Rootkits are sneaky, but they are not impossible to detect. User mode rootkits can be detected by checking for modifications to files on disk. On Windows, important code libraries are digitally signed, so that any tampering would invalidate the digital signature and be detected. Another commonly employed technique is to periodically compute a cryptographic hash function for critical system components while the system is offline. This hash can be recomputed while the system is online, and if the hashes do not match, then a rootkit may be altering these files. In addition, kernel mode anti-rootkit software can detect code injection in system processes. If the cryptographic hashes do not match, then the rootkit violated which of the three primary security principles?