Everyone is skittish about security, and few people can articulate the difference between security and privacy, so I had to use very precise language. The potential danger of overselling or under-emphasizing a threat is surprisingly dire. Both will hurt the user. So I was often more focused on what NOT to say, and I maintained a running list of forbidden words. For example, the word "safe" isn’t useful because we can't fully guarantee anything is safe.

I worked with some of Google’s best security experts and legal counsel to create a catalog of 25 types of threats and then design clear language for each. I also vetted the threat notification strings with experts so that the user would be more likely to take the appropriate reaction.