Type Based Information Flow Analysis
Francois Pottier  INRIA

Flow Caml
  demo...

Type system
  rules ...
Semantics
  - soundness
  - completeness
Noninterference
  the bracket calculus is a tool to attack the noninterference
  proof. it is sufficient to prove that a single ML^2 program 
  contains no brackets.

  give typing rules for brackets. In ML^2, reduction preserve
  types

Open Qs
  - The type system are sometimes not flexible enough, Dynamic
    labels are an interesting extension. What other extensions
    are possible and useful?

  - Noninterference is often too drastic a requirement. 
    declassification appears useful but is unsafe, how can it
    be tamed?

  - Despite a huge number of publications, nobody seems to be
    using these type systems in practice. There may be a need
    for a few killer applications.
  
Dorothy E. Denning, Cryptography and Data Security, 82
/*   there is a chapter on flow analysis*/
