Speaker 1: Cool Zone Media. Hello, and welcome back to It Could
Speaker 1: Happen Here, a show that is no longer hypothetical now
Speaker 1: that it is happening here. I'm your occasional host, Molly Conger,
Speaker 1: and today I just want to talk to you a
Speaker 1: little bit about your online security. It's a hot topic
Speaker 1: right now for obvious reasons, and this won't be a
Speaker 1: comprehensive overview on the subject by any meanings. I'm sure
Speaker 1: there will be more episodes in the future covering specific
Speaker 1: angles on this and more depth, but today I just
Speaker 1: want to touch on some basics, especially for people who
Speaker 1: may be asking themselves some of these questions for the
Speaker 1: first time. This is more of a mental framework and
Speaker 1: a pep talk. The main message here is don't freak out.
Speaker 1: I'm not saying the situation isn't serious for your concerns
Speaker 1: aren't real. It's very serious. But freaking out is not
Speaker 1: going to do you any good. And if you're looking
Speaker 1: for complicated, high tech solutions to the very real anxiety
Speaker 1: that you're feeling right now, this episode doesn't have it.
Speaker 1: That's not what I have for you today. And I
Speaker 1: know a lot of people have really specific concerns about
Speaker 1: apps they might be using to track their menstrual cycles
Speaker 1: or fertility, and we're not going to touch on that
Speaker 1: today because I think it's a topic that deserves its
Speaker 1: own episode, and an episode where I talk to an
Speaker 1: actual expert. So I'm hoping to get that out next month.
Speaker 1: So what are we talking about? The answer is pretty simple,
Speaker 1: calming down and shutting up. That's right. It's only Thursday
Speaker 1: when this airs, but it is always shut the fuck
Speaker 1: up Friday in our hearts, because the main source of
Speaker 1: the risks you can do something about is your own mouth.
Speaker 1: Because here's the thing. I'm not an expert on digital security.
Speaker 1: I'm not a computer programmer or a hacker. I had
Speaker 1: to call our producer Danil one time because I went
Speaker 1: to record an episode in my little recording device said no,
Speaker 1: and I almost cried. And it turned out I accidentally
Speaker 1: slid the little tab on the data card that locks it.
Speaker 1: I don't know, but what I do know a lot
Speaker 1: about is how to exploit someone else's lack of digital security.
Speaker 1: If you're a listener to my show We're Little Guys,
Speaker 1: you know that I kind of have a knack for
Speaker 1: finding out everything there is to know about a guy
Speaker 1: so what I can offer you is a sort of
Speaker 1: reverse engineered guide to stay safe online from someone like
Speaker 1: me but evil. I like to tell people that you
Speaker 1: should be thinking of your digital security kind of like
Speaker 1: your health. People are going to have different risk factors,
Speaker 1: different vulnerabilities, different concerns, different goals. If you're undocumented or
Speaker 1: on a student or work visa, the risks and possible
Speaker 1: consequences for you are very different. If you're queer or trans,
Speaker 1: or a person of color, your risk profile looks different.
Speaker 1: If you're economically dependent on family members whose politics don't
Speaker 1: align with yours, your risk profile is different. If you
Speaker 1: have a criminal record, if you work in a field
Speaker 1: where your political activity is a significant threat to your
Speaker 1: continued employment, if you're running for office, if you have
Speaker 1: a security clearance, if you have children or vulnerable family
Speaker 1: these are all different vulnerabilities, and you're going to have
Speaker 1: specific concerns that are unique to you. And this isn't
Speaker 1: meant to address those specific risk scenarios. But just like
Speaker 1: people who may have different risk factors when it comes
Speaker 1: to their health, everyone can benefit from the basics. You know,
Speaker 1: no matter who you are, you have to wash your
Speaker 1: hands and when it comes to digital security. A lot
Speaker 1: of people want to jump right to the exciting, complicated
Speaker 1: technical fixes. You know, they want the Kim Kardashian full
Speaker 1: body MRI equivalent of being safe online. People want to
Speaker 1: talk about buying burner phones and getting a Faraday bag
Speaker 1: and evading high tech surveillance, but they're not washing their hands.
Speaker 1: People love to say they're going to buy a burner phone.
Speaker 1: But if you go to Walmart and you buy a
Speaker 1: burner phone, and you put your credit card into the
Speaker 1: machine that is recording a video of your face, and
Speaker 1: then you take that phone home and turn it on
Speaker 1: inside your house next to your real phone, you've done
Speaker 1: nothing but waste your time and money. So we're not
Speaker 1: talking about solutions like that. We are talking about is boring,
Speaker 1: un sexy, basic stuff that everybody can and should be
Speaker 1: doing before they jump into the deep end. If you
Speaker 1: choose to go that route, because I'm not saying you
Speaker 1: shouldn't worry about more advanced threats, I'm just saying you
Speaker 1: have to start here. So before you can figure out
Speaker 1: how to mitigate a risk, you have to nail down
Speaker 1: what that risk actually is, What is the outcome that
Speaker 1: you're hoping to avoid. There's a lot of anxiety right
Speaker 1: now about unknowable possibilities, and it's really easy to get
Speaker 1: overwhelmed with the what ifs of a worst case scenario
Speaker 1: and then you just end up feeling really helpless. And look, yeah,
Speaker 1: there are there are some potential threats here that I
Speaker 1: don't have the tools to help you address. But that
Speaker 1: doesn't mean you shouldn't be taking the steps that are
Speaker 1: within your control right now. You have to fight off
Speaker 1: that feeling of helplessness. So what we're talking about here
Speaker 1: is threat modeling. I gave a little workshop a few
Speaker 1: months ago about digital security, and the first thing I
Speaker 1: asked the group was what is the bad thing that
Speaker 1: you were worried will happen? And most people's answer to
Speaker 1: that was they're worried about getting docksed. Okay, that's fair,
Speaker 1: that's a valid fear, But what do you mean by that?
Speaker 1: What specifically is the piece of information you are worried
Speaker 1: someone will discover? Is it your name, your address where
Speaker 1: you work? Is it connecting two pieces of your online
Speaker 1: identity that you thought were separate. Docsing can mean a
Speaker 1: lot of things to different people at different contexts, and
Speaker 1: it can happen in degrees right, like you know my
Speaker 1: full legal name. I'm doxed to whatever extent that means anything.
Speaker 1: But this could still happen to me. Someone could still
Speaker 1: discover a piece of information about me that I wish
Speaker 1: they didn't have. And most people can't become completely anonymous.
Speaker 1: I can't help you do that, and honestly, I don't
Speaker 1: think that should be most people's goals. Don't disappear. I'm
Speaker 1: not telling you you should disappear. This is just about
Speaker 1: figuring out what makes sense for you and what you
Speaker 1: can do to navigate the landscape that you've chosen to
Speaker 1: operate in. So, what is the actual negative outcome specifically
Speaker 1: that is making you feel afraid? What is the concrete
Speaker 1: thing that you are thinking about when you experience that fear.
Speaker 1: And people's answers tend to be that they're worried about
Speaker 1: getting harassed, They're worried about their physical safety, they're worried
Speaker 1: about negative fallout at work or at school. People's fears
Speaker 1: tend to be about things like getting arrested, getting sued,
Speaker 1: getting fired, getting hurt, and getting embarrassed. And so the
Speaker 1: next question is can you identify the potential sources for
Speaker 1: the kinds of harm you're worried about, and you can
Speaker 1: sort these into a few primary categories. The state can
Speaker 1: harm you. That's the police, the government. You can get
Speaker 1: charged with a crime. Institutions can harm you. If you're
Speaker 1: a student, you can get in trouble at school. If
Speaker 1: you have some kind of professional license, people could file
Speaker 1: complaints against you. Politicians and organized political groups can harm you.
Speaker 1: You know, Marjorie Taylor Green might tweet your TikTok video
Speaker 1: or Canary Mission might do a blog post about where
Speaker 1: you work. And right wing groups can harm you. You
Speaker 1: might get targeted harassment from some Nazi telegram channel. The
Speaker 1: worst case scenario, maybe you were physically threatened or attacked
Speaker 1: by an extremist group. You could get swatted. And then
Speaker 1: there's just this sort of wild card of the random
Speaker 1: strangers and Internet mobs and the way they factor into
Speaker 1: and exacerbate all of the above scenarios. When it comes
Speaker 1: to harm from the state, that's beyond what we're talking
Speaker 1: about with this digital hand washing metaphor. A lot of
Speaker 1: the prevention steps you can take today are still going
Speaker 1: to help you. They're still worth taking. But at the
Speaker 1: end of the day, if the government wants to know
Speaker 1: who runs a Twitter account, who drove to a protest,
Speaker 1: who supported a movement, who donated money. That's beyond the basics.
Speaker 1: Most of what I have direct experience with are just
Speaker 1: these basic measures that you can take today to make
Speaker 1: it a little bit harder for the average weird little
Speaker 1: guy to get into your business. It'll stop the average
Speaker 1: online troll, it'll slow down a decent sleuth, but it's
Speaker 1: not the kind of stuff that stops a guy with
Speaker 1: a warrant. Think of protecting your online identity like being
Speaker 1: inside your house. If you have no curtains, someone walking
Speaker 1: down the street can see you, even if they didn't
Speaker 1: go out of their way to look. If you're putting
Speaker 1: everything out there with no thought to digital security, somebody
Speaker 1: could dock see without even trying, just like they would
Speaker 1: be able to see and through your windows from the street.
Speaker 1: Somebody who is a little more curious about you might
Speaker 1: walk into your yard. But if you put up a fence,
Speaker 1: maybe that person will decide this isn't really worth my time.
Speaker 1: Somebody who loves peeping in windows and really wants to
Speaker 1: see you, he's gonna hop your fence, right. But the
Speaker 1: average troll will see these barriers and they'll get bored.
Speaker 1: But again, curtains, a fence, a locked door, a guard dog,
Speaker 1: these don't stop a guy with a warrant. So we're
Speaker 1: talking about just putting up barriers that slow down and
Speaker 1: discourage the average low to mid level weirdo. In short,
Speaker 1: delete your Facebook, set your accounts to private, you signal,
Speaker 1: put a passcode on your phone, and say less and
Speaker 1: try to do something about the data brokers. Let's break
Speaker 1: these down one at a time. I'm sure it's been
Speaker 1: talked about on this show before, but I tell everyone
Speaker 1: in my life download Signal. Download Signal. It's free, put
Speaker 1: it on your phone. It's just an encrypted messaging app,
Speaker 1: and I use it by default, pretty much exclusively in
Speaker 1: place of regular texting, just because it's easier for me
Speaker 1: to have everything in one place. It doesn't collect or
Speaker 1: store your metadata, it doesn't back up to the cloud,
Speaker 1: and you can set all of your conversations to automatically
Speaker 1: disappear at whatever time interval you choose. You don't need
Speaker 1: text messages from a year ago, You don't. Those can
Speaker 1: never help you, They can only hurt you. Just let
Speaker 1: them go and turn off the biometric unlock on your phone,
Speaker 1: whether that's a fingerprint or a face ID, turn it off,
Speaker 1: turn it off. Set a passcode. If you get arrested
Speaker 1: and you have your phone on you, they can use
Speaker 1: your finger or your face to unlock it without warrant.
Speaker 1: But if you have a passcode, you're a little bit safer.
Speaker 1: So set a pass code that's at least six digits
Speaker 1: long longer if you can bear it, I know. But
Speaker 1: when it comes to social media, you have some choices.
Speaker 1: You may look at your own threat model and say, well,
Speaker 1: I don't care if everyone can see what I've posted,
Speaker 1: and that's okay, right. We all have different goals and vulnerabilities.
Speaker 1: And if you're a very public organizer, then yeah, you
Speaker 1: need public social media. But if you've been using Facebook
Speaker 1: for twenty years, you probably weren't always very careful about
Speaker 1: what was on there. And there are privacy settings now
Speaker 1: where you can retroactively set all of your old posts
Speaker 1: to a new privacy settings. You should do that start
Speaker 1: there if you haven't done that, but that still leaves
Speaker 1: a lot of digital debris. If you've changed your display
Speaker 1: name to something more private in recent years, something that
Speaker 1: isn't your current legal name, old posts that other people
Speaker 1: made about you still have your old name in them.
Speaker 1: So if they tagged you ten years ago, that old
Speaker 1: name is still a link to your current profile, and
Speaker 1: you can't control the content that your friends and family
Speaker 1: posted years ago. And on the flip side, if in
Speaker 1: the end you decide you don't care what's on your
Speaker 1: Facebook about you, when you're doing your threat modeling, consider
Speaker 1: the people close to you, because when I'm working at
Speaker 1: this from the other side, a lot of times I'll
Speaker 1: find that, you know, the guy that I'm looking for
Speaker 1: has done a pretty good job cleaning up his own
Speaker 1: digital presence, but his wife, his mom, his sister, someone
Speaker 1: in his life as not. So if there's someone in
Speaker 1: your life who maybe is at greater risk than you are,
Speaker 1: don't be their weak spot. And if you're in a
Speaker 1: position to do so, talk to the people in your
Speaker 1: life about this. Have these conversations about what are our risks,
Speaker 1: what are our goals, Let's do a digital hygiene and
Speaker 1: check together. Because you can build an impenetrable digital fortress
Speaker 1: around yourself. But if you're aunt Kathy is live streaming
Speaker 1: your baby shower, that didn't do you much good. And
Speaker 1: now that more people are talking about these kinds of concerns.
Speaker 1: You can try approaching the subject with people in your
Speaker 1: life that may not have been receptive to it a
Speaker 1: year ago. Show your mom how to set her Facebook
Speaker 1: to private. Take the time to explain to your less
Speaker 1: political siblings why they should think about the ways in
Speaker 1: which their social media use might expose someone they care about.
Speaker 1: Don't just scold them or you say it's reckless that
Speaker 1: you're doing this, talk about why so when it comes
Speaker 1: to social media, I'm saying delete your Facebook as a
Speaker 1: sort of shorthand for the general cleanup of the stuff
Speaker 1: that you've left online for the last twenty years. Cleaning
Speaker 1: up your online presence is the number one thing you
Speaker 1: can do right now to thwart the bizarro universe version
Speaker 1: of me who is trying to collect every piece of
Speaker 1: information about you. Because even if you're careful today, even
Speaker 1: if you're so smart about it now and you're not
Speaker 1: putting anything online that puts you at risk, you weren't
Speaker 1: always that careful. We're all guilty of it. People who've
Speaker 1: been doing this for a long time, people who know better,
Speaker 1: We're all guilty of being a little messy online. It's okay,
Speaker 1: there's no shame that you didn't know before. Don't feel silly,
Speaker 1: don't feel guilty. Just start cleaning it up today and
Speaker 1: so to figure out what exactly you might have been
Speaker 1: leaving out in the open, one thing you can try
Speaker 1: is doxing yourself, or do it with a friend, right,
Speaker 1: try doxing each other. So start with a completely clean cash,
Speaker 1: deleat your cookies, whatever, Open an incognito browser, start with
Speaker 1: a blank slate, and just google yourself. Google your name,
Speaker 1: your address, your phone number. Google the usernames that you
Speaker 1: currently use on various sites. But google the username you
Speaker 1: used in high school. Google your old aim handle, Google
Speaker 1: the email address you made when you were twelve. What
Speaker 1: comes up? And is that information you want everybody to have?
Speaker 1: Probably not. Start by deleting accounts you don't use anymore.
Speaker 1: Just wipe those bad boys right out. You don't need those.
Speaker 1: A lot of people have no idea that the ghost
Speaker 1: of their old MySpace page still exists online. I've actually
Speaker 1: used that one fairly recently to confirm the details about
Speaker 1: a person's close associates and family members. They hadn't logged
Speaker 1: into MySpace since twenty ten. But your top eight lives
Speaker 1: forever so delete or set to privates any account that
Speaker 1: you don't use, don't need, or just don't need to
Speaker 1: be public facing. Log into every social media site, every forum,
Speaker 1: every online store where you've ever created an account, and
Speaker 1: just look at what's visible. Your online reviews may contain
Speaker 1: information about where you live. Your profile on some forum
Speaker 1: you posted on in twenty twelve probably has your birthday
Speaker 1: on it. And if you're an active Pinterest user, your
Speaker 1: Pinterest boards are probably revealing a lot more information about
Speaker 1: you than you realize, information about your family, your interests,
Speaker 1: your plans for the future. People will make Pinterest boards
Speaker 1: with names like Jaden's second birthday, and now I know
Speaker 1: that you have a son named Jaden whose second birthday
Speaker 1: party you were planning last July. That's a real example.
Speaker 1: So set these things to private. Change your profile picture
Speaker 1: to something that isn't your face. Look at your username.
Speaker 1: Did you have to put some numbers at the end
Speaker 1: of that because the one you wanted was taken? Are
Speaker 1: those numbers your birthday? And vary your usernames a little bit.
Speaker 1: Unless you have some kind of professional reason for using
Speaker 1: a personal brand across every platform, don't use the same
Speaker 1: username everywhere. Keep separate areas of your life. Separate, don't
Speaker 1: make it any easier than it needs to be to
Speaker 1: connect these different pieces of your digital footprint into one
Speaker 1: picture of who you are. Because again I'm not talking
Speaker 1: about becoming completely anonymous online. A lot of people need
Speaker 1: to exist online as the person that they are. You
Speaker 1: have a LinkedIn, you do public facing organizing. I'm not
Speaker 1: saying you need to disappear from online, but if you
Speaker 1: have accounts that you don't want connected back to your
Speaker 1: true identity, If there are pieces of you that exist
Speaker 1: that you don't want side by side, don't connect them.
Speaker 1: So if you anonymously run a social media account for
Speaker 1: an activist group, don't use it to follow your own
Speaker 1: real account. Don't like your boyfriend's posts when you're logged
Speaker 1: into your anarchist shit posting account if you don't want
Speaker 1: it connected to you, don't create overlap. If you post
Speaker 1: a screenshot from one social media platform onto another, a
Speaker 1: screenshot of a tweet on your Instagram, whatever, be mindful
Speaker 1: of what's in that image. Is there a thumbnail of
Speaker 1: your own profile picture in there? Does the screenshot show
Speaker 1: that you interacted with that post? Because a filled in
Speaker 1: heart on an Instagram screenshot is something I have used
Speaker 1: as a building block for a docs. And maybe you've
Speaker 1: never posted anything identifiable on Twitter, but if you've posted
Speaker 1: a link to your Twitter account on Reddit, or are
Speaker 1: you in a big discord and you shared one of
Speaker 1: your own posts with your friends in there, like hey
Speaker 1: look at this bang or tweet I'm going viral. And
Speaker 1: I say both of those specifically because both of those
Speaker 1: are specific mistakes that I have seen people make that
Speaker 1: were for me a crucial link between two accounts that
Speaker 1: connected the dots to figure out who they were. Use
Speaker 1: two factor authentication, use a password manager, use complex passwords,
Speaker 1: never recycle a password. Check databases like have I been poned?
Speaker 1: See what's been leaked about you? And some of that
Speaker 1: data is out of your control now, but it's out
Speaker 1: there and you can't call it back. But you can
Speaker 1: change all of your passwords today. You can download a
Speaker 1: password manager and change all of your passwords today, and
Speaker 1: all of your passwords should be something different from one another.
Speaker 1: I'm going to say it again, change all your passwords.
Speaker 1: Stop using your dog's name as your password for everything.
Speaker 1: It was hard, but I did it, okay. And when
Speaker 1: you're doing this digital hygiene check. You know you're googling yourself.
Speaker 1: You're checking these breach databases. One of the things you're
Speaker 1: going to find is your address, your email address, and
Speaker 1: your phone number, and your parents' names and your parents address.
Speaker 1: All of these pieces of what you thought were personal
Speaker 1: private information. They are bought and sold to data brokers,
Speaker 1: and these data brokers put them online on sites that
Speaker 1: people can pay to access. Fel like people find your
Speaker 1: true people search white Pages. There's hundreds of them. Now.
Speaker 1: By law, all of these sites have to have a
Speaker 1: link on them somewhere where you can ask them to
Speaker 1: delete your information. Some of them make it kind of hard,
Speaker 1: and it may take weeks for them to actually honor
Speaker 1: the requests, and you may have to follow up. But theoretically,
Speaker 1: if they're operating legally, you do have the ability to
Speaker 1: manually clean up how much of your personal information comes
Speaker 1: up from these data brokers. But I'll be honest with you,
Speaker 1: it's whack a mole. You could spend one afternoon a
Speaker 1: week for the rest of your life making opt out
Speaker 1: requests and following up on them and checking back to
Speaker 1: make sure it's really gone. You can do that. I
Speaker 1: used to do that, but there are also services that
Speaker 1: will do it for you for a fee. I think
Speaker 1: there may be an episode in the pipeline examining that
Speaker 1: particular ecosystem and some more details. So I won't go
Speaker 1: into the pros and cons of different services that exist,
Speaker 1: but if that's something you're interested in paying for, do
Speaker 1: some research about it before you put your money down.
Speaker 1: But at the end of the day, I just want
Speaker 1: you to remember you can't solve this whole problem. That
Speaker 1: might sound like a defeatist message, but I think it's healthy.
Speaker 1: I'm not saying it's hopeless. I'm saying you have to
Speaker 1: spend your energy where it counts. People ask me all
Speaker 1: the time, you know, are you worried about this or
Speaker 1: that specific threat? And the answer is yeah, probably, Yeah,
Speaker 1: of course I'm worried. But you can't let that fear
Speaker 1: overwhelm you. You know, if I get fixated on the
Speaker 1: existence of threats that are outside of my control, I'll
Speaker 1: just freak out, and that makes me less capable of
Speaker 1: focusing on mitigating the threats that are within my control.
Speaker 1: So don't put blinders on, don't lie to yourself, you know,
Speaker 1: be realistic, but don't wear yourself out worrying about things
Speaker 1: that are so far out of your control that all
Speaker 1: you have is fear. So today, now take a deep breath,
Speaker 1: delete your MySpace account, and talk to your mom about
Speaker 1: setting all her old Facebook pictures to private. It could
Speaker 1: Happen Here is a production of cool Zone Media. For
Speaker 1: more podcasts from cool Zone Media, visit our website foolzonmedia
Speaker 1: dot com, or check us out on the iHeartRadio app,
Speaker 1: Apple Podcasts, or wherever you listen to podcasts. You can
Speaker 1: now find sources for it could Happen Here, listed directly
Speaker 1: in episode descriptions. Thanks for listening.