A one-page addendum to standard threat-modeling frameworks (STRIDE, LINDDUN, PASTA) that models the case where the legitimate operator of the system becomes the adversary.
Companion artifact to the essay When Telemetry Turns Predatory.
Any product or feature that:
- Ingests user-attributed events
- Correlates identity across systems
- Produces prioritized signal for human or automated action
- Retains metadata beyond immediate operational need
- Depends on the legitimate operator remaining trustworthy across changes in ownership, executive leadership, or jurisdiction
For each data element the system collects, ask:
- Enterprise use - Why do we collect this? What legitimate security or product function does it serve?
- Retention default - How long is it kept? What would happen if that default were extended by executive order, acquisition, or subpoena?
- Correlation key - Which other systems can this be joined against? What population becomes visible when the join is performed?
- Authoritarian tenant reading - If an authoritarian tenant owned this pipeline tomorrow, what would they do with this data element that we did not intend?
See TEMPLATE.md for the copy-pasteable version.
Add a copy of the template to every design doc that touches user data. Fill it in during the same review pass as your STRIDE or LINDDUN doc. Do not skip the fourth column.
The specific artifact matters less than the commitment to run the exercise.
- STRIDE - Microsoft's threat categorization
- LINDDUN - KU Leuven, privacy-focused threat modeling
- PASTA - Process for Attack Simulation and Threat Analysis
- EFF Surveillance Self-Defense - end-user perspective on the harms this template addresses
- OONI - measurement of internet interference at ISP scale
- Data Detox Kit - Tactical Tech's practical guides
MIT. See LICENSE.