  The design of the defenses Internet systems can deploy against attack,
especially adaptive and resilient defenses, must start from a realistic model
of the threat. This requires an assessment of the capabilities of the
adversary. The design typically evolves through a process of simulating both
the system and the adversary. This requires the design and implementation of a
simulated adversary based on the capability assessment. Consensus on the
capabilities of a suitable adversary is not evident. Part of the recent
redesign of the protocol used by peers in the LOCKSS digital preservation
system included a conservative assessment of the adversary's capabilities. We
present our assessment and the implications we drew from it as a step towards a
reusable adversary specification.
