Everyday Carry Is a Threat Model

At 06:42, airport security asks him to empty his coat. A phone, glasses, a bronze rectangle, a battered hotspot, a white medical wand and an orange satellite communicator fill two gray trays. He travels for work, helps manage his father’s care and spends enough weekends beyond cell coverage to know where the carrier map turns optimistic. Old pocket dumps advertised taste: knife, watch, wallet, light. This one records doubt. A threat model is simply an account of what might fail, who or what could exploit it, and what matters enough to protect. In 2026, you can read one from a coat pocket.

Read this loadout as an X-ray, not a shopping list. Every object declines one default and accepts a different dependency.

Transmission 01THE PHONE WITH LESS INSIDE IT

SCENE // FICTIONAL

The parking garage has removed its ticket machine. A QR code on the wall sends him to an app that would like precise location, nearby devices, notifications and permanent access to the network. It is a large set of requests for the privilege of leaving a concrete box.

He installed GrapheneOS on an unlocked Pixel 10a before moving his data onto it. The parking app lives in a separate profile with no contacts and no photographs. He lets it reach the internet long enough to load his reservation, then closes that route again.

A phone operating system is a hierarchy of privileges. On GrapheneOS, even Google Play can run as an ordinary sandboxed app instead of a specially trusted part of the system. The network switch goes deeper than hiding an icon: the app is denied the ability to open the software connections it would use to speak outside the phone.

Anything the parking app sent during its brief connection is already outside his control. Closing its network permission stops future traffic from that profile. His carrier still knows which towers serve him, and the garage camera reads his license plate when the barrier lifts. One boundary closes in software; another is bolted to the ceiling.

Transmission 02THE HAND THAT CLICKS AIR

SCENE // FICTIONAL

He leaves the airport carrying coffee in one hand and pulling a suitcase with the other. A client’s message moves the meeting two blocks east. It appears in the small display over his right eye. He touches thumb to forefinger to open it, then calls up the beta walking directions before he reaches the next corner.

The cloth band on his wrist is reading electricity from muscle. Nerves tell the fingers to move; muscles answer with faint electrical patterns; sensors at the skin classify those patterns as scroll, click or swipe. It is called electromyography. It is not mind reading. The band recognizes a tiny physical command before anyone nearby can see the gesture.

The display is private to the wearer; the surrounding world is still part of the camera’s field. A capture light signals when the camera records, but no light announces that a message is being read or an AI answer is hanging over the person across the table. The interface has moved off the screen and into social space.

At the next crosswalk he takes the glasses off to wipe them. For a few seconds the street is only a street again—no arrow, no turn hovering at the edge of vision.

Transmission 03THE POCKET WITH ALL THE KEYS

SCENE // FICTIONAL

The phone falls screen-first onto tile in a train-station bathroom. It still vibrates. The display is black.

On his laptop, he plugs in the bronze device from his other pocket. It supplies the hardware security key already registered to his email account. A one-time code stored in the same device opens the client portal. An encrypted recovery file is there too. The most important parts of his digital life were moved off the phone before the phone became a dark rectangle.

The direction of travel reverses. Account credentials, money keys and recovery files leave the general-purpose phone and return to an object with weight. Dedicated hardware keeps long-term private key material out of phone and laptop memory. It also concentrates consequences. Ten failed PIN attempts erase the device’s Master Key, forcing recovery from backup. If the object disappears, recovery moves back into the physical world: encrypted NFC keycards, seed material and whatever separation the owner arranged before the loss.

His replacement phone will arrive tomorrow. The two backup cards are already waiting in different houses.

Transmission 04THE TOWER HAS A TELL

FIELD EXERCISE // FICTIONAL

08:12 — The older mobile hotspot begins logging in the top of his bag.

10:41 — He crosses a courthouse square.

13:06 — He walks through a street festival dense with phones and temporary radios.

22:17 — The local dashboard shows a timestamped warning. He matches the time to the square from his own notes; location logging was not enabled on the device.

A phone chooses among eligible cell sites using carrier and network priorities. A simulator tries to enter that trusted process and sends control messages designed to make nearby devices identify themselves or accept suspicious conditions. Rayhunter watches that signaling conversation inside the modem. The hotspot did not block anything. It cannot tell him whether the event came from police equipment, carrier maintenance, a configuration error or a false positive. It gives him a timestamp and packet capture that an expert might examine.

Before the walk, he had no reason to ask what the tower was doing. After it, he has a precise question and no culprit.

Transmission 05THE HOUSE CALL IN HIS PALM

SCENE // FICTIONAL

His father has had a cough for three days and has no interest in spending four hours at urgent care to be told that he has a cough. During a telehealth appointment, the clinician asks for a temperature and then for the white object on the kitchen table.

He passes it across. The device guides his father through several positions on the chest and records the sound moving through lungs and heart. A contactless scan measures temperature. Thirty seconds with two fingers on its metal electrodes produces a single-channel trace of the heart’s electrical activity.

A one-lead ECG watches the heart from one electrical angle; a hospital’s twelve-lead system looks from many. The stethoscope makes sound portable, not diagnosis automatic. What changes is the telehealth call: the clinician can receive more than a description and decide whether the kitchen is still the right room for the patient.

His father plugs in headphones and hears his own heartbeat while the same recording crosses the Withings servers to the clinician. The kitchen has become both an examination room and a network endpoint.

After listening to the uploaded recording, the clinician books an in-person examination for the morning. The pocket clinic ends by opening a real clinic door.

Transmission 06THE SKY TAKES VOICE NOTES

SCENE // FICTIONAL

His sister’s phone vibrates in a supermarket checkout line. The Garmin Messenger app shows a seventeen-second recording: they are safe, the cabin road is blocked and they will be late.

Forty minutes earlier, the road had ended at a fallen tree. The alternate route added two hours and dropped cellular service before the first turn. He stepped into an open patch, pressed the side of the orange communicator and recorded the message. The status remained on WAITING while the device looked for a clean link. A satellite voice message is stored and sent when the link opens; it is not a telephone call.

The route is still private infrastructure: Iridium satellites, Garmin servers, a paid plan and enough open sky to complete the link. The difference is geographical. A terrestrial carrier can abandon the road while the small device continues looking upward.

She replies before the cashier scans the last carton. Forty kilometers away, her answer reaches the network he carried.