> ## Content Index
> Fetch the complete content index at: https://www.ostering.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Elevation of Care

- URL: https://www.ostering.com/elevation-of-care-threat-modeling-game/
- Published: 2026-11-05T21:03:00.000Z
- Updated: 2026-11-05T20:30:13.845Z
- Description: A threat modeling card game for systems that watch over someone at home: 74 threat cards, and one player speaks for the person being watched.
- Author: Brett Crawley
- Tags: IoT Security, Privacy, Threat Modeling

![Elevation of Care: a threat modeling card game for the systems that watch over someone at home. The title on a name badge over a striped nurse's tunic, with a fan of five game cards.](https://www.ostering.com/media/posts/199/linkedin-article-cover-1920x1080.png =1920x1080)

# Elevation of Care: Threat Modeling the Systems That Watch Over Someone at Home


**TL;DR:** Elevation of Care is a new trick-taking threat modeling card game for the systems that watch over someone at home on someone else's behalf: baby monitors and smart socks, personal alarms and fall detection, ambient sensors, cameras with talk-back, and monitoring under a care plan. It has 65 threat cards in nine suits that follow the chain of care, 9 Trumps and three mitigation prompts on every card. One player speaks for the person being watched, who is never at the design table. You play it against your own system and leave with a findings log, not just a score.

## Silence looks like safety

I build threat modeling games for the parts of a system the general frameworks reach only partly. Elevation of Email Flow covers the machinery that delivers email, and Software Factory covers the machinery that builds software. Elevation of Care covers something closer to home.

Millions of homes now have a system that watches someone on someone else's behalf. A parent watches a baby through a camera with talk-back. A daughter in another city gets an alert when her father has not moved since two in the morning. A monitoring centre answers a pendant press. A mental health service checks a young adult's flat at night under a care plan. These products are sold as reassurance, and they fail in ways that look like reassurance. A sensor with a flat battery looks like a quiet night. An alert accepted by a push service looks delivered. A model that has slowly learned a decline as normal reports a normal week.

They also have an awkward property that most threat models never write down: **the person being watched is not the person using the product**. Someone else buys it, sets it up and reads its alerts. A baby cannot consent at all, a child's capacity grows every year, an older person's may be fading, and a person in mental health care may have full capacity one month and not the next.

At first glance, STRIDE and LINDDUN should cover this. STRIDE finds the stolen account, the spoofed sensor and the stream someone else can watch. LINDDUN finds the inference and the disclosure. Neither asks whether an alert reached a person rather than a phone, whether an ex-partner can still see into the nursery, whether the only watcher is asleep, or whether the person in the chair ever agreed. The rules don't help much either: consumer IoT security law, medical device law and care standards each cover a slice, and a single line of marketing copy can move a product from one to another. Nothing walks the whole chain of care in a form a design review can use. So I built one.

## What is Elevation of Care?

Elevation of Care is a card game for 3 to 6 players that takes 60 to 90 minutes. It uses the trick-taking engine Adam Shostack made famous with Elevation of Privilege (EoP): every card is a threat, stated as a property of the system or a design decision.

The deck has **nine suits** that follow an alert from the person to the people who respond, plus the people around it and the record it leaves:

- **Sensing, Interpretation, Alerting and Response:** the chain from the sensor to the person who acts.
- **Resident and Care Circle:** the person watched over at one end, and the watchers at the other: parents and co-parents, family, paid carers, agencies and clinical teams.
- **Sight and Sound:** cameras, microphones and talk-back, which carry the person straight to the watchers.
- **Data and Inference and Lifecycle:** what the record reveals and how long it lasts, and the device's life from the box to the bin.

![The chain of care, suit by suit: Resident, Sensing, Interpretation, Alerting, Response and Care Circle in a row, Sight and Sound arcing over them from the person to the watchers, Data and Inference and Lifecycle underneath, and 9 Trumps covering the whole system.](https://www.ostering.com/media/posts/199/visual-care-chain-1600x900.png =1600x900)

Each suit holds six to eight cards, ranked by severity with the Ace the most severe, which gives 65 threat cards. On top of them sit **9 Trumps**. These are hazards of the domain itself rather than of one suit, with names like *Silence Reads as Safety*, *The Watched Is Not the User* and *Capacity Is Not Fixed*. A **Life-safety** badge marks the 45 threats that can leave someone without help when they go wrong.

Every card also carries **three mitigation prompts**: plain questions your design should be able to answer. Take the Ace of Alerting, *Delivered to a Phone, Not a Person*:

> The push service accepted the alert, so it counts as delivered. The phone was on silent in another room.

- Which alerts must a person acknowledge?
- Who is called if nobody does within five minutes?
- Can it break through silent and do-not-disturb?

You don't have to be a security specialist to ask those questions, and you don't have to be an engineer to answer them. That is the point: the people who should be at this table include care staff, safeguarding leads and the team that runs the monitoring centre.

## How do you play it?

You play against **your own system**, not a made-up one. Here's how a session runs:

1. **Draw the system.** The team draws its system on the Care Map, an A3 sheet with zones for the home, the home network and radio, the cloud, the watchers, the response, the services and clinical teams, and the outside world. At the bottom is a strip for the people: who is watched over, who watches, and who else lives there. Most architecture diagrams stop at the phone; this one doesn't.
2. **Choose a care plan.** Pick three or four suits that match the system, or start from a ready-made care plan: baby and child monitors, telecare and personal alarms, clinical or supported monitoring, or the platform and business. Shuffle them with the Trumps and deal every card.
3. **Name a Scribe and a Resident's Voice.** The Scribe keeps the findings log. The Resident's Voice speaks for the person in the chair.
4. **Lead and claim.** The leader plays a card, reads the threat aloud and makes a claim: which element it lands on, and how. Everyone else follows suit, each claiming the threat against a different element.
5. **Test the claim.** The table tests each claim with the card's three prompts. If the design can't answer one, that is a **finding**. If it can, the Scribe logs **no exposure** with the reason, which is worth having too.
6. **Take the trick.** The highest Trump, or else the highest card of the suit led, takes the trick and leads the next.

![How a trick plays: Asha leads the Ace of Alerting for a finding, Ben follows with the King of Alerting for another, Chen plays Silent Sensor and the design answers it, and Dee plays the Trump Silence Reads as Safety to link the two findings and take the trick.](https://www.ostering.com/media/posts/199/visual-how-a-trick-plays-1600x900.png =1600x900)

### The Resident's Voice

This is the one rule Elevation of Care adds to the engine. One player speaks for the person watched over. Once per trick, when the table proposes a fix, the Voice asks: **"And how does this feel from the chair?"** If the table agrees the fix moves the harm onto the person (more watching, less dignity, less say), the Scribe writes the trade-off beside the finding. It scores nothing, so nobody games it.

It earns its place quickly. In this domain every safety control costs privacy, and every privacy control can cost a missed alert. The obvious fix for a pendant left on the bedside table is an alert to the family every morning. From the chair, that is a way of telling an 84-year-old man off for taking a shower. The Voice doesn't veto the fix; it makes the team say which harm it chose.

### Scoring

| Points | For |
| --- | --- |
| +1 | A finding the table accepts |
| +2 | A Trump finding, which must link two or more elements or earlier findings |
| +1 | Taking the trick |
| 0 | No exposure, or a pass |

Trumps beat every suit card, but you can't lead one until one has been played, so they arrive late, when the log is already filling. A Trump claim has to tie earlier findings to one design-wide decision, and the table has to agree an architectural response. That teaches players to stop patching findings one by one and look for the decision behind them.

Finding a weakness in your own product is normally unwelcome. Here it is how you win, so people go looking for it, and the person who answers the night calls can outscore the architect. The real prize is the findings log.

There are other ways to play too: a no-scoring **walkthrough**, a 30-minute **ward round** on one part of the system, a **full round** of all nine suits across three sessions, and **empty chair**, where a chair stays empty at the table for the person watched over.

## What's in the box?

The game is themed on nursing without being clinical. Every card is a striped tunic in a uniform colour, one for each suit, the way nursing roles are told apart by colour on a ward, with an object pinned above the pocket: a pendant alarm, a nursery camera, a clipboard chart, a key on a ring, a name badge, a case file, a parcel with a luggage tag. The emblem is a nurse's fob watch, pinned upside down so the wearer can read it, with five minutes marked in coral: the time an alert can wait before someone else is called. Type is large and plain, because care staff should be able to read the cards across a table.

- **76 cards** in a tuck box: 65 threat cards, 9 Trumps, a quick-reference card and a taxonomy card with a QR code.
- **A quick-rules concertina** in the tuck box, so the deck can travel and be played on its own.
- **An A3 Care Map** to draw your system on.
- **A pad of findings logs**, with a column for the Resident's Voice.
- **An A3 rules sheet** that folds down to the size of the box.
- **Hollyhock**, a worked example, as a 24-page booklet with its A3 drawing.
- **Larkspur**, a system to threat model yourselves, as a 12-page booklet with its A3 drawing.

[AVAILABILITY: TO BE CONFIRMED BEFORE PUBLISHING. How and when people can get the game.]

## What does a good claim look like?

The hardest part of any threat modeling game is the first claim. To show what "specific enough" sounds like, the game comes with a worked example against **Hollyhock**, a fictional home monitoring service for older people and adults living with long-term conditions. It is sold to families and to home-care agencies in four countries, with a 24/7 response centre run by a contractor, ambient sensors, a pendant, a home hub with a cellular backup, a family app, an agency portal and a routine model that learns each home. Its 12 design decisions are a mix of sound and weak, and most of them are common.

Four players work through two sessions and then the remaining Trumps:

- **Session 1, Telecare and personal alarms:** Sensing, Interpretation, Alerting and Response, against the sensors, the routine model, the family app and the response centre.
- **Session 2, people, data and lifecycle:** Care Circle, Resident, Data and Inference, and Lifecycle, against the watchers, the agency portal and the record.

The log ends with **24 findings, 7 of them critical**, and 4 cards logged as no exposure, each with its reason. The Trumps show why they come last. *Silence Reads as Safety* ties together a sensor that goes quiet without anyone noticing and a routine model that keeps learning while its inputs are broken. Each was already a finding. Together they point to one architectural response: treat missing data as an event, give every link in the chain an expected heartbeat, and make a missed heartbeat reach a person. That is the first item on Hollyhock's backlog, and it is a better outcome than two separate tickets.

**Larkspur**, the second booklet, has no answers in it. It is a nursery camera and a baby's sock with a "growing up" mode for older children, and a supported-living pilot with a community mental health service. Draw it, play it, and compare your log with someone else's.

## Where do the threats come from?

Elevation of Care is the latest in my family of threat modeling games, and like the others, the game came first. Writing the deck meant writing a taxonomy of care monitoring: 74 threats in nine suits plus nine structural hazards, each with a mitigation principle and concrete design measures behind its three prompts. That taxonomy is published as the [Care Assistant Threat Taxonomy](https://ostering.com/taxonomies/care-assistant/), with a page for every suit, and its reference is the game: each card is an entry, with the same reference. Why it exists, and what the existing frameworks miss, is in [Nobody Asked the Person Being Watched](https://ostering.com/nobody-asked-the-person-being-watched/).

The threats are not speculative. In 2019 a stranger [spoke to an eight-year-old through the camera in her bedroom](https://abc7.com/ring-security-cameras-studio-city-hacker-camera-hacked/5750794). A flaw in a widely used camera SDK, [CVE-2021-28372](https://cloud.google.com/blog/topics/threat-intelligence/mandiant-discloses-critical-vulnerability-affecting-iot-devices), let attackers impersonate devices, baby monitors among them, and watch live video. Alert clips from one baby monitor were [reachable in its cloud storage](https://www.bitdefender.com/en-us/blog/labs/severe-vulnerability-in-ibaby-monitor-m6s-camera-leads-to-remote-access-to-video-storage-bucket). When US carriers switched off 3G in 2022, [medical alert systems that depended on it stopped working](https://www.phlp.org/en/news/certain-life-alert-systems-will-no-longer-work-following-3g-shutdown). And a baby sock that told parents when oxygen levels fell was [treated by the US regulator as a medical device](https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/owlet-baby-care-inc-616354-10052021). Most of the cards, though, are threats that follow from how these systems work and who uses them, even where nobody has written up an incident yet.

### Credits

The trick-taking format comes from **Elevation of Privilege** by Adam Shostack, released by Microsoft under CC BY 3.0. Elevation of Care reuses none of its card text or artwork. **LINDDUN**, the privacy threat framework from KU Leuven, shaped how the privacy cards are framed. The researchers, journalists and regulators who documented what goes wrong did the hard work. The cards turn that work into questions a team can ask about its own design.

## Final thoughts

Care monitoring is sold to the people who worry, and used on the people they worry about. It is also the part of the connected home we threat model least, not because teams don't care, but because nobody hands them the questions, and nobody at the table speaks for the person in the chair. Elevation of Care puts 222 of those questions on cards, gives one player the job of speaking for that person, and asks a table to argue about both against their own design.

It won't replace a safety case or a privacy impact assessment. It will get the product team, the engineers, the safeguarding lead and the person who runs the monitoring centre in one room, looking at the same drawing and writing down what they find. In my experience, that is the part that rarely happens.

**Note to product teams:** play the care plan that matches your product before your next release or certification, and keep the findings log. The "no exposure" lines are evidence too.

**Note to care providers and services that commission monitoring:** you are on the Care Map as well. Play the Care Circle and Resident suits against the service you run, not just the product you bought.

I'd love to hear how it plays at your table: the claims that started arguments, the trade-offs the Resident's Voice made you write down, and the threats you think are missing.

Stay tuned!

## Sources

- [Ring camera in a child's bedroom](https://abc7.com/ring-security-cameras-studio-city-hacker-camera-hacked/5750794), ABC7 (2019)
- [Kalay SDK device impersonation, CVE-2021-28372](https://cloud.google.com/blog/topics/threat-intelligence/mandiant-discloses-critical-vulnerability-affecting-iot-devices), Mandiant (2021)
- [iBaby Monitor M6S cloud storage](https://www.bitdefender.com/en-us/blog/labs/severe-vulnerability-in-ibaby-monitor-m6s-camera-leads-to-remote-access-to-video-storage-bucket), Bitdefender (2020)
- [Medical alert systems and the 3G shutdown](https://www.phlp.org/en/news/certain-life-alert-systems-will-no-longer-work-following-3g-shutdown), Pennsylvania Health Law Project (2022)
- [Warning letter to Owlet Baby Care](https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/owlet-baby-care-inc-616354-10052021), US Food and Drug Administration (2021)

## Related

- [Care Assistant Threat Taxonomy](https://ostering.com/taxonomies/care-assistant/): every card's threat, principle, design measures and mappings to STRIDE, LINDDUN, CAPEC and CWE
- [Nobody Asked the Person Being Watched: A Threat Taxonomy for Care Monitoring at Home](https://ostering.com/nobody-asked-the-person-being-watched/), with the sources for every public case
- [Mapping the Care Assistant Threat Taxonomy to STRIDE, LINDDUN, CAPEC and CWE](https://ostering.com/care-assistant-taxonomy-stride-linddun-capec-cwe-mapping/)