Content Summary : The Microsoft Windows Vista operating system implements a multi-level integrity model that weakens some of the MAC checks that appear in classical integrity modelslike Biba’s “no write up, no read down” [7]. While Vista’s MAC disallows low-integrityprocesses from writing to high-integrity objects, it places no restriction on reads. Fur-ther MLS labels in Vista are dynamic—objects and code can be explicitly protectedor unprotected by changing their labels. These facilities are useful in practice, sincethey enable processes in different trust boundaries to communicate, and allow dynamicaccess control. At the same time, unrestricted use of these facilities can cause severalinformation flow vulnerabilities.