Source Protection and JSAT
Global Investigative Journalism Conference 2023
Rubric #1: Threat Modeling
https://freedom.press
Assessing your risk aka “Threat Modeling”
Assets: What do I have to protect?
Adversary: From whom?
Resources: What resources does my adversary have?
Likelihood: What is the likelihood my adversary will target me?
Your resources: How far will I go to protect my assets?
https://freedom.press
Rubric #2: Which Door Do They Use?
https://freedom.press
Back door
https://freedom.press
Front door
https://freedom.press
Rubric #1 + Rubric #2: Likely tactics
https://freedom.press
Who concerns you? The Troll
Time: 1 dedicated person
Money: Low
Technical skill: Unsophisticated, self-taught
Tactics: Due to lack of technical skill, relies on social-based attacks like harassment and phishing
https://freedom.press
Who concerns you? Intelligence
Time: 1 dedicated group
Money: High
Technical skill: Top in-house experts and/or external contractors
Tactics: These actors will use legal means to get your data, but also has the resources to deliver malware or other surveillance methods (in-house or contracted)
https://freedom.press
Who concerns you? Law Enforcement
Time: 1 dedicated group
Money: High
Technical skill: In-house experts
Tactics: Expect them to lean on the legal system to get your assets (subpoenas and warrants to platforms for your data, device confiscation)
https://freedom.press
Who concerns you? Corporate Figure
Time: 1 dedicated group, can outsource
Money: High
Technical skill: Outsourced experts
Tactics: Has the resources to contract out to surveillance professionals like PIs; they might use the legal system to harvest your assets
https://freedom.press
Who concerns you? 1337 Hackers
Time: 1 dedicated person,
Money: Low-High
Technical skill: Expert
Tactics: This person has the skills to pull off social and technical attacks to get at your assets. They don't tend to, or have the power to, use legal methods to get assets
https://freedom.press
Assessing your risk aka “Threat Modeling”
Assets: What do I have to protect?
Adversary: From whom?
Resources: What resources does my adversary have?
Likelihood: What is the likelihood my adversary will target me?
Ability: How far will I go to protect my assets?
https://freedom.press
What do I have to protect? | Who am I concerned about? | How likely is this adversary? | What are their resources? Likely tactics? | What would the impact be? (Low, medium, high) | What resources do I need? |
| | | | | |
https://freedom.press
Rubric #3: Bullseye Mapping
https://freedom.press
Bullseye Mapping
https://freedom.press