I am researching users threat models for a documentary film dedicated to surveillance. The idea is to identify the threat model (asset to protect, attacker, attacker's capabilities, threat, risk of an attack) of different categories of people to help create a better understanding of surveillance and counter-surveillance tactics.

For example:

  1. A US citizen might want to protect some assets (i.e. sensitive information) from trackers to avoid a credit rating/ banking credentials from a black-hat hacker.

  2. A journalist in Germany working on an insider trading scandal will need to protect his source from his employer in order to get his story out without a trial.

  3. A Kurdish activist living in Ankara needs to communicate with his fellows to publish a forbidden fanzine. His group is scrutinized by Turkish authorities. (...)

  4. Others categories could be: human rights researcher, teenager being bullied, LGBT... I also try to identify the threat model of people who would be less at risk and to whom "normal/random" people could easily relate to: a lawyer, an entrepreneur with an innovative technology, a doctor, a professor......

I didn't find much on this approach on the net, a part from the EFF Surveillance Self Defense guide, this interesting article, a slate and a wired story.

What are your thoughts on this approach? Do you find it relevant/reducing to apply a threat model to social categories, considering their environment/regime they live in?

I am looking for material/reads related to the issue. Forgive me if I misused some concepts, still new to the topic.

2 Answers 2


The problem with threat models is that they require deep, technical understanding of the subject and the capabilities of the threats. Your 4 scenarios would require very different threat models, and they are not something you can cover in a documentary.

For instance, every place the data touches has its own threat model. The data on your computer, the data in transit, the data at rest at the destination, and the meta data created at every point.

Instead of delving deep into the threat models at each point, one could apply a risk model (likelihood, impact) at each point and focus on addressing the highest risks. If every threat point is a high risk (even storing data on your computer), then you have other problems. If there is one point that has a higher risk (data in transit) then you can mitigate that problem.

So, my advice is to expose the risks at every point along the data's path, and apply the typical risk mitigations at the points where there is higher risk.


Thanks Schroeder,

I have been looking into deeper risk assesment. I found people talking about it like Sean Gallagher in Arstechnica and Adam Shoshack Here are some good reads for people willing to look further into it.

The risk assesment is anyway also a part of the threat modeling, if I got it right. As the likelihood of the threat has to be assessed and the mitigation concentrated on the higher risk.

  • 1
    Please add this as a comment or an edit to your question, as it does not serve as an answer to this question.
    – Tom K.
    Commented Aug 7, 2017 at 10:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .