length of the exposure—when spread over a large enough number of sequential or nearly sequential photos taken by the same camera, the steganography might be detectable by using a model of the predicted levels of noise that the image sensor should produce for a shot of a given duration and the elapsed time since the previous shot. This won't tell you what is embedded in the image, but if you're lucky, it might tell you that with a high probability, something is embedded. Depending on the circumstances, that might be enough to get a warrant. Then again, it could just be Digimarc.

Finally, there's the question of the randomness of the source material (or, more to the point, the lack thereof). If the base image is at the native sensor resolution of the camera, the nature of the image sensors themselves could potentially be exploited to detect some types of steganography. In a real-world image sensor (except for Foveon sensors), there's no such thing as a pixel; there are only subpixels that produce a value for a single color. The camera must combine these values (a process called "demosaicing") to compute the color for a pixel in the final image. Because the subpixels that make up a pixel are not physically on top of one another, the camera typically computes the estimated value for the color at a given physical point on the sensor by combining adjacent subpixel values in differing percentages. For example, if the green subpixel is chosen as the "center" of the pixel and the red subpixel is to the left and the blue is above, it might mix a bit of the red from the "pixel" to its right and a bit of the blue from the "pixel" below it. (This explanation is overly simplistic, but you get the basic idea.)

Unfortunately for steganographers, the way that particular cameras construct a pixel value from adjacent subpixel values is predictable and well understood. If a steganographic technique does not take that into consideration, it is highly likely that, given knowledge of the camera and its particular mixing algorithm, the steganographic data can be detected simply by determining whether there is any plausible set of subpixel values that could result in the final computed pixel values for the entire image. For that matter, given that most of the algorithms for subpixel blending are straightforward, even without knowledge of the particular camera, it is highly likely that steganography can be detected, because portions of the image that contain no hidden data will likely only be producible by a single algorithm, and portions of the image that contain hidden data likely will not be.

Those are just a couple of types of analysis off the top of my head that might potentially be used against some types of steganography, given some types of source material, etc. It is entirely possible that there are steganographic techniques that are resistant to these sorts of analysis, and there are likely many other interesting types of analysis that I have not mentioned. I have not kept up with steganographic research personally, so I can't say with any certainty.

Re:Easy to crack?

[shikaisi]

Makes me wonder to what extent steg techniques are being used today.

What else do you think all those cute pictures of cats are on the interwebs for?

Re:Easy to crack?

[Ceriel Nosforit]

Depending on the circumstances, that might be enough to get a warrant.

Those no longer seem to matter to your government.

But a BYTE Is a letter

[Bruce66423]

which is only subsequently translated into a type face when the item is converted into an image which doesn't contain the letters. So all your data would have to be held as such PDFs, which are no longer searchable.Nice idea - shame about the reality

Re:But a BYTE Is a letter

[cold fjord]

The great tragedy of Science — the slaying of a beautiful hypothesis by an ugly fact. -- Thomas Huxley

Re:But a BYTE Is a letter

[K. S. Kyosuke]

I've seen a couple academic articles in pdfs where copied text came out as jibberish. At the time I thought it was copy protected because when I examined the metadata I saw that dozens of proprietary fonts had been embedded.

That happens whenever the typesetting program doesn't include an internal-encoding-to-Unicode table into the PDF file. My understanding of PDF is quite rusty but I believe that the Tj operator which is most commonly used for drawing text works with 8-bit strings. This means that if the original uses anything clever, the typesetting SW has to reencode the font, translate the original into to the new encoding, and embed a matching translation table from character numbers to glyph names to be used for displaying the text. When you're copying the text out, every character has to be converted back to Unicode according to the table which may or may not be present. If there are more different characters used in the text than what the 8-bit strings can handle, you have to switch the reencoding in the middle of the text and include multiple reencoding tables. I think that since the glyphs are named, you need to include the (potentially subsetted) font only once, but again, there have to be multiple 8-bit-number-to-glyph-name tables present, otherwise you wouldn't be able to display the different strings with different reencodings. Pretty much the only situation where you can copy out text without the reencoding tables is when the text is ASCII-only and uses the default mapping, which will fail for any non-English text, for example.

If anyone here understands PDF better than I do, feel free to correct me.

I guess it will work...

[cdrudge]

I guess it will work for all my digital content that I save as raster graphics. Which is...um...none of it.

Re:Yes, that'll work

[Anonymous Coward]

You mean this font will be best used on all future Slashdot summaries?

This is what you get...

[carlhaagen]

...when people with a fundamentally flawed understanding of computer communication try their hands at digital cryptography.

Yeah...

[Georules]

Looks like a fun little project, but subverted about as trivially as a ROT-13. A dynamic font might be a little better.

How can we conceal our fundamental thoughts from artificial intelligences and those who deploy them?

By using a real form of encryption.

Re:Yeah...

[camperdave]

The beast at Tanagra. Kiteo, his eyes closed. Temba, his arms wide/open. Shaka, when the walls fell. Temba, at rest.

That's all I've got to say about that.

Re:Yeah...

[BSAtHome]

Just send all communication in EBCDIC with latin or utf ID. Surely will make all slightly modern computers go haywire.

Re:Yeah...

[Georules]

Sokath, his eyes opened.

really want to give the NSA fits?

[Connie_Lingus]

hey this has given me an idea for the perfect secure font...every char is a blank.

useless

[BarfooTheSecond]

"This project will not fully solve the problems we are facing now", they say. I'd say it barely solve some.
It could even mislead people into thinking that writing emails with this font will make their messages safer. My father for sure would, as he doesn't know what UTF-8 nor what "charset" do mean.

Missing the point...

[RedBear]

I think most commenters here will end up completely missing the point, just as I initially did. Of course it will be trivial to bypass any possible protection the font might briefly provide, but that isn't the point. The making of the font is a political statement against government machinery and software spying on us and taking our humanity away. As such, I'd say it's quite clever and attention-getting.

Now I'll sit back and watch 50 different people get up-modded for pedantically explaining how it will be trivial to train an OCR to recognize the font and how software reads the bytecodes and doesn't care about the font and blah blah blah...

Is that a giant whooshing sound I hear?

Re:Missing the point...

[putaro]

And I will be writing all of my messages in crayon from now on because crayon will smudge up the scanner. It's only a point if it actually does something!

Re:Missing the point...

[king neckbeard]

If you want to make a political statement, why not just make a font that is all middle fingers? Equally useful, much clearer, and it requires far less effort. That he intends to make a political statement doesn't stop him from being a dumbass. There are plenty of stupid political statements. Furthermore, I'm not entirely convinced that he believes this to be a purely political statement. If he does, then he's done a poor job of explaining himself, as that is not what his statements convey. In all likelihood, he really has a poor grasp of the issues at hand, and while he is on the right side of this issue, he's not doing anything to help, and may give some people a false sense of security.

Re:Missing the point...

[camperdave]

A point that doesn't accomplish anything is pointless.

Summary misses the point... again...

[wonkey_monkey]

Yes, as anyone with half an ounce of sense will have already realised, no font will ever be NSA proof. The first mistake was publishing it on the internet...

The creator is trying to make a point about privacy, not implement a workable solution.

Re:Is this a joke?

[fustakrakich]

Yes, you get better encryption when you type unicode on Slashdot..

Re:They're from RISD

[PolygamousRanchKid]

RISD is just a place where stupid hipster kids with rich parents go to film themselves masturbating in bath tubs then go in front of the class and spout a line of b.s. about how it's the most original and unique thing ever created.

I dunno. The Talking Heads came out of the RISD, and they were pretty cool back in the 80's.

Of course, maybe the RISD only produces a band like that once in a lifetime . . .

Epic failure

[pbjones]

Too easy to train OCR for his font. Same glyph for same character. When they say that NSA is reading your mail, they don't mean snail mail. I'm sure that it seamed like a good idea at the time.

alternate implementation

[v1]

If you exported a document as a pdf, you can embed fonts in it. Run a program to convert your original text file into another one. translate out the characters to other ascii ids. and then embed the font.

For example, ""DOG". Letter "D" is ascii 68. So the pdf will say "this is character 68, in whatever font you had selected." So place the obfuscated glyph for "D" in the position for "Y" (90) and then change all Ds to Ys in the document's text stream. Then when a person reads it, it LOOKS like DOG but copy-paste will get "YOG". Do this for all characters and numbers.

A smart app to do this would roll up a random ascii remapping for each document, and obfuscate characters in the font differently each document. This would make it difficult to craft a specific skimmer module to handle this obfuscation automatically..

This will allow you to email or post the data, and humans to read it, but skimmers won't get legible text with a copy and paste, and if they then fall back to OCR attempt, that will also fail.

Although in reality, fallback to OCR in an automated system is unlikely, and would probably just move on to the next document to skim. So just making very slight adjustments to the glyphs in the font, (to prevent automated correction) in addition to mixing them up, would probably do a good job against fully automated skimming. The adjustments this guy is making (except for the last one) are inconvenient to read. Just adding a LITTLE noise would do the trick I think.

Re:Woosh!!!!

[cbiltcliffe]

Al of /. completely missed his joke. Man, you guy are pathetic.

I know /. readership has dropped over the past few years, but I think you might be exaggerating just a little bit, here.....

Alternative: Don't send, just compute data

[Anonymous Coward]

If the NSA and other snoops capture and record data that is sent and just store it for subsequent analysis when the need arises, a better approach to foiling them would be to not actually send data at all, but only to compute data live at each end.

Computing the data of a communication can be done in countless ways, from timing the intervals between items of data sent (where the data is either garbage or readable misdirection), to encoding it in IP addresses used, applying mathematical functions to the live stream, or any of a million other wierd approaches that a suitably inebriated brain could dream up. This diversity is a strength.

Note that this is not cryptography, it's denial of cryptographic analysis at a later date because essential reassembly parameters are available only at the time of transmission, not later. All it would do is prevent dumb data gathering and storage by the mass dragnet from providing data that is meaningful at a later time.

Needless to say, you could use it in conjunction with cryptography too if you wanted to ensure that, should they actually be monitoring you live and capturing a whole pile of possible reassembly parameters, then they'd still need to break the real crypto as well. But if they're doing that to you then you're probably in deep trouble already and you shouldn't be online reading Slashdot.

Where it can help is by being a thorn in the side of the mass data collectors, and so helping the great mass of public communication remain private despite subsequent analysis by the spooks. To combat it, they would not be able to just blindly collect traffic for posterity, because it would be meaningless.

It's not an original idea, but perhaps after the PRISM revelations it's time to revive some old ones.

Re:hand writing

[rossdee]

Even better, a Doctors hand writing - the NSA will have to hire pharmacists or RN's to read it.