Uncertain Future – Part IV – Doxxing

The Gamergate scandal didn’t end at name calling, though. Several key individuals suffered far more than the traditional effects of the average internet rabble. Along with threats of rape and murder, which are disturbing, but easily dismissed given the safety that online anonymity provides, there was another threat, one which pierced that veil of safety and put the power directly in the hands of the mob.

Doxxing.

Doxxing – from documents – search for and publish private or identifying information about (a particular individual) on the Internet, typically with malicious intent.

“hackers and online vigilantes routinely dox both public and private figures.” [11]

During Gamergate the ugly side of the conflict saw the threat, “We will dox you,” begin to surface for the first time. Doxxing, as the definition states is when online users attempt to publish personal information about other users, celebrities, or public figures against their will. This personal information ranges from your real name to private email, banking information, and anything that hackers can get hold of. Once one member discovers it and is able to publish it, the fear is that it may lead to future attacks, such as flooding email accounts with harassment emails via a botnet attack, or worse, people literally able to knock on your door.

And this is exactly what happened to the internet’s Queen, Felicia Day.

Day commented that she had thus far remained silent on the issue of Gamergate to fans and the media, including over 2.3 million Twitter followers at the time, not because she wanted to or didn’t care, but out of fear of getting doxxed  – and seeing her personal information become public knowledge on the seedy parts of the internet.

“I realised my silence on the issue was not motivated by some grand strategy, but out of fear that the issue has created about speaking out. … I have tried to retweet a few of the articles I’ve seen dissecting the issue in support, but personally I am terrified to be doxxed for even typing the words ‘gamer gate’. I have had stalkers and restraining orders issued in the past, I have had people show up on my doorstep when my personal information was hard to get.”

This was posted on her personal blog, in a post titled simply The Only Thing I have to Say about Gamergate. [12]She was immediately attacked online and doxxed. Felicia’s experiences in the past have included direct encounters with stalkers, empowered by knowledge about her that they shouldn’t have access to. Others, such as one of the women central to the beginning of Gamergate, Anita Sarkeesian a game designer who also makes videos explaining misogynist tropes in gaming, were far more disturbing.

According to Time, Sarkeesian, had to flee her home because of violent threats. She was even forced to cancel a speaking engagement at Utah State University after an anonymous person sent a letter to the school administration threatening to massacre students if she spoke. “I will write my manifesto in her spilled blood, and you will all bear witness to what feminist lies and poison have done to the men of America,” the letter read.

Now, perhaps, we are getting the reason that anonymity is something of a concern for security analysts. With abilities such as doxxing, which is just one among many possible issues that internet users face, those who use the internet, or everyone, is going to need to learn to deal with some new and very profound threats. In the way that we prepared ourselves for active shooters with things like A.L.I.C.E. training, training is going to have to be done to teach people how to protect their personal information from slippage, the military term for unwanted dispersal of sensitive information. If we don’t take that initiative,I’m afraid of an internet where anonymity creates a world where there are no activists. Many who have read and follow my work know, if nothing else, one thing about me; I am super American. I like that I have this right and freedom to speak up and speak out, but at the point where living room vigilantes are able to threaten the safety of women for complaining about big tits in video games, along with anyone who happens to listen… I’m seriously afraid of a world twenty years down the road. That anonymity grants protection for criminal acts is something we should very seriously be concerned and something the leaders of the internet need to seriously consider when they list their values. As was mentioned before, to quote Goya, “fantasy abandoned by reason produces impossible monsters.” That said, don’t be surprised if in your next annual security briefing, you see the “Dox” for the first, but not the last time.

Advertisements

Uncertain Future – Part III – Online Harassment

Beginning in August 2014, a the hashtag #GamerGate [6] began to form. It was began by groups of video game enthusiasts on differing camps of the politics of gaming. Those on the side of Gamergate gave the stated purpose for it to be combatting political correctness, censorship, and poor journalistic ethics in video game reporting. Specifically, many organized their efforts to target several female members of the gaming community for attacks against the genre norms and values. In retribution, these women and commenters denied the ethical basis and condemned the affair as misogynistic, which then led to reprisal attacks from across the internet world.

The roots of the debate began as a progressive pull to make  females in video games less… um… genetically improbable babes.

Designers and other feminist gamers argued against the exploitive nature in which females were depicted in many games, showcasing outrageous body types, and surfacing new controversies like “Same Armor/Same Stats” and “Less Armor/More Protection”.

So yeah, anyone who argues that is pretty much arguing, “I want more boobs! Don’t take away the boobs!” Granted, in the defense of the status quo, some interesting arguments did come out  deeper than merely, “Save the boobs!” Many Gamergates, argued that coming down on developers was a legitimate attack on free speech, while others decried the very nature of political correctness for gaming. Perhaps the best I had yet heard gave a rather remarkable feminist appeal by asking whether a very popular, and famously buxom, character from the 1990’s should be “reduced” for the upcoming remake. The argument there was that to retool, some said sensor, a character which is already well known on account of her body type is an attack on anyone who legitimately has that body type. In this case, it sends the message that simply having large breasts or long legs is wrong, and something to be ashamed of.  [7]

I honestly didn’t know if I just heard a masterful counterargument supporting both sides of the controversy from the feminist perspective or simply some grade A BS. Regardless, many of the feminists dismissed such views outright, some retaliating through the absolute attack on what it meant it meant to be a “gamer”, coinciding the meaning with being synonymous with misogyny. This, as it should surprise no one, led to a greater and greater tit-for-tat assault on both sides. More joined the Gamergate cause simply in opposition to the radical feminists among those who in over the top demonstrations, stated that all those who don’t agree with the narrative of the feminists were misogynistic, and eventually homophobic, racists, and bigoted.

That was wrong, but what happened next disappointed many as conversation wasn’t the only thing that came out. Users operating, mostly anonymously via sites like Reddit, 4Chan, and 8Chan, began attacking against leaders on both sides taking the stances that games need to redirect. The attacks eventually grew to threats, including the threat of rape and murder for many of the feminists, and threats to have get many of the Gamergaters fired from their real world jobs. Most of us were surprised it got as bad as it did as fast as it did. I wondered why so many gamers became so visceral in their attacks against activists in the industry, or even just their defense of the boobs. I, along with much of the rest of the gaming community with large internet followings, just wondered with surprise how it got that bad.

And that is what is really scary about online security threats like these. People online can get really mean, hateful, and even cruel. I’m not talking about calling you an “asshat” cruel. I mean subjecting people to the constant barrage of hate that results in  IRL (in real life) ugliness. There is even a hashtag going out on snapchat called #TBR. For those of us blessed not to work with children on a daily basis, you’ve probably never heard of #TBR, but it stands for To Be Rude. Literally, it is nothing but children being hateful to one another, insulting one another in “secret”, via Snapchat. Snapchat is a novel tool for kids because it allows sharing of content that will “delete” after a predetermined time or number of views, and only to those you choose. I suppose this may be useful to revolutionaries fighting against totalitarian regimes, but mostly kids just use it to post pictures of themselves naked and be monsters to one another. It sort of explains the ghost icon, though; a hint of secrecy.

Now where this fits into the GamerGate controversy was that we didn’t just see children acting like children. We saw adults acting very maliciously with the intent to cause fear and psychological harm, with the intended purpose of manipulation. By most accounts, that’s terrorism. What made normal, boring actually, twenty and thirtysomething year old gamers turn into, well let’s call it what it was, terrorists is a question we all need to answer, but it is probably the same reason kids use snapchat to post hateful videos instead of Youtube.

Not getting caught.

In both cases of Snapchat or #Gamergate, the offenders function behind a wall of protection from authority. For middle schoolers acting badly, it is really no different than any other time when mean girls said mean things when no teachers were around. With #Gamergate, we saw something very different. Grown adults behaving online in a way they never would in the real world. Many attribute this to the anonymous nature in which they gathered, communicated, and executed their “operations.”

Anonymity on the internet is an important thing if for no other reason than to understand how people act when functioning under the guise of anonymity. Dr. John Suler is a Professor of Psychology and has written on the subject of online behavior. In his paper The Online Disinhibition Effect, Suler argues that those on the internet are able to disconnect from their normal behaviors and can frequently do or say as they wish without fear of any kind of meaningful reprisal. An example being most Internet communities, even one such as Quora which uses real names. The worst kind of punishment an offender can expect for bad behavior is being banned from interaction. In practice, however, this serves little use; the person involved can usually circumvent the ban by simply registering another username and continuing the same behavior as before [8]. Suler calls this toxic disinhibition.

CB radio during the 1970s saw similar bad behavior:

Most of what you hear on CB radio is either tedious (truck drivers warning one another about speed traps) or banal (schoolgirls exchanging notes on homework), but at its occasional—and illegal—worst it sinks a pipeline to the depths of the American unconscious. Your ears are assaulted by the sound of racism at its most rampant, and by masturbation fantasies that are the aural equivalent of rape. The sleep of reason, to quote Goya’s phrase, brings forth monsters, and the anonymity of CB encourages the monsters to emerge.

Suler’s work was a brilliant synopsis, but we on the internet need a simplified version. “John Gabriel’s Greater Internet F***wad Theory” was a posted comic strip by Penny Arcade. The post regards reflects the unsocial tendencies of other internet users as described by the online disinhibition effect. Krahulik and Holkins, Penny Arcade’s creators suggest that, given both anonymity and an audience, an otherwise regular person becomes aggressively antisocial. [9]

How this relates to security is obvious to those who have experience it. The internet can feel like an unsafe place sometimes. The internet can be an unsafe place sometimes. Looking to the long term effects of bullying that are being better understood every day [10], sometimes I wonder if this place I’ve called a second home is a place I want my kids to play on. Most of us who are active on this playground understand this as the status quo, but in the future of internet security, the debate will center around the freedom to be private and the freedom to be anonymous. Many fear, given precedence, what may happen under this veil of anonymity. I can’t help but agree that his is a rational concern for many. Sometimes the internet comments go far beyond words or threats, which carry lasting psychological damage to some of the victims, but transforming to very legitimate real world threats. What this will mean for the future is that companies is deciding what kind of culture they want to deal with. For the internet to stay the internet we want to be on, we may see more companies adopt guidelines like Quora’s, with it’s real names policy and Be Nice Be Respectful Policy, a place where people feel welcome and safe to exchange and interact.