A couple of weeks ago I posted my introduction to threat modeling. Several times in that post I mentioned the concept of profile elevation, and it will certainly be coming up more as I flesh out my thoughts on threat modeling. It has occurred to me that this topic should be explored more fully.
Profile elevation is a fairly intuitive concept. For our purposes we can describe it as† “the generally-undesirable condition of:
- becoming more visible to one’s adversary, and/or
- becoming more interesting to one’s adversary.”
Being either or both more visible and/or interesting to your adversary is a bad thing in nearly any adversarial situation (Murphy’s Laws of Combat: Try to look unimportant, the enemy may be low on ammunition). If you are highly visible to an adversary your movements, whether online or in the real world, are easier to track. If you are interesting to your adversary, he or she will be willing to invest time and money to pursue you, digitally or physically.
Targeted surveillance costs time and money, and most adversaries will be limited in some capacity on each. In the digital collection realm this limitation is often one of analytical or language capabilities; paying competent analysts and linguists is expensive. Fitting their findings into a bigger picture is also difficult unless you have elevated your profile to the point of being interesting.
In the “tactical” community profile elevation avoidance is referred to as being a “grey man“. If your personal threat model(s) warrant it, you should strive for the being digitally grey. That is, blending with the herd and being generally uninteresting to avoid becoming a target. Once your adversary has become focused on you and your activities, defeating him or her can become extremely difficult in the short to mid-term, and next-to-impossible in the long term. As I mentioned in threat modeling, the best way to do this is to select mitigations that are in accordance with your perceived threat model.
†This is my made-up definition. If you think it needs improvement, let me know.
