A company monitors privileged activity, but the monitored administrators can alter all the logs without independent detection. What weakness is most direct?

1. The logs contain too many timestamps
2. The administrators should stop being individually identifiable
3. The evidence is vulnerable to unauthorized modification by the subjects being monitored
4. The logs should be kept only in each administrator's personal directory