Personal threat models

Different houses, different locks

A jeweller, a student flat and a farmhouse all have doors, but nobody would fit them with the same locks. The same is true online. Below are four people, all made up, each with a short threat model built from the one-page method in the last lesson.

1. Dana, a job seeker

• Assets: her CV with phone number and address, her current employer not knowing she is looking, her old public posts.
• Adversaries: fake recruiters running scams, data brokers who scrape CVs, her current manager.
• Top threat: a fake job advert collects her CV and ID documents (likelihood 2, impact 3, risk 6).
• Mitigations: share a CV without her home address; never send ID documents before an interview with a verified company; tidy old public posts; set job-site profiles to hide her from her current employer where the site allows it.

2. Ravi, a journalist

• Assets: the identity of his sources, unpublished notes, his own location during sensitive work.
• Adversaries: people his reporting exposes, who may have money and time; anyone with access to his phone records.
• Top threat: a source is identified from who Ravi contacted and when (likelihood 2, impact 3, risk 6). Notice this is about metadata, not message content.
• Mitigations: an end-to-end encrypted messenger with disappearing messages for sources; meeting in person for the most sensitive talks; a separate device for that work; full-disk encryption and a strong passcode on every device.

3. Kai, a teenager

• Assets: photos, location, friendships, and the feeling of not being watched all the time.
• Adversaries: people met online who are not who they say, classmates who screenshot and share, apps that collect far more than they need.
• Top threat: a photo shared privately gets passed around (likelihood 2, impact 3, risk 6).
• Mitigations: share live location only with a few people and switch it off by default; assume anything sent can be screenshotted; turn off location access for apps that do not need it; know who to talk to if something goes wrong.

4. Ola, a small shop owner

• Assets: customers' names, addresses and order history; the shop's admin login; the trust of regulars.
• Adversaries: criminals who try stolen passwords on many sites, tracking scripts added by plugins, a former helper who still has a login.
• Top threat: the admin account is taken over with a password leaked elsewhere (likelihood 3, impact 3, risk 9).
• Mitigations: a passkey or unique password with two-step login on the admin account; remove logins people no longer need; audit which third-party scripts the shop loads; keep only the customer data the shop really uses.

What to notice

• Adversaries change everything. Ravi faces people who may spend real effort; Dana mostly faces scammers who move on to easier targets.
• The top threat is often ordinary. Ola's biggest risk is a reused password, not a clever hacker.
• Mitigations are habits as much as tools. "Assume it can be screenshotted" protects Kai more than any app.
• Some threats are accepted. Dana accepts that recruiters will see her name; that is the point of a CV.

A common misconception

"More privacy tools always means more privacy." Tools you do not understand can give false confidence, or get in the way so much that you stop using them. Ravi's separate device helps because he uses it for one job only. For Kai, it would just be another phone to lose.