Everyone is skittish about security, and few people can articulate the difference between security and privacy on their device, so I had to simplify things down to very simple but precise language. The potential danger of overselling or under-emphasizing a threat is surprisingly dire. Both will hurt the user.

So I worked with some of Google’s best security experts and legal counsel to create a catalog of 25 types of threats and then design clear language for each. I also vetted the threat level strings with experts so that the user would be more likely to take the appropriate reaction.

As is often the case with sensitive work, I was often more focused on what not to say, and I had to maintain a running list of forbidden words. For example, the word "safe" isn’t useful because we can't fully guarantee anything is safe.