  Data flow diagrams (DFDs) are popular for sketching systems for subsequent
threat modelling. Their limited semantics make reasoning about them difficult,
but enriching them endangers their simplicity and subsequent ease of take up.
We present an approach for reasoning about tainted data flows in design-level
DFDs by putting them in context with other complementary usability and
requirements models. We illustrate our approach using a pilot study, where
tainted data flows were identified without any augmentations to either the DFD
or its complementary models.
