Chelsea Handler (127:29)
Hello and welcome back to It Could Happen Here, a show that is no longer hypothetical now that it is happening here. I'm your occasional host, Molly Conger, and today I just want to talk to you a little bit about your online security. It's a hot topic right now for obvious reasons and this won't be a comprehensive overview on the subject by any means. I'm sure there will be more episodes in the future covering specific angles on this in more depth. But today I just want to touch on some basics, especially for people who may be asking themselves some of these questions for the first time. This is more of a mental framework and a pep talk. The main message here is don't freak out. I'm not saying the situation isn't serious or your concerns aren't real. It's very serious. But freaking out is not going to do you any good. And if you're looking for complicated high tech solutions to the very real anxiety that you're feeling right now, this episode doesn't happen. It that's not what I have for you today. And I know a lot of people have really specific concerns about apps they might be using to track their menstrual cycles or fertility. And we're not going to touch on that today because I think it's a topic that deserves its own episode and an episode where I talk to an actual expert. So I'm hoping to get that out next month. So what are we talking about? The answer is pretty simple. Calming down and shutting up. That's right, it's only Thursday when this airs, but it is always Shut the fuck up Friday in our hearts. Because the main source of the risks you can do something about is your own mouth. Because here's the thing. I'm not an expert on digital security. I'm not a computer programmer or a hacker. I had to call our producer Danil one time because I went to record an episode in my little recording device, said no, and I almost cried. And it turned out I accidentally slid the little tab on the data card that locks it. I don't know. But what I do know a lot about is how to exploit someone else's lack of digital security. If you're a listener to my show, Weird little Guys, you know that I kind of have a knack for finding out everything there is to know about a guy. So what I can offer you is a sort of reverse engineered guide to stay safe online from someone like me, but evil. I like to tell people that you should be thinking of your digital security, kind of like your health. People are going to have different risk factors, different vulnerabilities, different concerns, different goals. If you're undocumented or on a student or work visa, the risks and possible consequences for you are very different. If you're queer or trans or a person of color, your risk profile looks different. If you're economically dependent on family members whose politics don't align with yours, your risk profile is different. If you have a criminal record, if you work in a field where your political activity is a significant threat to your continued employment, if you're running for office, if you have a security clearance, if you have children or vulnerable family, these are all different vulnerabilities. And you're going to have specific concerns that are unique to you. And this isn't meant to address those specific risk scenarios. But just like people who may have different risk factors when it comes to their health, everyone can benefit from the basics. You know, no matter who you are, you have to wash your hands. And when it comes to digital security, a lot of people want to jump right to the exciting, complicated, technical fixes. You know, they want the Kim Kardashian full body MRI equivalent of being safe online. People want to talk about buying burner phones and getting a Faraday bag and evading high tech surveillance, but they're not washing their hands. People love to say they're going to buy a burner phone, but if you go to Walmart and you buy a burner phone and you put your credit card into the machine that is recording a video of your face, and then you take that phone home and turn it on inside your house next to your real phone, you've done nothing but waste your time and money. So we're not talking about solutions like that. What we are talking about is boring, unsexy, basic stuff that everybody can and should be doing before they jump into the deep end if you choose to go that route. Because I'm not saying you shouldn't worry about more advanced threats. I'm just saying you have to start here. So before you can figure out how to mitigate a risk, you have to nail down what that risk actually is. What is the outcome that you're hoping to avoid. There's a lot of anxiety right now about unknowable possibilities. And it's really easy to get Overwhelmed with the what ifs of a worst case scenario. And then you just end up feeling really helpless. And look, yeah, there are, there are some potential threats here that I don't have the tools to help you address. But that doesn't mean you shouldn't be taking the steps that are within your control right now. You have to fight off that feeling of helplessness. So what we're talking about here is threat modeling. I gave a little workshop a few months ago about digital security. And the first thing I asked the group was, what is the bad thing that you were worried will happen? And most people's answer to that was they're worried about getting doxxed. Okay, that's, that's fair. That's a valid fear. But what do you mean by that? What specifically is the piece of information you are worried someone will discover? Is it your name, your address, where you work? Is it connecting two pieces of your online identity that you thought were separate? Doxing can mean a lot of things to different people and in different contexts. And it can happen in degrees, right? Like, you know, my full legal name, I'm, you know, doxed to whatever extent that means anything. But this could still happen to me. Someone could still discover a piece of information about me that I wish they didn't have. And most people can't become completely anonymous. I, I can't help you do that. And honestly, I don't think that should be most people's goals. Don't disappear. I'm not telling you you should disappear. This is just about figuring out what makes sense for you and what you can do to navigate the landscape that you've chosen to operate in. So what is the actual negative outcome specifically that is making you feel afraid? What is the concrete thing that you are thinking about when you experience that fear? And people's answers tend to be that they're worried about getting harassed, they're worried about their physical safety, they're worried about negative fallout at work or at school. People's fears tend to be about things like getting arrested, getting sued, getting fired, getting hurt, and getting embarrassed. And so the next question is, can you identify the potential sources for the kinds of harm you're worried about? And you can sort these into a few primary categories. The state can harm you. That's the police, the government, you can get charged with a crime. Institutions can harm you. If you're a student, you can get in trouble at school. If you have some kind of professional license, people could file complaints against you. Politicians and organized political groups can harm you. You know, Marjorie Taylor Greene might tweet your TikTok video, or Canary mission might do a blog post about where you work and right wing groups can harm you. You might get targeted harassment from some Nazi telegram channel. Worst case scenario, maybe you were physically threatened or attacked by an extremist group. You could get swatted. And then there's just this sort of wild card of the random strangers and Internet mobs and the way they factor into and exacerbate all of the above scenarios when it comes to harm from the state. That's beyond what we're talking about with this digital hand washing metaphor. A lot of the prevention steps you can take today are still going to help you. They're still worth taking. But at the end of the day, if the government wants to know who runs a Twitter account, who drove to a protest, who supported a movement, who donated money, that's beyond the basics. Most of what I have direct experience with are just these basic measures that you can take take today to make it a little bit harder for the average weird little guy to get into your business. It'll stop the average online troll, it'll slow down a decent sleuth, but it's not the kind of stuff that stops a guy with a warrant. Think of protecting your online identity like being inside your house. If you have no curtains, someone walking down the street can see you even if they they didn't go out of their way to look. If you're putting everything out there with no thought to digital security, somebody could dox you without even trying. Just like they would be able to see in through your windows from the street. Somebody who is a little more curious about you might walk into your yard. But if you put up a fence, maybe that person will decide this isn't really worth my time. Somebody who loves peeping in windows and really wants to see you, he's going to hop your fence, right? But the average troll will see these barriers and they'll get bored. But again, curtains, a fence, a locked door, a guard dog, these don't stop a guy with a warrant. So we're talking about just putting up barriers that slow down and discourage the average low to mid level weirdo. In short, delete your Facebook, set your accounts to private use, sign signal, put a passcode on your phone, say less and try to do something about the data brokers. Let's break these down one at a time. I'm sure it's been talked about on this show before, but I tell everyone in my life, download signal, download signal. It's free. Put it on your phone. It's just an encrypted messaging app, and I use it by default pretty much exclusively in place of regular texting, just because it's easier for me to have everything in one place. It doesn't collect or store your metadata. It doesn't back up to the cloud. And you can set all of your conversations to automatically disappear at whatever time interval you choose. You don't need text messages from a year ago. You don't. Those can never help you. They can only hurt you. Just let them go. And turn off the biometric unlock on your phone, whether that's a fingerprint or a face id. Turn it off. Turn it off. Set a passcode. If you get arrested and you have your phone on you, they can use your finger or your face to unlock it without a warrant. But if you have a passcode, you're a little bit safer. So set a passcode that's at least six digits long, longer if you can bear it. I know. But when it comes to social media, you have some choices. You may look at your own threat model and say, well, I don't care if everyone can see what I've posted, and that's okay, right? We all have different goals and vulnerabilities. And if you're a very public organizer, then, yeah, you need public social media. But if you've been using Facebook for 20 years, you probably weren't always very careful about what was on there. And there are privacy settings now where you can retroactively set all of your old posts to a new privacy settings. You should do that. Start there. If you haven't done that. But that still leaves a lot of digital debris. If you've changed your display name to something more private in recent years, something that isn't your current legal name, old posts that other people made about you still have your old name in them. So if they tagged you 10 years ago, that old name is still a link to your current profile. And you can't control the content that your friends and family posted years ago. And on the flip side, if in the end you decide you don't care what's on your Facebook about you when you're doing your threat modeling, consider the people close to you. Because when I'm working at this from the other side, a lot of times I'll find that, you know, the guy that I'm looking for has done a pretty good job cleaning up his own digital presence, but his wife, his mom, his sister, someone in his life has not. So if there's someone in your life who maybe is at greater risk than you are. Don't be their weak spot. And if you're in a position to do so, talk to the people in your life about this. Have these conversations about what are our risks, what are our goals. Let's do a digital hygiene tech together, because you can build an impenetrable digital fortress around yourself. But if your Aunt Kathy is live streaming your baby shower, that didn't do you much good. And now that more people are talking about these kinds of concerns, you can try broaching the subject with people in your life that may not have been receptive to it a year ago. Show your mom how to set her Facebook to private Take the time to explain to your less political siblings why they should think about the ways in which their social media use might expose someone they care about. Don't just scold them or, you know, say it's reckless that you're doing this. Talk about why. So when it comes to social media, I'm saying delete your Facebook as a sort of shorthand for the general cleanup of the stuff that you've left online for the last 20 years. Cleaning up your online presence is the number one thing you can do right now to thwart the Bizarro Universe version of me, who is trying to collect every piece of information about you. Because even if you're careful today, even if you're so smart about it now, and you're not putting anything online that puts you at risk, you weren't always that careful. We're all guilty of it. People who've been doing this for a long time, people who know better. We're all guilty of being a little messy online. Fine. It's okay. There's no shame that you didn't know before. Don't feel silly. Don't feel guilty. Just start cleaning it up today. And so, to figure out what exactly you might have been leaving out in the open, one thing you can try is doxing yourself. Or do it with a friend, right? Try doxing each other. So start with a completely clean cache. Delete your cookies, whatever. Open an Incognito browser. Start with a blank slate and just Google yourself. Google your name, your address, your phone number. Google the usernames that you currently use on various sites, but Google the username you used in high school. Google your old AIM handle. Google the email address you made when you were 12. What comes up and is that information you want everybody to have? Probably not. Start by deleting accounts you don't use anymore. Just wipe those bad boys right out. You don't need those. A lot of people have no idea that the ghost of their old MySpace page still exists online. I've actually used that one fairly recently to confirm the details about a person's close associates and family members. They hadn't logged into MySpace since 2010, but your top eight lives forever. So delete or set to privates any account that you don't use, don't need, or just don't need to be public facing. Log into every social media site, every forum, every online store where you've ever created an account, and just look at what's visible. Your online reviews may contain information about where you live. Your profile on some forum you Posted on in 2012 probably has your birthday on it. And if you're an active Pinterest user, your Pinterest boards are probably revealing a lot more information about you than you realize. Information about your family, your interests, your plans for the future. People will make Pinterest boards with names like Jaden's second birthday. And now I know that you have a son named Jaden whose second birthday party you were planning last July. That's a real example. So set these things to private. Change your profile picture to something that isn't your face. Look at your username. Did you have to put some numbers at the end of that because the one you wanted was taken? Are those numbers your birthday? And vary your usernames a little bit. Unless you have some kind of professional reason for using a personal brand across every platform, don't use the same username everywhere. Keep separate areas of your life separate. Don't make it any easier than it needs to be to connect these different pieces of your digital footprint into one picture of who you are. Because again, I'm not talking about becoming completely anonymous online. A lot of people need to exist online as the person that they are. You have a LinkedIn, you do public facing organizing. I'm not saying you need to disappear from online, but if you have accounts that you don't want connected back to your true identity. If there are pieces of you that exist that you don't want side by side, don't connect them. So if you anonymously run a social media account for an activist group group, don't use it to follow your own real account. Don't like your boyfriend's posts when you're logged into your anarchist shitposting account. If you don't want it connected to you, don't create overlap. If you post a screenshot from one social media platform onto another. You know, a screenshot of a tweet on your Instagram, whatever, be mindful of what's in that image. Is there a thumbnail of your own profile picture in there? Does the screenshot show that you interacted with that post? Because a filled in heart on an Instagram screenshot is something I have used as a building block for a docs. And maybe you've never posted anything identifiable on Twitter, but have you ever posted a link to your Twitter account on Reddit? Or are you in a big discord and you shared one of your own posts with your friends in there, like, hey, look at this banger tweet. I'm going viral. And I say both of those specifically because both of those are specific mistakes that I have seen people make that were for me a crucial link between two accounts that connected the dots. To figure out who they were, use two factor authentication, use a password manager, use complex passwords, never recycle a password. Check databases like have I been pwned? See what's been leaked about you. And some of that data is out of your control now, but it's out there and you can't claw it back. But you can change all of your passwords today. You can download a password manager and change all of your passwords today. And all of your passwords should be something different from one another. I'm going to say it again. Change all your passwords. Stop using your dog's name as your password for everything. It was hard, but I did it. Okay? And when you're doing this digital hygiene check, you know, you're googling yourself, you're checking these breach databases. One of the things you're going to find is your address, your email address and your phone number and your parents name names and your parents address. All of these pieces of what you thought were personal private information, they are bought and sold to data brokers. And these data brokers put them online on sites that people can pay to access. Be like people finder, true people search white pages. There's hundreds of them. Now, by law, all of these sites have to have a link on them somewhere where you can ask them to delete your information. Some of them make it kind of hard and it may take weeks for them to actually honor the request and you may have to follow up. But theoretically, if they're operating legally, you do have the ability to manually clean up how much of your personal information comes up from these data brokers. But I'll be honest with you, it's whack a mole. You could spend one afternoon a week for the rest of your life making opt out requests and following up on them and checking back to make sure it's really gone on you. You can do that. I used to do that. But there are also services that will do it for you for a fee. I think there may be an episode in the pipeline examining that particular ecosystem in some more detail. So I won't go into the pros and cons of different services that exist. But if that's something you're interested in paying for, do some research about it before you put your money down. But at the end of the day, I just want you to remember you can't solve this whole problem. That might sound like a defeatist message, but I think it's healthy. I'm not saying it's hopeless. I'm saying you have to spend your energy where it counts. People ask me all the time, you know, are you worried about this or that specific threat? And the answer is, yeah, probably. Yeah, of course I'm worried. But you can't let that fear overwhelm you. You know, if I get fixated on the existence of threats that are outside of my control, I'll just freak out. And that makes me less capable of focusing on mitigating the threats that are within my control. So don't put blinders on. Don't lie to yourself. You know, be realistic. But don't wear yourself out worrying about things that are so far out of your control that all you have is fear. So today, now take a deep breath, delete your MySpace account, and talk to your mom about setting all her old Facebook pictures to private.
