“People will try to find where you live”: On doxxing and the social media surveillance monster

CW: violence, transphobia, sexual abuse

Kiwi Farms (KF), a creepy AF troll community that operates across a forum board platform and a handful of wikis, once had a signup page that read: “Autistics will be laughed at. Trannies will be misgendered. People will try to find where you live”. Kiwi Farms is among a niche (but loud) community of trolls who make it their life goal to disrupt and upset folks online for the unholy fun of it. We’ve all encountered trolls in our lives, they come in many forms and usually spend their time trying to disrupt conversations, seed discord, and argue for the fun of it. Trolling is a widely mainstream activity that many of us have likely encounter in just about all digital spaces. In fact, I’ve also tapped into the dark, trickster-y satisfaction of trolling in quite a few conversations over my years.

However, KF trolls, along with trolls who come from 4chan, 8chan, and various other obscure and offensive Internet communities, are markedly different. Whitney Phillips, an ethnographer who’s spent thousands of hours studying trolling practices, uses the term “subcultural troll” to characterize those who not only engage in the act of trolling but self-identify as a troll. Subcultural trolls share obscure Internet memes, have their own parlance and lingo, and live and die for the lulz.

The lulz is a feeling of overwhelming joy that follows pissing someone off or wrecking their online social life. To a subcultural troll the only thing better than the lulz is its fallout. Trolls will set up their tricks through an array of surveillance, social engineering, and sometimes hacking, wait for their mark to stumble into their trap, and enjoy the unending pleasure of wrecking havoc on a person’s life.

doxxing and political violence

Doxxing is the practice of collecting personal information on a person’s legal identity and Internet activities and publishing them to hostile digital publics. Sometimes, this will mean collecting information on a persons Internet browsing history, pseudonyms, pictures, and any embarrassing information that can be easily scraped through a basic Google search. Other times, a doxx can include publishing a home address, social insurance number, personal phone number, and the identity of relatives.

What is most damaging, however, is the online fallout. Doxxing often entails dropping this data over a hostile digital public. Some trolls dump data on Github, neo-Nazi sites, or as in the case above, the Kiwi Farms forum board. This is followed by “name and shame” tactics that are designed to encourage digital harassment in order to punish a person for a perceived wrong.

The word is a shorthand for the phrase “dropping docs” which was historically used as a method to de-anonymize hackers and software pirates to reveal their personal information online. Doxxing is used a method of revenge, vigilantism, or political violence.

Doxxing is effective, folks who get doxxed become embattled over the Internet as they have to deal with both having their activities monitored and scrutinized by troll-y social media platforms and hostile strangers slipping into their DMs with abusive and terrifying content. After a doxx is dropped on a hostile forum board, the onslaught of abuse has the potential of becoming relentless.

Doxxing for the lulz is a form of political violence. Though trolls ostensibly claim that they aren’t political, their harassment of women who don’t fit their sexist standards of what constitutes a proper or desirable body is very telling. For instance, KF often targets trans, disabled, and fat women for harassment and much of their abuse usually clusters around topics of unattractiveness, sexual abuse, and cissexist insults. Basically patriarchy 101.

KF trolls are constituted by an unsavory cocktail of far-right politics and lulzy antics that make up their fringe political ideals. Though it’s worth saying that due to the messiness of trolling subcultures, their politics aren’t clear cut. Across a great deal of social media platforms, far-right trolls encompass an uncoordinated grouping of Internet subcultures that include trolls, incels, men’s rights activists, pick-up culture, and other similar groups who organize under the banner of bigotry. These groups aren’t a unified front, but more like a constantly shifting coalition of interests that are organized by explicitly racist, anti-queer, and anti-feminist sentiments.

I bring up Kiwi Farms for a reason. Kiwi Farms engages in what I’ve come to call do-it-yourself (DIY) gender policing, or the strategic monitoring, doxxing, and harassment of marginalized women through the use of accessible Internet technologies. This form of strategic harassment is made possible through the visibility afforded to us by daily participation in social media platforms across the Internet. For many of us, a life time of engaging in social media means that there is an abundance of information about our intimate lives scattered across the Internet. Those who engage in DIY gender policing borrow from the punitive logics of security and intelligence agencies in order to punish women who they see as threatening the status quo or challenging “Western values” of whiteness and freedom of speech.

For those of us who experience marginalization on a daily basis, the presence of far-right trolls on the Internet can transform our participation in digital spaces into a paranoia-fueled nightmare.

I can already hear the accusations of being an SJW snowflake. Just turn of the screen, they will furiously type into their keyboards. It’s harmless fun, and besides, you don’t have to read it. But this is so far from the truth. Digital spaces have become so ubiquitous that our presence in them are non-negotiable. Internet citizenship is essentially mandatory in contemporary society. Besides, running away from the Internet while your online presence is embattled by trolls at the gates just means that they win. And fuck that.

Being visible, being exposed

Many of us spend and increasing amount of time on the Internet. Oftentimes, for those who engage in any kind of knowledge or creative based work, the Internet is our home, a way to contribute our work to the wider public discourse. For journalists, activists, artists, and academics, our IRL identity and our digital identities are becoming increasingly wed together.

Much of our time on the Internet is underscored by our reliance on social media where we render our legal identities visible for others to scrutinize. This is called the real-name web, and it’s become entirely normalized. Many of us rarely consider the consequences of putting so much of our intimate life on display for others. We might have used a multitude of social media platforms throughout our tenure on the Internet, each one betraying disparate details into our private lives.

We can’t leave the Internet, but we can certainly prepare ourselves to both defend our Internet presence and fight back. What follows is a loose set of methods for thinking about your personal security over the Internet. You should put them to practice to protect yourself and your femme sisters from the far-right trolls who hate us. As I am myself not a technical person, I’ve drafted these thoughts on security to be accessible to anyone who’s willing to do a bit of googling.

As Emma Jane writes in her substantive digital historiography of online misogyny, there is a long and dark history of misogynist abuse used against women who speak up in digital spaces. Much of this abuse is conducted through “rapeglish” or the practice of sending women messages that contain threats of violence and sexual abuse. Other forms of digital misogyny might include transphobic slurs, accusations of being fat, ugly and slutty, comments on mental health issues or ability, and abuses derived from a disdain for queer sexualities.

For trans women, digital transmisogyny takes on a slightly different form. Trans women are derided for being “troons” (trans women who don’t pass as cis and are thus comedic caricatures), for being mentally ill and delusional, for mutilating themselves, and are constantly misgendered and deadnamed. This can often be on top of threats of violence or encouragements to commit suicide.

Being doxxed by KF trolls and having abusive comments slide in your DMs or the awareness that your online activity is being monitored can be a terrifying experience. For those of us stand-up to this abuse, we are often accused of enjoying the attention. Our resistance can be taken as an invitation for more abuse.

But we can’t stay silent, it only lends to a society that accommodates such abuse and pins the fault on the women defending themselves against violence, as opposed to addressing the abusers themselves. In the short term, there is nothing we can do as individuals to change the heavy saturation of abuse on the Internet, but we can sure as hell take measures to protect ourselves, slow down the efforts of trolls, and mediate the damage they might cause to your life.

Threat modelling 101

It’s a pretty daunting job to begin addressing all of the security threats that our day-to-day Internet practices might facilitate. I know for myself, I had a lot of habits to start chipping away at and it took quite some time to get some basic understandings of how to foster a better operational security (op-sec).

It is worth understanding that we can never be fully secure. There are far to many digital threats for the average person to realistically address in their day-to-day lives. So we need to work on strategies that help us manage the more realistic threats in our lives. This is what security experts call “threat modelling”. The Electronic Frontier Foundation (EFF) defines threat modelling as “a way of thinking about the sorts of protection you want for your data so you can decide which potential threats you are going to take seriously”.

To begin threat modelling, start scribbling down a list of potential threats that you may need to take precautions around. For instance, if you’re a trans feminine journalist, you might need to consider the threat posed by far-right Kiwi Farms trolls and the TERFs on mumsnet. You are much likely to come under their scrutiny than you are from the secret agent type NSA and CSIS threats. Next, you will want to consider how exactly they might pose a threat to your op-sec. For instance, most of what you should be concerned about are publicly available data from your older social media accounts, any personal public photo albums or blogs, pseudonyms or handles that can be easily linked to your legal identity, and any leaky social media accounts that you’re currently using.

And finally, you will want to brainstorm solutions to those threats. Start with searching for old accounts from your past and finding methods of having them shut down and removed from the Internet. Close down any photo album or blog that you don’t want hostile users pilfering data from. Delete any pseudonyms that can be linked to your legal name. And finally, max out your privacy settings on all of your current social media accounts.

Facebook is a surveillance monster, slay it.

Your memberships across social media platforms are your biggest source of insecurity. For many of us, our social media accounts are defaulted to public and an appalling amount of personal data can easily be made publicly accessible to anyone with the mind to look.

I’ve been using social media for as long as I remember and for the longest time I had forgot about my old MySpace accounts that meticulously documented my angsty and embarrassing emo years from the early 2000s. From the advent of Facebook to now, data about our personal identities are spread across the Internet. They may be fractured, but with minimal effort they can be brought together to map your behavior and highlight anything that might lead to public embarrassment.

What’s more is that all of this excessive visibility is entirely normalized. Most of us will never even consider the consequences of all of this data until someone comes searching for it. And as Emma Jane has noted in her work, it isn’t always us SJW types that suffer from digital misogyny. Oftentimes it’s everyday women who might build a big enough digital footprint to attract abusers.

We live in a culture of visibility, where we willingly (and playfully) compromise our own privacy and security to participate with our friends and family in the digital public. And for KF trolls, this is the primary source of data for their doxxing practices.

Not only is Facebook a surveillance machine in and of itself, it’s also a technology that facilitates us watching each other. We curate our self-identity on a profile, and scroll through our newsfeeds to watch and lurk others. Facebook is a fucking surveillance monster, and if we’re going to challenge the pervasiveness of this culture of visibility, we need to slay it. Either hit that delete button or configure those privacy settings to max. This is important for protecting ourselves, but also others who might be in your friends list and commenting on your posts. If you’re not careful, you can easily become a leaky container and compromise your femme comrades.

The primary goal of KF trolls is to find embarrassing information, and this isn’t hard. We’ve all posted unfortunate things to the Internet. Things that we often quickly forget existed.

Unlinkability and using a shit ton of pseudonyms

We’ve become way to accustomed to existing on the real-name web, where most of our Internet browsing is tied to our legal identity through Facebook accounts. For a lot of people, this isn’t an immediate or concerning issue and its easy to ignore the dangers of being so visible. However, when it rains it pours. If you become the target of a troll, your visibility becomes a weapon that will be turned in on you.

As you might remember, in the Internet of yesteryear, many of us used a host of different pseudonyms as we lurked in instant chat sites, forum boards, and other digital communities. When you use a series of different and unrelated pseudonyms, much of your traffic becomes essentially anonymous. Many of us still use pseudonyms when we browse today, but because of the normalization of the real-name web, these accounts can often be linked back to your name.

We need to move back to digital publics that are premised on pseudonyms and anonymity. In order to help facilitate this, consider how you might foster unlinkability between all of your accounts. This is the practice of being sure that a troll isn’t going to follow the pixelated bread crumbs of your data trail and connect all your handles to your legal name. Disconnect any account associated with Facebook, and remake those accounts with randomized pseudonyms.

Going dark

The Internet is a dangerous place, and as women, we are prime targets for harassment and abuse. This is especially the case if you’re a feminist speaking up about the injustices about the white supremacist, cis- and hetero-patriarchy. Far-right trolls HATE feminists who they deride as SJW snowflakes. Take some time to start threat modelling and map out how you might approach strengthening your operational security. We all have leaky social media data that we need to plug up and there is no better time to start then now.