Field instrument Threat modelling

Threat-model worksheet

Ten sober questions on the work you publish, who you publish for, and what you can lose. The worksheet emits a one-page editorial brief on the hosting posture the operator would recommend.

The ten questions below are deliberately sober. Pick the option closest to your circumstances; if none fit, pick the nearest neighbour and note the divergence in the resulting brief.

01. Who are you publishing for?

Investigative journalists or a newsroom
An NGO, advocacy organisation, or research group
A lawyer or legal-aid clinic
An archive, library, or historical project
An individual under political or corporate pressure
Other / mixed

02. What is the work?

An active investigation that names parties
An archive of completed material, kept available
A leak-aggregator that receives material from sources
Advocacy or policy publication
Litigation-support hosting
A regular publication or newsletter

03. How sensitive is the material?

Low — open-source research, already-public material
Medium — controversial but defensible publicly
High — sources at risk if disclosed
Extreme — disclosure could be life-threatening

04. Who are the principal adversaries?

Corporate legal teams pursuing takedowns
Criminal organisations whose interests you cross
A domestic state actor with subpoena power
A foreign state actor with extra-territorial reach
Online mobs, harassment campaigns, doxxing crews
Some combination of the above

05. Where is the subject of the work located?

06. How much downtime can the work tolerate?

None — the work is operationally live
Hours — short interruption is acceptable
Days — content is asynchronous
Weeks — the archive does not need to be live

07. What is your tolerance for operator-side disclosure to authorities?

Zero — any disclosure is a fail
Acceptable on a lawful court order in the operator's jurisdiction
Acceptable for narrow categories with notice
Case-by-case under counsel review

08. How do you intend to pay for hosting?

Card or bank transfer through a KYC channel
Cryptocurrency acquired on a KYC exchange
Cryptocurrency acquired peer-to-peer or via atomic swap
Cash by post
A mix of paths

09. What is your capacity for self-hosting on rented infrastructure?

Fully — Linux administration is in-house
Partial — operations team needs support
None — managed services preferred

10. What support window do you need from the operator?

Minimal — ticket within business hours is fine
Standard — same-day response on operational issues
Extended — multi-hour out-of-hours availability

Editorial brief