Paul F. Syverson, Stuart G. Stubblebine. Group Principals and the Formalization of Anonymity. In Jeannette M. Wing, Jim Woodcock, Jim Davies, editors, FM 99 - Formal Methods, World Congress on Formal Methods in the Development of Computing Systems, Toulouse, France, September 20-24, 1999, Proceedings, Volume I. Volume 1708 of Lecture Notes in Computer Science, pages 814-833, Springer, 1999. [doi]