Lesson 1 of 9 · about 14 minutes
Threat Modeling in Plain Terms
You'll be able to
- Use the EFF Surveillance Self-Defense questions to build a personal security plan
- Tell the difference between a likely threat and a dramatic but unlikely one
- Rank risks with a simple likelihood times impact score
- Pick the first three protections that give the most safety for the least effort
Security advice fails when it is generic. "Use encryption" means nothing until you know what you are protecting and from whom. A writer covering the county fair has different problems from a writer whose source works inside the sheriff's office. So the first tool in this module is a sheet of paper.
The Electronic Frontier Foundation's free guide, Surveillance Self-Defense, calls this a security plan. Security people call it a threat model. Same thing: a short, honest list of what you have, who might want it, and what you are willing to do about it.
The six questions
EFF builds its plan from six questions. Here they are with the plain version a writer would ask.
| EFF question | What a writer actually asks | Typical answers |
|---|---|---|
| What do I want to protect? | What would hurt if it leaked, vanished or got changed? | Email, notes, drafts, source names, home address, the website, the newsletter list |
| Who do I want to protect it from? | Who would bother? | Random scammers, an angry subject of a story, an online mob, a stalker, rarely a government |
| How bad are the consequences if I fail? | What happens on the worst day? | Embarrassment, lost work, money stolen, a source fired, someone at your door |
| How likely is it that I will need to protect it? | Is this realistic for me, this year? | Phishing: very likely. Targeted spyware: very unlikely for most |
| How much trouble am I willing to go through? | What will I actually keep doing? | A password manager: yes. Carrying a burner phone daily: probably not |
| Who are my allies? | Who helps me prepare and respond? | An editor, a tech-minded friend, press freedom groups, your carrier's fraud team |
The fifth question matters more than people admit. A plan you abandon after a week protects nothing. Pick protections you will still use in a year.
Likely beats dramatic
Movies teach us to fear the hooded genius and the spy satellite. Real losses come from boring places. The FBI's Internet Crime Complaint Center logged 1,008,597 complaints in 2025, with reported losses of about $20.9 billion. Phishing and spoofing alone accounted for 191,561 complaints. Business email compromise, where a criminal takes over or fakes an email account to redirect money, cost about $3.05 billion (IC3 2025 report).
Those are reported crimes, so the real numbers are higher. And they point at the same few weak spots: reused passwords, weak two-factor, fake login pages and unpatched devices. Fix those first. They are also the doors a more serious adversary would try before spending real money.
Common mix-ups
- Claim: "Nobody would bother hacking me, I'm a small newsletter." What the evidence shows: Most attacks are automated and untargeted. Bots try leaked passwords against millions of accounts. Being small just means nobody notices when you get hit.
- Claim: "Security is about the technology." What the evidence shows: CPJ's Digital Safety Kit spends as much space on phishing, account recovery and personal data online as on tools. People and habits are most of the attack surface.
- Claim: "If the government wants in, nothing helps, so why try?" What the evidence shows: Very few writers face that adversary, and even then, good habits raise the cost of watching you. Giving up hands the easy wins to everyone else too.
Scoring your risks
Once you have a list, rank it. A simple way: rate each risk 1 to 5 for likelihood and 1 to 5 for impact, then multiply. The product runs from 1 to 25. Work top down.
Example: a freelance writer in Cutter Falls
Dana writes a weekly newsletter about the invented town of Cutter Falls. This month she is covering a proposed 22 percent water rate hike. A clerk at the utility has been sending her internal emails about how the rate study was done. Dana's list:
| Risk | Likelihood (1 to 5) | Impact (1 to 5) | Score |
|---|---|---|---|
| Email account taken over by phishing | 4 | 5 | 4 x 5 = 20 |
| Clerk's identity exposed by a forwarded email or careless message | 3 | 5 | 3 x 5 = 15 |
| Laptop dies, drafts and notes lost | 3 | 4 | 3 x 4 = 12 |
| Home address posted by an angry commenter | 2 | 4 | 2 x 4 = 8 |
| Newsletter domain hijacked | 1 | 4 | 1 x 4 = 4 |
| State-grade spyware on her phone | 1 | 5 | 1 x 5 = 5 |
Sorted, her top three are email takeover (20), source exposure (15) and data loss (12). So her first week goes to a password manager, an authenticator app or security key on email, moving the clerk to Signal with disappearing messages, and setting up a backup. Total cost: one $29 security key (Yubico's Security Key NFC price as of October 2026) and an afternoon. The spyware risk stays on the list but does not drive her choices.
The numbers are judgment calls. That is fine. The point of scoring is to stop you from spending a weekend on the exotic threat while your email still uses the password from 2014.
Assets you forget to list
People list their laptop and their email. They miss these:
- Recovery paths. The phone number and backup email that can reset your main account are assets too. Whoever controls them controls everything downstream.
- Other people's information. Source names, interview recordings and tip emails. You are holding their risk, and their consequences may be worse than yours.
- Your physical location. Home address, kids' school, the coffee shop where you write every Tuesday and post photos from.
- Your reputation. A hijacked account posting scams or fake quotes under your name can do more damage than a stolen file.
- The publishing chain. Domain registrar, web host, newsletter platform, social accounts. If someone takes the domain, they take your email address with it.
Adversaries, sized honestly
Write down who, specifically. "Hackers" is not an answer. Most writers end up with some mix of these:
| Adversary | What they want | Typical method | Skill and money |
|---|---|---|---|
| Automated criminals | Money, accounts to resell | Password stuffing, mass phishing | Low effort per victim, huge volume |
| Angry subject of a story | To embarrass, scare or silence you | Digging up personal info, complaints, pressure on sources | Low to medium |
| Online mob | Attention, punishment | Doxxing, pile-ons, fake reports to platforms | Low skill, many people |
| Someone who knows you | Control, information | Guessing answers, physical access to your phone | Low skill, high access |
| Government or well-funded group | Sources, communications | Legal demands, sometimes spyware | High, but rarely aimed at local writers |
Allies change the math
You do not have to do this alone. An editor can agree to take source names out of shared drafts. A friend can hold a copy of your backup drive. Press freedom groups publish free guides: CPJ's Digital Safety Kit (updated February 2026) covers accounts, phishing, devices and border crossings. Write the names and phone numbers of your allies on the plan itself, because on the bad day you will not want to go looking.
When to redo the plan
Revisit it when your work changes: a new beat, a story naming a powerful person, a new confidential source, a trip abroad, a public fight online. A good habit is a fifteen-minute review on the first of each quarter. Most quarters nothing changes. The quarter something does, you will be glad you looked.
Checklist
- List at least eight assets, including recovery phone and email
- Name specific adversaries, not "hackers"
- Score each risk for likelihood and impact, multiply, sort
- Choose three protections you will actually keep using
- Write down your allies with contact details
- Put a review date on the calendar
Try it
Take one sheet of paper or a blank document. Make three columns: asset, adversary, score. Fill in at least eight rows for your own work, scoring each one with likelihood times impact. Circle the top three. For each, write one protection you can set up this week, using the later lessons in this module as your menu. Keep the page somewhere offline, because it is a map of your weak spots and you do not want it sitting in an email draft.
Check yourself
1. Which question is NOT one of the questions in EFF's 'Your Security Plan' guide?
EFF's questions are about assets, adversaries, consequences, likelihood, effort and allies. Picking algorithms is a detail that comes much later, if ever.
2. A local writer's most likely threat, based on the IC3 numbers in this lesson, is which of these?
The FBI's IC3 logged 191,561 phishing and spoofing complaints in 2025, one of the largest categories. Ordinary account attacks are the realistic starting point.
3. In the worked example, the leaked-source risk scored 3 for likelihood and 5 for impact. What is its score?
The lesson multiplies likelihood by impact: 3 times 5 equals 15.
4. Why does a threat model ask 'Who are my allies?'
Help from an editor, a press freedom group or a tech-savvy friend changes what you can do and how fast you can recover.
5. What is the main reason to write the plan down and revisit it?
A new beat or a story that angers someone powerful changes your risks. Review the plan when your work changes.
Terms in this lesson
- Threat model
- A simple map of what you need to protect, from whom, and how much effort protection is worth.
- Asset
- Anything worth protecting: accounts, files, a source's identity, your home address, your website.
- Adversary
- A person or group who might want to get at your assets, from a scammer to an angry official.
- Attack surface
- All the ways in: every account, device, app and person that could be used to reach your assets.
Sources
- Your Security Plan, Surveillance Self-Defense (EFF) checked 2026-10
- FBI Internet Crime Complaint Center, 2025 IC3 Annual Report checked 2026-10
- Digital Safety Kit, Committee to Protect Journalists checked 2026-10