Quantifying noninterference