This project is designed to improve your personal online security, enhance your online privacy, and enable you to help others do likewise.

Your deliverable is a three-to-five page report (don’t pad, please! brevity is the soul of wit) containing:

Ø A threat model (information assets, adversaries, threats and risks) you develop based on your walkthrough of the Security Planner (https://www.securityplanner.org/#/ ) and the questions in EFF’s Surveillance Self-Defense guide’s Assessing Your Risks section (https://ssd.eff.org/en/module/assessing-your-risks and please see important note below)

Ø You must consider “UW(school)” one of your adversaries. What information about you and your digital information behavior on and off campus are we able and likely to collect? Of that information, what do you not want us knowing and how can you protect it from us?

Ø Choose no fewer than Four information assets and Four adversaries (UW(school) counts as one). Likely adversaries include but are not limited to: bosses present or future, (fr)enemies, ex-es, corporations,

governments. The assets you choose do not need to be of interest to all your chosen adversaries—it’s fine to decide, for example, that you want to work out how to protect your social-media-based classwork from your nosy parents, but you don’t care whether UW(school) knows about it.

Ø An assessment of your password security, social-media privacy, and general online privacy and security. How well are you protecting yourself, and what can you do to further reduce your risks?

Ø A list of no fewer than Four measures (based on lab or from any part of the Security Planner or Surveillance Self-Defense guide) you have just taken to improve your personal security and privacy, with (for each measure) a short one-paragraph explanation of why you chose this measure (why was it a high priority for you?), which adversary/ adversaries it protects you against, and which information asset(s) of yours it protects

Grading rubric:

Ø clear, reasonable threat model: 5 points

Ø appropriate, comprehensive security/privacy assessment: 5 points

Ø measures taken, with explanations: 5 points

 

Important note: We anticipate that some people’s threat models and/or adversaries will be extremely personal. If you decide to include such circumstances in your report (which you are not obligated to do!), we strongly recommend that you not identify individuals, nor be specific about how they harmed you (if they did). For example, if you are concerned about a specific person stalking you, do not identify that person or use the word “stalking.” “Someone I do not want following me on social media” is enough.

Be aware that all your instructors are REQUIRED BY LAW to report campus incidents of sexual harassment and sexual abuse to the campus Title IX office, and to report certain crimes (so-called “Clery crimes”) to campus authorities. (We are not allowed to keep such reports confidential!) If such situations are part of your threat model, you are absolutely not required to tell us so. Be as vague as you wish. (Our feelings will also not be hurt if your report considers us an “adversary” with respect to this or similar information.)

We will not share your report with anyone except when required to under the circumstances listed in the above paragraph. If you turn in your report on paper rather than in Canvas, we will shred it after grading if you prefer. You may ask us for referrals to confidential agencies without revealing to us what occasioned your request.