We know how to writefunctional. specs to say what the code is supposed to do, but we don'tknow as much about expressing security constraints regarding what asystem is not supposed to do. When security ...