1.
Threat Modeling
Library Freedom Edition
Morgan Marquis-Boire & Eva Galperin
@headhntr @evacide

2.
Who are we?

3.
What are we talking about?
What the hell is threat modeling?
How do you do it?
What makes this trickier than it looks?

4.
Librarians are doing it for themselves

5.
How not to go crazy

6.
What the hell is threat modeling?
111sdgisjfoisejfoijs11. What do you want to
protect?kok
1. What do you want to protect?
2.1. What do you want to protect? ASSETS1. What
do you want to protect
1. What do you want to protect?

7.
What the hell is threat modeling?
111sdgisjfoisejfoijs11. What do you want to
protect?kok
1. What do you want to protect?
2.1. What do you want to protect? ASSETS1. What
do you want to protect
1. What do you want to protect?
2. Who do you want to protect it from?

8.
What the hell is threat modeling?
111sdgisjfoisejfoijs11. What do you want to
protect?kok
1. What do you want to protect?
2.1. What do you want to protect? ASSETS1. What
do you want to protect
1. What do you want to protect?
2. Who do you want to protect it from?
3. How likely is it you will need to protect it?

9.
What the hell is threat modeling?
111sdgisjfoisejfoijs11. What do you want to
protect?kok
1. What do you want to protect?
2.1. What do you want to protect? ASSETS1. What
do you want to protect
1. What do you want to protect?
2. Who do you want to protect it from?
3. How likely is it you will need to protect it?
4. How bad are the consequences if you fail?

10.
What the hell is threat modeling?
111sdgisjfoisejfoijs11. What do you want to
protect?kok
1. What do you want to protect?
2.1. What do you want to protect? ASSETS1. What
do you want to protect
1. What do you want to protect?
2. Who do you want to protect it from?
3. How likely is it you will need to protect it?
4. How bad are the consequences if you fail?
5. How much trouble are you willing to go through in
order to prevent those consequences?

11.
What do you need to know?
Assets
Adversary
Threat
Capability
Risk

12.
Surveillance is magic.

13.
VS

14.
COST = $0

15.
COST = $$

16.
Replenishing
the minibar?
Or...

17.
COST = $$$

18.
COST = PRICELESS

19.
Those are the types of actors, but who are the players?

20.
High End
FVEY - US / UK / CA / AU / NZ
ISRAEL
CHINA
RUSSIA
FRANCE
etc etc etc etc

21.
Artisanal, Small-Batch,
Locally made, home grown...

22.
Commercial Market
● Law Enforcement
● Intelligence agencies
● Security companies

23.
Pay for tools

24.
Pay per job

25.
Gotta get paid, yo

26.
Attacker resources
vs
$$$$
vs
target value

27.
Surveillance Starts at Home

28.
Stalkers

29.
“When we share information, we are building power of
our own. Potential harassers may deterred by the
thought that we are both capable of and willing to turn
the eye of internet surveillance back on them.”
Liz Henry, Model View Culture Investigation Online:
Gathering Information to Assess Risk

30.
Amina Araaf: a gay girl in Damascus

31.
Tom MacMaster: middle aged guy in
Scotland

32.
Domestic abuser

33.
I smell a RAT

34.
StealthGenie

35.
Other kinds of criminals

36.
“Before his gauche upload, he posted a picture
of his lobster salad and tagged the restaurant.”
New York Post

37.
Hey teacher, leave those kids alone

38.
“One day soon, home room teachers in your local
middle and high schools may stop scanning rows of
desks and making each student yell out ‘Here!’ during
a morning roll call. Instead, small cards, or tags,
carried by each student will transmit a unique serial
number via radio signal to an electronic reader near the
school door.”
AT&T advertising brochure

39.
The blended threat landscape
Not discrete categories:
many delicious flavors!

40.
Risk

41.
Different appetites for risk

42.
Meet the nihilists

43.
Alaa Abdel Fattah says “Come at
me, bro.”

44.
Meet the vegans

45.
Further reading
What Every Librarian Should Know About HTTPS:
https://www.eff.org/deeplinks/2015/05/what-every-librarian-needs-know-about-
https
Surveillance Self Defense: https://ssd.eff.org.
COMSEC: Beyond Encryption:
https://grugq.github.io/presentations/COMSEC%20beyond%20encryption.pdf
Digital First Aid Kit: http://digitaldefenders.org/digitalfirstaid/