Systems for processing highly classified governmental/military confidential information often are required (depending on the country laws) to provide formal pro

Systems for processing highly classified governmental/military confidential information often are required (depending on the country laws) to provide formal proof of their entire work. Other than that (and because it is too expensive to run such an analysis) people just need to look at the code to check whether it's doing what it's supposed to do.