lauren should use a rule-based attack on the agency’s user passwords