The formal specification of the Tees Confidentiality Model. - Anthony Howitt (2008)