Direct answer
In threat models, “concepts” are the structured building blocks you define up front—what you’re protecting, what you fear, and what protections you assume. “Operation” is how those concepts play out in real life: when and where your privacy controls are used, which network paths they cover, and which behaviors you must maintain for them to keep working. For a privacy-conscious digital nomad, this means you reason in scenarios (camp café, hotel Wi‑Fi, mobile data, shared devices) rather than expecting one permanent outcome.
How it works
A practical threat model starts by defining operating conditions. First, identify assets: for example, browsing destinations, device identifiers, and metadata like IP address visibility. Next, identify actors: local observers on a Wi‑Fi network, website operators, network intermediaries, or your own device risk from malware or misconfiguration. Then choose protections and assumptions: encryption-in-transit can reduce exposure to passive network observers, but it does not automatically fix endpoint compromise, malicious apps, or bad user practices.
“Operation” covers two things. (1) Coverage: which traffic is protected under what circumstances (managed device vs. unmanaged device; specific apps vs. everything). (2) Failure modes: what happens when connectivity changes, when apps bypass protection, or when you switch locations and networks.
Practical context for a privacy-conscious digital nomad
Use concept-and-operation thinking to compare scenarios. For example, on unfamiliar Wi‑Fi, you might prioritize reducing what local observers can see; when traveling across regions, you might focus on maintaining consistent protective behavior despite changing networks.
A useful mental checklist: if your threat is “someone on the same network,” you model passive observation; if your threat is “tracking by websites,” you model how identifiers persist beyond encrypted transport; if your threat is “compromised laptop,” you model endpoint hygiene and application behavior. This keeps you from treating any single control as a universal solution.
Limitations and what to verify
Major limitations: a VPN (or any encryption-based transport) does not guarantee anonymity, safety, or uninterrupted access. Performance and availability also vary by device, network type, provider, location, and time.